Vulnerabilities
Tue 8 Sep
Updated Thu 29 Oct
Schneider Electric's security notification SEVD-2026-251-04 (8 September 2026) describes CVE-2026-3869, an incorrect implementation of an authentication algorithm (CWE-303) in Modicon M580 and Modicon M580 Safety controllers. Schneider says failure to apply the remediations may risk establishing an unauthenticated connection to the controllers, which could result in loss of confidentiality, integrity and availability of the PLC, when an application project with a lower application level is running on it. Schneider rates it Critical: CVSS v4.0 9.2 and CVSS v3.1 9.8. Affected: Modicon M580 with an application level below 4.00 and Modicon M580 Safety with an application level below 4.20. Remediation: for M580, firmware 4.10 or above and an application project at application level 4.00 or above (available in EcoStruxure Control Expert V15.2 or later); for M580 Safety, firmware 4.21 or above and application level 4.20 or above (EcoStruxure Control Expert V16.0 with HF001 or later). (source: Schneider Electric SEVD-2026-251-04) Schneider's security notifications index lists other advisories published the same day, for EcoStruxure IT Data Center Expert (CVE-2026-19233, CVE-2026-8044), PowerLogic T300 RTU (CVE-2026-77120) and SCADAPack x70 products (CVE-2026-81861), and shows older Modicon advisories last updated that day. (source: Schneider Electric security notifications) Correction (29 Oct 2026): this card previously combined Schneider Electric, Siemens, AVEVA and Rockwell September ICS advisories from a news report; Siemens now has its own card, the AVEVA and Rockwell mentions were removed because no readable source for them is linked, and this card is now sourced from Schneider's own notifications. The card date is now 8 September 2026, the date on Schneider's notification (it was 9 September). (source: Schneider Electric SEVD-2026-251-04)
Schneider Electric SEVD-2026-251-04 — Modicon M580 and M580 Safety (8 Sep 2026)
vulnerabilities ot ics network
Vulnerabilities
Tue 8 Sep
Updated Fri 30 Oct
Ivanti's September 2026 security update (blog, 8 Sep 2026) discloses flaws in Neurons for ITSM, Sentry and Endpoint Manager Mobile (EPMM). According to Ivanti's CVE records (published 8 Sep 2026 UTC), Neurons for ITSM before 2026.2 is affected by missing-authorization flaws CVE-2026-12645, CVE-2026-12646 and CVE-2026-12647 and deserialization flaw CVE-2026-12650, each letting a remote authenticated attacker execute arbitrary code on the server (CVSS 9.9), and by deserialization flaws CVE-2026-12744 and CVE-2026-12745, which let a remote unauthenticated attacker execute arbitrary code (CVSS 9.8). Sentry before R10.8.2, R10.7.3 and R10.6.4 has authentication bypass CVE-2026-83527, letting a remote unauthenticated attacker gain administrative access (CVSS 8.1), and EPMM before 12.10.0.0, 12.9.0.2 and 12.8.0.4 has missing-authorization flaw CVE-2026-18851, letting a remote authenticated attacker escalate to admin (CVSS 8.8). Ivanti's blog says it has no evidence of exploitation in the wild and that no other Ivanti products are affected. (sources: Ivanti September 2026 Security Update blog; CVE records) Correction (30 Oct 2026): removed a bug count and fixed-build details that only SecurityWeek, which this desk cannot read, gave; CVE details are now credited to Ivanti's own CVE records. (source: CVE records)
Ivanti September 2026 Security Update blog (8 Sep 2026)
vulnerabilities identity cloud network
Vulnerabilities
Tue 8 Sep
Google's Stable Channel Update for Desktop (8 September 2026) promotes Chrome 153 to 153.0.8010.36 (Linux) and 153.0.8010.36/.37 (Windows/Mac). Google lists Medium CVE-2026-87491 as an out-of-bounds write in V8 (reported 6 August 2026 by Jihyeon Jeong, Compsec Lab, Seoul National University) and states an exploit exists in the wild — the seventh Chrome zero-day Google has fixed in 2026 per same-day press coverage. BleepingComputer (9 September) describes remote code execution inside the sandbox via crafted HTML and heap corruption risk; Google has not published attack details while uptake is incomplete. Update Chrome promptly; other Chromium browsers should follow vendor builds. NEW 11 September 2026 (WA SOC advisory 20260911001, TLP:CLEAR): Chromium V8 Known Exploited Vulnerability covers the same CVE-2026-87491 for Google Chrome versions prior to 153.0.8010.36; WASOC table lists CVSS 8.8 High (out-of-bounds write enabling code execution inside the sandbox via crafted HTML). Notes Google is aware of in-the-wild exploit use and CISA KEV listing; WASOC had not received reports of exploitation on Western Australian Government networks at time of writing. Patch Chrome/Chromium browsers to 153.0.8010.36+ per vendor.
