Stay updated with the latest cybersecurity news. This daily roundup covers the record-breaking September Patch Tuesday, actively exploited e-commerce and enterprise flaws, AI-agent abuse, mobile zero-click research, crypto-sidechain theft, and major data-breach claims from the last 48 hours.
1. Microsoft Ships Record September Patch Tuesday: ~966–974 Flaws, Two Exploited Zero-Days
Published: 2026-09-08
Microsoft’s September 2026 Patch Tuesday is the company’s largest security release on record, fixing roughly 966 flaws on Patch Tuesday itself (about 974 when earlier-in-month cloud fixes are counted). The bundle includes two actively exploited elevation-of-privilege zero-days and more than 100 Critical issues, including dozens of remote code execution bugs. Microsoft has credited AI-assisted vulnerability discovery for the jump in volume, which is forcing many organizations to rethink patch prioritization.
2. Adobe Patches Actively Exploited Magento/Commerce Zero-Day “StyleSmuggler”
Published: 2026-09-08
Adobe released an emergency fix for CVE-2026-75650, a maximum-severity Magento and Adobe Commerce flaw dubbed StyleSmuggler. Sansec observed exploitation from at least September 4, with attackers injecting code through the template engine and planting a stealthy Rust backdoor that masquerades as a Linux kernel worker or font-cache process. Adobe is aware of in-the-wild abuse and is telling store owners to apply hotfix VULN-39341 immediately, then rotate admin passwords, tokens, payment-gateway keys, and other secrets.
3. SAP Warns of Maximum-Severity “OVERPASS” Kernel Flaw
Published: 2026-09-08
SAP’s September updates close 20 issues, headed by CVE-2026-44756 (“OVERPASS”), a buffer overflow in Extended Passport Protocol processing inside the SAP Kernel. Unauthenticated attackers who can reach Internet Communication Manager can run commands with administrative privileges and take over SAP processes and business data. Onapsis estimates more than 10,000 internet-facing SAP web interfaces may be exposed, and that figure is likely conservative because Web Dispatcher instances are harder to fingerprint.
4. Researchers Demo WeChat Zero-Click Worm via Incoming Contact Calls
Published: 2026-09-08
Security firm Calif demonstrated a worm that hijacks a WeChat account from an incoming call on both iPhone and Android. The target does not need to answer or touch the phone; declining the call stops that attempt, but the attacker can call again. The caller must already be a WeChat contact. Calif reported the bug to Tencent in July; Tencent later blocked the exploit server-side and shipped WeChat 8.0.77 (Android) and 8.0.76 (iOS). Users should stay on current versions even though the live exploit path is now mitigated.
5. ChatGPT Flaw Let a Planted Prompt Quietly Forward Gmail Data
Published: 2026-09-08
Check Point Research showed that a single hidden instruction planted in a ChatGPT conversation could make the model answer the user normally while secretly reading connected Gmail and sending data to another ChatGPT account. The planted prompt can arrive via pasted text, a shared conversation, or hidden custom-GPT builder instructions. In Thinking mode, ChatGPT ran a visible answer and a hidden attacker task in the same turn; the only user-facing clue was a small “Talked to Gmail” label after the fact. The incident is another reminder that connected-app permissions and shared chats need tight controls.
6. Liquid Network Attackers Return 3,400 BTC After Elements Bug Drain
Published: 2026-09-08
Attackers drained nearly 4,000 bitcoin from the Liquid Network federation wallet on September 6 after a bug in Elements, the software behind Liquid’s L-BTC sidechain. On-chain records show about 3,400 BTC (roughly $265 million at then-prices) were returned to a federation address the next day; about 598.5 BTC (~$47 million) remained at the attacker-controlled change address. The network stayed paused, so holders could not peg L-BTC back to bitcoin. Blockstream and Liquid have not publicly confirmed whether the return is part of a negotiated white-hat deal.
7. Mathspace Breach Hits More Than 1 Million Students, Staff, and Parents
Published: 2026-09-07
Australian maths platform Mathspace said attackers used a vulnerability in a self-hosted Metabase reporting instance to steal data on 1,079,819 students, school staff, and parents/guardians in Australia and New Zealand. Access began on August 10; data was downloaded on August 27 and confirmed stolen on September 3. Mathspace says passwords, SSO tokens, academic results, and assessment records were not taken, but names and contact details were, and school affiliation may be inferable from email domains. Education providers running self-hosted analytics tools should treat this as a patch-and-review priority.
8. ShinyHunters Claim Breach of Florida “DAVID” DMV Database
Published: 2026-09-08
The ShinyHunters extortion group listed Florida’s Highway Safety and Motor Vehicles agency and claims it breached the DAVID driver-lookup platform used by law enforcement. The group says it stole more than 200,000 driver records after compromising employee and official accounts, then iterating records by ID. As purported proof it posted a screenshot of Jeffrey Epstein’s DAVID record, including address, SSN, license details, and registered vehicles. Florida has not publicly confirmed the claim; agencies should treat it as an active extortion incident until verified.
Also worth watching
- N-able N-central max-severity RCE (CVE-2026-86218): Emergency hotfix 2026.3 HF4 is out; Huntress flagged possible zero-day use, and Shadowserver still sees ~1,500 internet-exposed consoles. MSP platforms remain high-value targets.
- Trezor / ShipMonk supply-chain breach: Impact widened from ~14,000 to 81,000 customers after older U.S. shipping records were found still stored at the logistics vendor. Hardware wallets themselves were not compromised; phishing risk is high.
- Slim Spider vs. Brazilian finance: CrowdStrike documented a new cluster stealing cloud credentials and crypto-custody secrets, including Pix/SPI-themed tooling.
Stay Vigilant
Patch Microsoft, Adobe Commerce/Magento, SAP Kernel, and any internet-facing N-central consoles first. Treat unexpected WeChat calls from contacts, shared ChatGPT threads, and “support” messages to crypto-wallet customers as hostile until proven otherwise. Subscribe for the next daily drop, and keep monitoring vendor advisories rather than waiting for a weekly digest when zero-days are already in the wild. Stay safe online.