Stay updated with the latest cybersecurity news. This daily roundup covers critical vulnerabilities, emerging threats, major data exposures, and the latest AI-defense moves so you can stay informed in a landscape that is changing by the hour.
1. Unpatched Magento and Adobe Commerce Zero-Day Actively Backdooring Online Stores
Published: 2026-09-05
Dutch firm Sansec disclosed StyleSmuggler, an unauthenticated remote-code-execution zero-day in Magento Open Source and Adobe Commerce. Attacks began on September 4. Sansec reproduced the full chain on clean 2.4.7, 2.4.8, and 2.4.9 installs; the first confirmed victim was already on 2.4.6-p15 with July and August 2026 patches applied. As of September 6, Adobe had not issued a CVE, advisory, or official workaround. A successful exploit plants a persistent backdoor. Temporary options include WAF rules, disabling GraphQL, and hunting for implants outside the webroot. Adobe’s next scheduled Commerce bulletin is September 8; it is not confirmed that it will cover this bug.
2. Attackers Hijack Internet-Exposed MikroTik Routers via SSH With No Authentication
Published: 2026-09-06
CERT Polska warned that attackers are taking full administrative control of MikroTik devices whose SSH service is reachable from the internet, with successful attacks dating to at least September 2. MikroTik has shipped fixed RouterOS builds (including 6.49.21, 7.23.4/7.23.5, and 7.24.2). Until you can patch, disable or restrict public SSH, WWW/WWW-SSL, and bandwidth-test, then inspect configs for unauthorized changes. Home units with default firewall rules are less exposed; anything with management ports on the public internet is not.
3. FBI Probes Apparent Theft of 153 Million+ Driver’s License Scans Tied to IDScan.net
Published: 2026-09-01 (story still developing through Sept. 6)
A dark-web service called Nexus advertised digital scans of more than 153 million U.S. and Canadian driver’s licenses, plus millions of other IDs, travel documents, and medical cards. Brian Krebs confirmed authentic samples, including his own license, and traced timestamps to scans at Hertz, dispensaries, and similar venues that use Louisiana-based ID-verification firm IDScan.net. The FBI’s New Orleans field office opened an inquiry; Nexus went offline after the reporting. IDScan said it was investigating. If confirmed at that scale, this would rank among the largest identity-document exposures on record. Class-action suits have already been filed.
4. ASUS Control Center Enterprise Flaw Rated CVSS 10.0 Enables Unauthenticated Root
Published: 2026-09-06
ASUS patched CVE-2026-75754 in Control Center Enterprise (ACC). The chain combines missing authentication, SSRF that leaks an encryption key, an attacker-triggered SSH listener on port 2222, and hard-coded credentials. Result: a remote attacker can obtain a root shell and control every server, PC, and workstation ACC manages. Versions through 4.0.0.2 are affected. Update immediately to the fixed build (ASUS guidance cites 3.1.0.9 or later) and treat any internet-facing ACC instance as an emergency.
5. REVSTEALER Follow-On Modules Kill Windows Update and Defender, Then Mine Crypto
Published: 2026-09-06
Elastic Security Labs documented four previously unreported payloads that stay on a machine after the REVSTEALER infostealer deletes itself: ProManager, WinUpdate, SoftManager, and LockAppHost. One module disables Windows Update and Microsoft Defender before launching an XMRig miner. Others steal wallets and browser extensions, clip cryptocurrency addresses, and open a reverse SOCKS5 proxy. REVSTEALER has been sold commercially since at least February 2026 and hides backup C2 addresses in Polygon smart contracts. Watch for new persistence in the user profile after a “cleaned” stealer infection.
6. JetBrains Cadence Breached via Unpatched TeamCity; AWS Credentials Stolen
Published: 2026-09-05
Unidentified actors exploited critical TeamCity vulnerability CVE-2026-63077 (CVSS 9.8) to breach JetBrains’ own Cadence cloud environments in August. Cadence is JetBrains-hosted compute used with PyCharm for ML and heavy workloads. Attackers extracted AWS credentials and other secrets used in executions. JetBrains is telling Cadence users to revoke and rotate every credential and secret that may have been used to run jobs. This is a reminder that vendor-hosted CI/CD and cloud execution platforms are high-value supply-chain targets the moment a CI bug drops.
7. PaperCut Auth-Bypass + RCE Chain Exploited Against Schools and Universities
Published: 2026-09-05
Threat actors are chaining newly disclosed PaperCut flaws CVE-2026-81578 and CVE-2026-82078 (authentication bypass plus remote code execution) against education-sector print servers in the U.S. and Europe. Post-exploitation has included privileged-account creation, registry-hive collection, Metasploit/Meterpreter Java payloads, and recon of hosts, users, and configs. PaperCut was already a favorite initial-access path in 2023 ransomware waves. Treat any internet-reachable or poorly segmented PaperCut NG/MF box as urgent: patch, restrict management interfaces, and hunt for new admin accounts.
8. OpenAI Rates Astra “Critical” for Cyber Capability and Pledges $1B for Frontline Defenders
Published: 2026-09-01 to 2026-09-03
OpenAI said its new Astra model is the first to hit the Critical cybersecurity level under its Preparedness Framework — meaning, with tools and access, it can find unknown bugs and develop exploits against hardened systems with limited human direction. The same week, the company pledged $1 billion in subsidized Daybreak access, training, and support for water utilities, grid operators, local government, community banks, nonprofits, and open-source maintainers, starting in the U.S. with an MS-ISAC pilot. CrowdStrike separately launched SafeMind with NVIDIA — purpose-built red/blue agentic models inside Falcon — arguing defenders need dedicated cyber models, not generic chatbots. The dual message: offensive AI capability is here, and vendors are racing to put equivalent tools on the blue team.
Also on the radar this week
- VMware Workstation/Fusion critical integer overflow (CVE-2026-59346) lets a privileged guest admin execute code on the host.
- Invisible Unicode / ASCII-smuggling phishing is splitting lure words so filters and some AI scanners miss them.
- Dropbox disclosed ~5,000 accounts compromised via a legacy Lenovo ID integration that lacked 2FA.
- PostgreSQL patched a 12-year-old logical-decoding bug that lets a REPLICATION role run code as the database OS user.
- Law firms Quinn Emanuel and McDermott, plus Thomson Reuters court software, disclosed recent unauthorized access.
Stay Vigilant
This week’s pattern is familiar and worse: unpatched e-commerce and print servers going down in hours, edge devices with management ports on the internet, identity vendors holding copies of government IDs, and AI systems that can both find bugs and (in isolated tests) wander out of their sandbox.
Practical checklist for the next 48 hours:
- Magento/Adobe Commerce merchants: assume exposure, hunt for backdoors, apply emergency WAF/GraphQL controls, wait for Adobe’s Sept. 8 bulletin.
- MikroTik, PaperCut, ASUS ACC, TeamCity, and VMware Workstation/Fusion: patch and verify management interfaces are not public.
- Rotate cloud and CI secrets if you use JetBrains Cadence, TeamCity, or similar hosted runners.
- Treat any “we already cleaned the stealer” Windows host as still infected until you look for REVSTEALER follow-on modules.
- If you scanned an ID at a rental desk, hotel, retailer, or dispensary in recent years, monitor for synthetic-identity and account-takeover fraud — the Nexus inventory, if real, is built for that.
Subscribe for the next daily drop. Patch what is actively exploited first; everything else can wait a day. Stay safe online.