Chrome Stable Channel Update for Desktop (8 Sep 2026)
vulnerabilities cloud
Vulnerabilities
Tue 8 Sep
cPanel's 8 September 2026 advisory is titled SQL injection in EmailTrack. The body says an authenticated account with mail-related privileges can create arbitrary files through EmailTrack, and that success is code execution as root. All supported versions. Patched builds: 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and WP Squared 11.138.1.9. Credit to Ali Mustafa (rz1027) and abed1526. No CVSS and no exploitation claim on the vendor page. Separate from the August domain-parking flaw and from the April login bypass. THN (9 Sep) confirms no public exploit and absence from CISA KEV catalog version released 8 Sep; notes related July DB and August parking flaws have purported exploit repos online.
cPanel advisory (8 Sep 2026)
vulnerabilities cloud
CrowdStrike (covered by The Hacker News, 8 September 2026) tracks Slim Spider, a Brazil-based e-crime cluster active against Brazilian financial institutions since at least March 2026. In a late-March 2026 multi-stage intrusion at a Brazilian financial institution, the actor targeted crypto custody assets and Pix instant-payment infrastructure: custom Bash scripts queried cloud instance metadata for temporary credentials, enumerated secrets in the cloud credential manager, used Foundry cast to derive an Ethereum wallet address from a stolen private key, and implemented cloud-native signing via OpenSSL. The actor also pivoted to Azure DevOps to run malicious pipelines that deployed implants across a managed Kubernetes cluster, including backdoors mimicking legitimate infrastructure binaries (e.g. "spi" impersonating Sistema de Pagamentos Instantâneos). (sources: CrowdStrike adversary page; The Hacker News)
CrowdStrike — Slim Spider adversary page
breaches cloud identity
Vulnerabilities
Tue 8 Sep
The Hacker News (8 September 2026) reports security firm Calif built a worm that takes over a WeChat account via an incoming call and demonstrated spread across three test phones. The callee does not need to answer or touch the phone, but the caller must already be a WeChat contact. Calif reported the flaw to Tencent in July and says the company has since shipped a fix (report does not name a CVE in the RSS abstract). Treat as a messenger client/patch urgency item for WeChat on iPhone and Android; confirm your app store build is current. (source: The Hacker News)
The Hacker News — WeChat Calif worm (8 Sep 2026)
vulnerabilities identity australia
Vulnerabilities
Tue 8 Sep
SAP’s September 2026 security patch day (covered 8 September 2026 by BleepingComputer and SecurityWeek) includes CVE-2026-44756, a maximum-severity memory-corruption bug in Extended Passport (EPP) processing in the SAP kernel, dubbed OVERPASS by Onapsis. Missing boundary checks on externally supplied length fields during EPP deserialization can let unauthenticated attackers run OS commands as the SAP installation owner, recover DB credentials/password hashes, read live user sessions, and modify data/binaries. Onapsis says EPP is hit as a session opens (before authz controls), via web/ICM, SAP GUI, and RFC; products relying on the vulnerable kernel include S/4HANA, ERP/ECC, NetWeaver, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO, Solution Manager and others. Onapsis estimates >10,000 internet-facing SAP web interfaces; no in-the-wild exploitation indicators reported for OVERPASS at publish. Same cycle: CVE-2026-58240 (S4GET) missing authentication on NetWeaver Message Server enabling unauth cluster RCE as <sid>adm; also critical CVE-2026-76969 (CAP credential disclosure) and CVE-2026-66768 (NetWeaver access control). Apply SAP Security Notes for September 2026 immediately; do not invent CVSS for sister CVEs beyond vendor/Onapsis statements. (sources: BleepingComputer; SecurityWeek)
BleepingComputer — SAP OVERPASS CVE-2026-44756 (8 Sep 2026)
