CISA published ICS advisories ICSA-26-244-01 and ICSA-26-244-03 for Rockwell Automation products, both with a release date of 1 September 2026. ICSA-26-244-01 covers RSLinx Classic version 4.50 and earlier: four vulnerabilities (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625) let a crafted CIP packet crash the RSLinx Classic service, which then has to be restarted; CVE-2026-9621 and CVE-2026-9622 are rated CVSS 3.1 8.6 (High) and CVSS 4.0 9.2 (Critical), and the other two CVSS 3.1 7.5 and CVSS 4.0 8.7; the fix is version 4.60. ICSA-26-244-03 covers CVE-2026-9637 (CWE-119) in ControlLogix 5580, CompactLogix 5380, GuardLogix 5580 and Compact GuardLogix 5380 controllers at V33 and earlier, V34.011 to V34.014, V35.011 to V35.013 and V36.011 to V36.012, where exploitation causes a major nonrecoverable fault (MNRF) that needs a power cycle; it is rated CVSS 3.1 7.5 and CVSS 4.0 8.7, with fixes in V37.011, V34.015, V35.014 and V36.013. For both advisories CISA says no known public exploitation specifically targeting these vulnerabilities has been reported to it. (source: CISA) Correction (31 Oct 2026): removed the SecurityWeek link and credit, which this desk cannot read; this card now covers only the two CISA advisories we have read (it previously listed other Rockwell products from SecurityWeek), and the card date moves from 2 to 1 September 2026, the CISA release date. (source: CISA)
Mozilla's advisory MFSA 2026-82 (announced 1 September 2026) lists 29 vulnerabilities fixed in Firefox 155, with an overall impact of high; Mozilla rates 13 of them high, 7 moderate and 9 low. They include sandbox escapes due to use-after-free in the DOM: Navigation (CVE-2026-84119) and DOM: Security (CVE-2026-84121) components, a privilege escalation due to use-after-free in Graphics: WebGPU (CVE-2026-84123), use-after-free flaws in the JavaScript: GC (CVE-2026-84118) and Audio/Video components, and internally found memory-safety bugs that Mozilla says showed evidence of memory corruption and that it presumes could have been exploited with enough effort. Mozilla does not say any of them is being exploited in the wild. (source: Mozilla MFSA 2026-82)
Mozilla MFSA 2026-82 — Security Vulnerabilities fixed in Firefox 155 (1 Sep 2026)
Google's Stable Channel Update for Desktop (1 September 2026) promotes Chrome to 152.0.7977.75/.76 on Windows and Mac and 152.0.7977.75 on Linux, with 26 security fixes. Google rates two Critical, both use-after-free flaws reported by Google: CVE-2026-84353 in Shared Tab Groups and CVE-2026-84352 in WebGL. It rates nine High, including incorrect authorization in FileSystem (CVE-2026-84354), an information leak in Skia (CVE-2026-84359), improper input validation in Omnibox (CVE-2026-84357), use-after-free flaws in Proxy, Browser and Dawn, a buffer overflow in GPU and an uninitialized resource in V8, plus ten Medium and five Low. Google's post does not say any of the flaws is being exploited in the wild and gives no CVSS scores. (source: Chrome Releases) Correction (29 Oct 2026): this card previously covered both Chrome 152 and Firefox 155; Firefox 155 now has its own card, sourced from Mozilla's advisory, and the news report the Firefox figures came from is no longer linked here. The card date is now 1 September 2026, the date shown on Google's post (it was 2 September). (source: Chrome Releases)
Microsoft Security Blog (1 September 2026) details an active campaign of high-fidelity fake vendor download sites (.com.cn / .hl.cn lookalikes for brands including Microsoft Edge, Razer, Kaspersky, Sejda, Calibre and others) that serve ZIP installers whose hashes rotate per download. Payloads establish persistence via disguised scheduled tasks, write sweeping Microsoft Defender exclusions (including short-lived SYSTEM tasks), delete volume shadow copies, stop/disable Windows Update services (wuauserv, UsoSvc, uhssvc, WaaSMedicSvc), and C2 on non-standard ports (e.g. 5090, 7031–7090, 8050, 28290, 28300) plus six-character .net domains. A parallel path uses msiexec -Embedding. Microsoft assesses with moderate confidence consistency with the publicly reported Silver Fox (Yinhu) fake-software campaign but does not attribute a nation-state. Victims span healthcare, manufacturing, gaming, technology, logistics, government and education, primarily China-based operations / Chinese-speaking users. Primary mitigations Microsoft names: Tamper Protection, SmartScreen/network protection, hunt randomized drops under Public/ProgramData/Program Files (x86), and block look-alike ZIP download patterns.
