Stay updated with the latest cybersecurity news. This daily roundup covers actively exploited vulnerabilities, major breaches, botnet takedowns, and policy-scale defense moves from the first week of September 2026. Patch windows are shrinking, supply-chain vendors keep leaking customer data, and attackers are hiding payloads on-chain so takedowns do not stick.
1. Unpatched Magento and Adobe Commerce Zero-Day Used to Backdoor Online Stores
Published: 2026-09-05
Dutch firm Sansec disclosed an unpatched, unauthenticated code-execution chain in Magento Open Source and Adobe Commerce, nicknamed StyleSmuggler. Attacks began September 4. Sansec reproduced the full chain on clean 2.4.7, 2.4.8, and 2.4.9 installs; even a 2.4.6 store on Adobe’s latest August 2026 patch level was hit. As of September 6 Adobe had not issued a CVE, patch, or workaround. A successful exploit plants a persistent server-side backdoor. E-commerce operators should isolate stores, hunt for unexpected PHP in generated files, and watch Sansec/Adobe advisories closely.
2. Critical Elementor Pro Flaw Exploited Against WordPress Sites
Published: 2026-09-05
CVE-2026-32475 (CVSS 9.8) is an unauthenticated arbitrary file-upload bug in Elementor Pro through 4.2.1. A validation-loop error (return instead of continue on an empty upload slot) skips type checks on later files in the same field, so attackers can drop PHP into /wp-content/uploads/elementor/forms/. The plugin has millions of installs; Defiant/Wordfence report exploitation started as soon as 4.2.2 shipped on August 19, with 190,000+ blocked attempts. Update to 4.2.2 or later and scan that upload directory for unexpected .php files.
3. Attackers Breached JetBrains Cadence via Unpatched TeamCity and Stole AWS Credentials
Published: 2026-09-05
JetBrains says unidentified actors exploited a recently disclosed critical TeamCity flaw against JetBrains’ own Cadence cloud environment between August 8 and 24. Investigators found access to a 2024 Cadence backup plus storage that could hold current-user emails, project source, and secrets. Extracted material included AWS IAM users and credentials used with Cadence, plus files in JetBrains S3 buckets. Cadence users should revoke and rotate every credential used for executions, treat past run inputs/outputs as untrusted, and audit AWS, Git, and package-registry access. The exposed Cadence API host has been taken offline.
4. Google Patches Sixth Chrome Zero-Day of 2026
Published: 2026-09-04
Chrome 152.0.7977.82/.83 fixes 12 bugs, including actively exploited CVE-2026-85046 (CVSS 8.8), a V8 type-confusion issue that can yield arbitrary read/write on the JavaScript heap from a crafted page. Researcher Salvatore Gulizia reported it August 4. This is Google’s sixth in-the-wild Chrome zero-day of 2026. Update Chrome now; Edge, Brave, Opera, and Vivaldi users should apply Chromium patches as vendors ship them.
5. Over 5,400 Hacked Sites Serve ClickFix Payloads Stored on the Blockchain
Published: 2026-09-05
Netskope tracked more than 5,400 compromised small-business sites (mostly WordPress and PrestaShop) injecting scripts that fetch the next-stage payload from a BNB Smart Chain smart contract—an EtherHiding pattern. Victims see a fake CAPTCHA and are told to paste a PowerShell command into the Windows Run dialog. Operators can change the on-chain payload at will; a later variant switched to a WebRTC data-channel stager. Hundreds of infected sites hit BSC Testnet RPCs daily in August. Treat unexpected “verify you are human / press Win+R” prompts as malware, and hunt injected third-party scripts on customer-facing sites.