vulnerabilities cloud identity ot ics
Vulnerabilities
Tue 8 Sep
Updated Thu 29 Oct
Microsoft’s 8 September 2026 Patch Tuesday is its largest security release on record. BleepingComputer counts 966 flaws shipped on Patch Tuesday itself (105 Critical, including 81 RCE), excluding 204 flaws fixed earlier in the month in cloud products. Two actively exploited elevation-of-privilege zero-days are fixed: CVE-2026-81963 (Windows Update Stack link-following to SYSTEM; credited to Romain Deperne and MSTIC) and CVE-2026-85880 (Windows ALPC heap buffer overflow to SYSTEM / AppContainer sandbox escape; Volexity and Proofpoint researchers). Coverage notes ~20 potentially wormable unauthenticated RCEs in the set and calls out Exchange (CVE-2026-55007), SharePoint (CVE-2026-69465), RDS (CVE-2026-69525), SQL (CVE-2026-65669), and Authenticator (CVE-2026-80097) among high-priority items. Microsoft attributes the volume increase partly to AI-assisted vulnerability discovery. NEW 8 Sep KEV: CISA added both exploited zero-days to the Known Exploited Vulnerabilities catalog on 2026-09-08 (catalog 2026.09.08) — CVE-2026-81963 and CVE-2026-85880 (FCEB dueDate 2026-09-22). WA SOC advisory 20260909001 (9 September 2026, TLP:CLEAR) summarises the September Monthly Updates as addressing 973 vulnerabilities, highlights critical CVE-2026-69730 and CVE-2026-69525 (CVSS 9.8) plus the two known-exploited EoPs (CVSS 7.8), notes Microsoft detected exploitation of one or more of the mentioned vulnerabilities, and says WASOC has not received WA Government exploitation reports at the time of writing. Prioritise the two exploited EoPs, internet-facing roles, and Extended Security Updates where applicable. UPDATE (23 Oct 2026; Enclave, Microsoft): Enclave researcher Ofek Levin published details on 23 October of 'AuthMask', a Microsoft Authenticator for Android flaw tracked as CVE-2026-80097, which Microsoft's advisory lists as released on 8 September. Enclave says Microsoft confirmed and fixed the issue after Enclave reported it. Enclave also says an Android app with zero permissions could pretend to be any installed Microsoft first-party app, such as Teams, and get Authenticator, acting as the sign-in broker, to hand it that app's tokens for a work account signed into Authenticator, because an exported activity trusted the caller's own description of itself; in Enclave's tests the tokens gave full delegated mailbox, files and calendar access and, by impersonating Authenticator's own client, the ability to create and delete passkeys, with no user interaction beyond having Authenticator signed in to a work account. Microsoft's advisory (released 8 September) rates it CVSS 3.1 8.6, Important, says an attacker would need to install a malicious app on the device and convince the user to complete an authentication flow in Authenticator, and lists it as not exploited and not publicly disclosed at the time of original publication; the CVE record lists Microsoft Authenticator for Android from 6.0.0 to before 6.2606.4246 as affected. Help Net Security reported the research on 27 October. (source: Enclave; Microsoft Security Update Guide CVE-2026-80097; Help Net Security) Correction (29 Oct 2026): removed a CVE count credited to SecurityWeek and Krebs, which are not linked sources. (source: Microsoft)
BleepingComputer — September 2026 Patch Tuesday (8 Sep 2026)
vulnerabilities cloud identity australia
Vulnerabilities
Tue 8 Sep
The Hacker News (8 September 2026) summarises Red Hat guidance that a FreeIPA flaw lets a client that has never logged in create a Kerberos identity of its choosing in the directory and end up in the administrators group. FreeIPA stores identities in 389 Directory Server over LDAP; the attack also needs a second flaw in that database software. The Hacker News's report does not list CVE IDs or fixed package versions — operators should pull current RHEL/FreeIPA errata from Red Hat rather than inventing patch levels. (sources: The Hacker News pending RHSA deep-link; Red Hat)