SecurityWeek (2 September 2026) reports CVE-2026-84115 in Cleo Harmony file-transfer: improper privilege management in the JWT refresh token handler on /api/connections, where manipulating the Bearer argument can let a remote attacker elevate privileges. VulDB (listed as CNA-style record in public mirrors) says builds through 5.8.1.10 are affected, a public exploit exists, and upgrading to 5.8.1.11 fixes it. Cleo's Harmony 5.8.1 release notes list 5.8.1.11 as a 15 May 2026 limited/restricted build and do not expand on this CVE in the public notes SecurityWeek also noted thin vendor detail. WatchTowr (quoted by SecurityWeek) has reproduced the issue and flags Harmony as a frequent ransomware target historically. This Cyberstack does not invent a CVSS beyond what secondary reporting attributes; Cyber Security News cites 8.3 High for the same CVE. Patch to 5.8.1.11 or later; hunt anomalous /api/connections auth traffic.
iTnews (1 September 2026) reports the Attorney-General's Department released the Privacy Amendment (Personal Data Protection) Bill 2026 for consultation. The draft would replace the Notifiable Data Breaches scheme's "as soon as practicable" OAIC notification standard with a fixed 72-hour deadline once an entity has reasonable grounds to believe an eligible data breach has occurred, aligning NDB timing with 72-hour windows used under the Security of Critical Infrastructure Act 2018 and ransomware-payment reporting in the Cyber Security Act 2024. The existing 30-day window to assess a suspected breach would remain; entities unable to file a complete statement in time could lodge an incomplete one with written notice of what is missing. Failing to file within 72 hours could attract an infringement or compliance notice. The same package proposes a narrow erasure right limited to large digital platforms (Online Safety Act services clearing $500m gross revenue or 2.5 million average monthly Australian end users), not an economy-wide deletion duty. This is draft consultation legislation, not yet enacted.
UPDATE 17–19 October 2026: researcher Zach Main published the Plex2Shell write-up and proof-of-concept code on 16 October, showing how four of the flaws chain into unauthenticated remote code execution on Plex Media Server before 1.43.3.10861: the /player/timeline SSRF (CVE-2026-96652) is used to call searchOne (CVE-2026-96654) and obtain the owner's admin token, the transcoder SSRF (CVE-2026-96655) fetches an attacker-hosted file, and the Codecs path flaw (CVE-2026-96656) writes it as a shared object that Plex then runs. The fixes shipped in PMS 1.43.3.10861 on 3 August, after Zach Main reported the bugs to Plex on 27 July. Researcher boredhackerblog reported in-the-wild exploitation of a honeypot from the morning of 17 October, first from 45.194.92[.]222 and also from 91.92.40[.]202 and 176.65.139[.]228, which downloaded payloads from 217.60.194[.]116: an XMRig miner (seen as 'mylovelyminer', mining to ota.proxystream[.]st) and a Linux reverse-proxy backdoor called 'myawesomeproxy' (SHA-256 e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9). Bitsight linked another proxystream[.]st subdomain to the AISURU DDoS and proxyware botnet in August. Plex users on Reddit report servers infected with the same miner, though it is not confirmed those infections came from Plex2Shell. Zach Main has published detection guidance and boredhackerblog has published packet captures. Plex had not commented by 19 October (The Hacker News). UPDATE 23–24 September 2026: NVD and CISA CSAF VA-26-266-01 (published 23 Sep 2026) assign five CVEs to Plex Media Server before 1.43.3.10861 — the build family covered by Plex’s 1 September 2026 forum security notice (PMS 1.43.3 / Desktop 1.115.0) that previously said CVEs were requested but withheld. CVE-2026-96656 (CVSS 3.1 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H): admin can write arbitrary files via TranscoderH264Options appended to x264; .so files run at startup without signature checks. CVE-2026-96651 (6.5 Medium): path traversal on /system/agents/media/get can read files including PlexOnlineToken (account/server control) with a valid session token. CVE-2026-96654 (6.5): unauth URL injection via searchOne into other plugins. CVE-2026-96652 / CVE-2026-96655 (4.3): SSRF via /player/timeline and transcoder universal path. BleepingComputer reported on 9 September 2026 that Shadowserver said over 36,000 internet-exposed Plex Media Server instances were still unpatched against the flaws in v1.43.2 and earlier. Patch: PMS ≥1.43.3.10861 / Desktop ≥1.115.0; confirm auto-updates landed. UPDATE (22 Oct 2026): CISA added CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 to its Known Exploited Vulnerabilities catalog on 20 October 2026 (US federal due dates 23 October for -96654 and -96656, 3 November for -96652 and -96655). (source: CISA KEV catalog)
Kaspersky Securelist published on 1 September 2026 that Iranian APT Mirage Kitten (also tracked as Nimbus Manticore, UNC1549, Smoke Sandstorm) is using two previously undocumented cross-platform RATs: NodeRabbit (Node.js) and PollCat (obfuscated JavaScript), the first publicly documented Node.js and JavaScript malware from this group. Operators deliver the implants through recruiter personas on LinkedIn and other job platforms, using trojanized coding-challenge archives. Kaspersky found NodeRabbit samples on systems in Afghanistan, Egypt and Ethiopia. PollCat was recovered from a RankChallenge-react assessment archive. The group has historically used C, C++ and Go malware against aviation, aerospace and fintech in the Middle East and Africa. Kaspersky detections: Trojan.JS.MirageKitten.*.