6. Thomson Reuters C-Track Breach May Have Exposed Court Records Across the U.S. and Canada
Published: 2026-09-03
Thomson Reuters disclosed unauthorized access to C-Track, the appellate case-management platform used by courts in 11 U.S. states, the U.S. Virgin Islands, and Ontario. Intrusion began in March 2026 and was detected June 30—about four months of dwell time inside the vendor’s cloud, not on court networks. Affected U.S. jurisdictions named in reporting include Alabama, Kentucky, Montana, Nevada, New Hampshire, North Dakota, Ohio, Oregon, Pennsylvania, South Carolina, Tennessee, and Wyoming. Files may include names, SSNs, driver’s license numbers, dates of birth, and medical/insurance data, though some courts (e.g., New Hampshire) say they have not yet confirmed sensitive identifiers in their slice. C-Track stayed online. Watch vendor notices and freeze credit if you had appellate matters in those systems.
7. Critical VMware Workstation and Fusion Flaws Let VM Admins Run Code on the Host
Published: 2026-09-05
Broadcom patched CVE-2026-59346 (CVSS 9.3), an integer overflow in the VMXNET3 adapter that lets a local admin inside a VM execute code on the host, plus CVE-2026-59347 (CVSS 8.1), a stack buffer overflow in HGFS that runs code as the host VMX process. Both affect Workstation and Fusion 25H2 and 26H1. There are no workarounds. Fixed builds are Workstation 26H1u1 and Fusion 26H1u1. The attacker already needs admin inside the guest, but that is a common follow-on after phishing or a guest compromise—patch desktop hypervisor fleets used for untrusted workloads.
8. Trezor Says ShipMonk Breach Exposed 67,000 More U.S. Customers After Data Was Supposed to Be Deleted
Published: 2026-09-05
Trezor disclosed that another 67,000 U.S. customers were in a ShipMonk shipping-vendor breach, on top of 13,689 reported last month. Exposed fields: names, emails, phones, shipping addresses, and order numbers from November 2019–August 2021. Hardware wallets themselves were not compromised. Trezor says it had written confirmation that the data had been deleted under contract; ShipMonk notified Trezor on August 10. Researchers have linked the incident to ShinyHunters. Expect phishing and impersonation using old shipping details—Trezor will not ask for seed phrases. This is a reminder that vendor retention promises are not a control; verify deletion.
Also on the radar this week
- Sality botnet disrupted after ~20 years. FBI, DOJ, European partners, CrowdStrike, and Shadowserver sinkholed the P2P botnet (active since 2003; 11M+ IPs historically; peak ~1M bots). Recent payload EggJagger swapped crypto clipboard addresses.
- OpenAI Daybreak: $1B in subsidized cyber-defense access for water/electric utilities, local government, community banks, and maintainers—announced alongside Astra, OpenAI’s first model rated Critical under its Preparedness Framework.
- Dropbox: ~5,000 accounts accessed in August via a legacy Lenovo ID SSO path without 2FA; sessions terminated.
- Cisco Nexus 9000: CVE-2026-20212 (CVSS 9.8) lets an unauthenticated remote attacker run code as root on certain Silicon One models; patch NX-OS.
Stay Vigilant
This week’s pattern is familiar and getting faster: unpatched CMS and plugin bugs go from disclosure to mass exploitation in hours; cloud and logistics vendors sit on years of customer PII they claimed to delete; and delivery infrastructure is moving onto blockchains so domain seizures do not kill the campaign.
Practical moves for the next 48 hours:
- Patch Elementor Pro to 4.2.2+, Chrome to 152.0.7977.82+, and VMware Workstation/Fusion to 26H1u1.
- If you run Magento/Adobe Commerce, assume StyleSmuggler is live until Adobe ships a fix—monitor file integrity and outbound connections.
- Rotate secrets if you used JetBrains Cadence or TeamCity on the affected window.
- Train staff that “Win+R + paste this CAPTCHA command” is never a real security check.
- Treat shipping-vendor and court-vendor breach mail as high-risk phishing bait.
Subscribe for the next daily drop. Stay patched, assume vendor data lives longer than the contract says, and stay safe online.