The Hacker News — FreeIPA admin credential chain (8 Sep 2026)
vulnerabilities identity cloud
BleepingComputer (8 September 2026) covers German firm Nebty’s report on DoppelCart, a fake e-shop cluster of more than 119,000 domains (mostly .SHOP; Nebty says ~2.72% of that TLD), with more than 105,000 still active in latest scans. About 96% of confirmed shops share identical build files and resolve to 27 commerce backends; they impersonate ~44,182 brands (median two clones each; some brands >30 clones) and advertise discounts up to ~65%. Checkout pages collect PAN, expiry, CVV, name, email, phone and address over WebSockets to C2 in real time, and can relay bank OTPs. Victims sometimes email the real brand’s support address shown on the fake shop. Nebty built a searchable brand-abuse database and said the main hosting provider did not respond. Distinct from BogusBazaar (~75k sites). (source: BleepingComputer)
BleepingComputer — DoppelCart (8 Sep 2026)
tech cloud identity
Check Point Research (published 8 September 2026; covered by The Hacker News the same day) found a covert two-way channel between code-execution containers of separate ChatGPT accounts via an internal JFrog Artifactory package service those containers could all reach. Containers could write/read shared item metadata, turning package-delivery properties into a clipboard between supposedly isolated sessions. A planted prompt, shared conversation link, or custom GPT instruction could make a victim session pull a hidden task, use the victim’s already-granted connected-app permissions (CPR demo: Gmail), and exfiltrate results to the attacker’s session while the visible reply looked normal; CPR noted a small “Talked to Gmail” label after the fact. OpenAI confirmed the specific internal Artifactory instance was decommissioned after disclosure. CPR also notes its PoC predated separate activity on that Artifactory instance linked to a Hugging Face compromise OpenAI has disclosed. Lesson: AI assistants with tool/connectors are coerced-insider risk. (source: Check Point Research blog)
Check Point Research — ChatGPT hidden channel / Gmail (8 Sep 2026)
ai cloud identity network
Incidents
Tue 8 Sep
Updated Sun 25 Oct
BleepingComputer exclusive (8 September 2026): Kinryū Labs found an internet-reachable Elasticsearch cluster named "pax-info" (Viettel-assigned IP space, Hanoi) holding Advance Passenger Information System (APIS) data — 210,318,069 passenger and 10,465,631 crew records (220,783,700 entries, ~107 GB across 29 indices) spanning January 2017 to April 2026. Fields included names, dates of birth, sex, nationalities, passport/travel-document numbers and expiry, issuing countries, plus flight numbers/dates, airlines, origin/destination/transit airports, seats, baggage refs, and scheduled/estimated/actual times. Sample records reviewed included Korean, Chinese, Canadian, and New Zealand nationalities among others; many international carriers across Asia-Pacific, Europe, and the Middle East appear, so travellers who flew to/from/through Vietnam may be affected (counts are travel records, not unique people). Access path: open internet returned HTTP 401, but a cloud-based path reached the cluster which then accepted default credentials (FOFA saw the host/port from Oct 2022; exposure duration via the second path unknown). Kinryū reported to Vietnamese authorities, airlines, and national CERTs from 3 June 2026; access remediated 8 June 2026 after Singapore Airlines security helped coordinate containment. No ransom notes or sales listings found; without server logs, prior copying cannot be ruled out. Operator organisation not confirmed. Kinryū Labs published its own report on 9 September 2026. (sources: BleepingComputer; Kinryū Labs)
BleepingComputer — Vietnam-linked APIS leak (8 Sep 2026)
breaches australia cloud identity