Manifold Security published GitSpawn research on 1 September 2026: several AI coding agents run git (status, diff and similar) to gather repo context at startup, in some products before a workspace-trust prompt or authentication. Those calls did not strip the repository's own git configuration. Git settings that name a helper program (including core.fsmonitor) then run as the developer, outside the agent sandbox, with no approval prompt. Manifold says clone, fetch or pull of a hostile URL does not carry this; the repository has to arrive as files with its .git directory already inside (zip, shared drive, USB). Named products and status at publication: Claude Code core.fsmonitor patched by 2.1.196 (confirmed on 2.1.193; reported 26 June, closed as duplicate); Claude Code ultrareview still unpatched on 2.1.252; Goose patched in 1.44.0 (CVE-2026-72718, maintainers 7.0); Hermes unpatched on 0.21.0 (CVE-2026-71963); Qwen Code unpatched on 0.22.3; Grok Build unpatched on 1.0.13; OpenAI Codex and Cursor patched (reports closed as duplicates). Manifold 1 September update says Codex and Cursor were also affected, reported, and have since been patched. Inspect .git/config before opening a received folder in an agent. This Cyberstack does not invent CVSS for the unpatched products. Correction (26 Oct 2026): a reference to the CVE numbering authority for CVE-2026-71963 has been removed. (source: Manifold Security)
Decrypt published on 1 September 2026 that Dropbox had emailed users about unauthorised access between 4 and 21 August 2026 via Lenovo ID single sign-on. A Dropbox spokesperson told Decrypt the company identified unauthorised access affecting Dropbox accounts connected through Lenovo ID that did not have Dropbox two-factor authentication enabled, and that an issue with Lenovo email verification allowed an unauthorised party to register a Lenovo ID using another person's email address and then use that Lenovo ID to log into the Dropbox account associated with that address. The spokesperson said approximately 5,000 Dropbox accounts were impacted, less than a third of those had files viewed or downloaded, and Dropbox had emailed all impacted users; users who did not receive an email were not impacted. Decrypt also reported that Dropbox's notification letter said logs showed no evidence files were viewed or downloaded, and that Dropbox has since changed how Lenovo IDs can access accounts. Affected user Yoni Levy posted screenshots of a new-browser sign-in alert from near Canary Wharf (Chrome on Windows, 18 August) and said he had never had a Lenovo account. Cyberstack has not found a Dropbox public advisory page; the company notice in hand is the user email plus the spokesperson comments to Decrypt. Updated 2 Sep 2026 (9to5Mac): 9to5Mac's report is dated 2 September 2026; details credited to 9to5Mac on this card come from that report.
Coder published GitHub advisory GHSA-vx42-ghc9-gw65 on 1 September 2026 (Critical). An unidentified actor gained access to Coder's Cloudflare infrastructure and added unauthorised IP addresses to the pool used for the Coder module registry (registry.coder.com). Those addresses hosted a malicious copy of registry artefacts. For a short window the registry served malicious packages to a subset of users. The implanted code was designed to identify credentials and exfiltrate them to a lookalike domain (coder-infra.com). Coder says it has no indication that any customer data maintained by Coder was impacted. Users who downloaded a Coder Registry module between 07:35 UTC and 21:45 UTC on Monday 31 August 2026 may be affected (new templates or template versions; also workspace creation if module caching is disabled). Coder recommends reviewing firewall, DNS and VPC logs for outbound traffic to coder-infra.com, purging cached modules from the affected window, rotating potentially exposed credentials, and updating Coder. Patched versions: 2.37.0, 2.36.4, 2.35.7, 2.34.9. Affected: versions before 2.37.0.
NovoCure Limited's Form 8-K dated 1 September 2026 (Item 8.01) says that in mid-August 2026 a subsidiary became aware of unauthorised access to some information systems. The company activated its cybersecurity response plan, implemented containment measures, and engaged independent forensic experts. Exposed data to date: internal company patient ID numbers for over 1,400 U.S. patient records (IDs used only internally; no names or other identifying data for those records); identifying information for fewer than 50 other patients in the western U.S.; general contact information for healthcare providers; and employee contact details such as job titles and phone numbers. Novocure states no access to medical treatment devices was obtained, operations were not compromised, and systems remain fully functional. It does not currently expect a material financial impact and says it will make required notifications, including to impacted patients. Vector and threat actor are not named in the filing.
