Gen Digital traced a GRAYRABBIT intrusion to a crafted Sogou Input Method link. The link opened a six-year-old browser engine with its sandbox disabled, allowing an old JavaScript exploit to run.
Wiz observed attackers chaining two Artifactory flaws for administrator access and using a third flaw separately. Some intrusions left persistent accounts, malicious plugins and Rust backdoors.
CISA says attackers are exploiting CVE-2026-85706, a CVSS 10 GitLab flaw that can expose arbitrary server files without authentication. Self-managed operators need to update and investigate.
CISA now marks CVE-2025-14733 as used in ransomware campaigns. WatchGuard Firebox operators need to patch, investigate and rotate stored secrets.
CISA has set a 12 September deadline for CVE-2025-25249 as researchers describe attackers using compromised FortiGate devices for tunnelling, credential harvesting and internal discovery.
Google's exploited V8 flaw was one stage in BlueMoon, a three-vulnerability Chrome and Windows chain that multiple espionage groups adopted within days. Patch both Chrome and Windows, then hunt the published indicators.
Microsoft has confirmed exploitation of two Windows privilege-escalation vulnerabilities. One can break out of an AppContainer on older Windows systems; the other affects the Update Stack on current Windows releases. Together, they turn partial access into a race for SYSTEM.
Microsoft’s September security release is not a simple highest-score-first exercise. Two Windows flaws are already being exploited, several network services expose unauthenticated remote-code paths, Outlook can be attacked without a click, and even hotpatch-enrolled systems face a restart. Here is the order businesses should use.
Three MikroTik RouterOS vulnerabilities are now tied to active exploitation, although CISA has not linked CVE-2026-67277 to the documented MikroTrick chain. Patch immediately, then inspect exposed routers for compromise.
A clean patch report is no defence against StyleSmuggler. Sansec says attackers are using the unpatched flaw to install persistent backdoors on current Magento and Adobe Commerce releases.
