🔴 CrowdStrike Falcon privilege escalation PoC, 🟠 Chrome V8 zero-day actively exploited, 🔵 Chinese AI agents orchestrate Asia-Pacific intrusions, 🟣 M365 RejectDirectSend bypass enables internal spoofing, 🟡 PaperCut zero-days chain for pre-auth RCE with data theft, 🟢 ASCII smuggling crosses from AI research to phishing

A researcher published FalconFlank, a proof-of-concept claiming local privilege escalation in CrowdStrike Falcon Sensor for Windows by abusing the agent's Microsoft Office macro remediation workflow. The technique reportedly escalates from standard user to SYSTEM on fully updated Windows 11 25H2 and Server 2025 with Phase 3 Optimal Protection enabled. CrowdStrike has not confirmed the vulnerability or assigned a CVE but is advising customers to disable the "Microsoft Office File Suspicious Macro Removal" policy setting while investigating. If validated, this is a significant finding: Falcon runs with the highest system privileges and deep kernel access, and the affected setting is commonly enabled across tens of thousands of enterprise deployments.

Google patched CVE-2026-85046, a high-severity type confusion in the V8 JavaScript engine that is under active exploitation, rolling out Chrome 152.0.7977.82/.83 to Windows, macOS, and Linux. The flaw allows a malicious website to corrupt memory and potentially execute arbitrary code within Chrome's renderer process when a victim visits attacker-controlled content. This is the fifth Chrome zero-day patched in 2026, continuing the trend of V8 type confusion bugs being reliably weaponized. The browser sandbox limits direct impact from a renderer compromise, but sophisticated attackers typically pair V8 vulnerabilities with sandbox escapes.

Chinese-speaking threat operators ran a second intrusion campaign using commercial AI models as operational components, targeting Taiwan's Kuomintang Party History Archives, Indonesia's Ministry of Foreign Affairs, and industrial organizations in Vietnam. Researchers linked five attacker workspaces through a shared SOCKS proxy, finding an AI orchestration framework called SecFlow that routed tasks to Claude, Qwen, and DeepSeek models for reconnaissance, exploitation, data collection, and reporting. The AI models did not independently compromise systems but organized and automated conventional offensive activity across eight CVEs including Log4Shell, Spring4Shell, and Ghostcat. This is a distinct campaign from an earlier July operation, suggesting the approach is becoming a standard playbook rather than a one-off experiment.

ReliaQuest disclosed that Microsoft 365's RejectDirectSend protection can be bypassed by sending email with an empty SMTP envelope sender. When the envelope sender is empty, there is no domain for the control to evaluate, so the check passes silently while the visible From address can still display any trusted internal identity. In controlled testing, two unauthenticated messages with the same internal-looking From header bypassed the control entirely when using MAIL FROM:<>. This is not a software vulnerability but a design limitation, and organizations relying on RejectDirectSend as a phishing defense should evaluate additional mitigations such as DMARC enforcement and external email tagging.

FortiGuard Labs documented LLMjacking, a cloud intrusion technique where attackers abuse leaked AWS credentials to access Amazon Bedrock foundation models at the victim's expense. The attack started with a long-lived IAM access key with AdministratorAccess permissions, used to create a new IAM user and subscribe to premium models through AWS Marketplace. The technique monetizes the target's existing relationship with the cloud provider without requiring compute for cryptomining or a buyer for data exfiltration. Organizations with long-lived IAM keys and broad permissions are exposed.

Jamf Threat Labs identified 14 malicious DMG and PKG files used by DPRK-linked Contagious Interview operators to distribute the OtterCookie remote access trojan via trojanized macOS applications. The campaign impersonates legitimate software including The Unarchiver, Presentify, PDFify, Sketch, and Bartender, with a hidden executable that launches when the victim opens the application. This represents an evolution from earlier techniques that relied on malicious Git hooks and VS Code task files, expanding the attack surface beyond repository-based delivery to anyone who downloads software during a job interview or coding assessment.

TP-Link patched two vulnerabilities in the Archer AX55 v4 wireless router that allow a local-network attacker to crash the EasyMesh service, steal admin credentials, or potentially achieve remote code execution. CVE-2026-18167 is a stack-based buffer overflow in the EasyMesh module rated CVSS 7.7, and CVE-2026-18330 targets the web management interface for credential extraction. Both are fixed in firmware version 1.2.1 Build 20260527. Router-level code execution is a high-value target because a compromised appliance can silently redirect DNS, intercept traffic, or serve as a persistent pivot point inside a network.

Plex pushed an emergency update to Media Server version 1.43.3 and the Desktop client version 1.155.0 to fix multiple security vulnerabilities, urging users running affected versions to update immediately. The company did not disclose technical details about the affected components, severity ratings, or exploitation conditions, and CVE identifiers have been requested but not yet assigned. Plex Media Server is commonly deployed on home servers, NAS appliances, Docker containers, and Linux machines, often with remote-accessible ports.

CISA set a September 5 remediation deadline for the SonicWall SMA1000 zero-day chain after adding CVE-2026-83548 and CVE-2026-83549 to its Known Exploited Vulnerabilities Catalog. With the deadline now imminent, CyberScoop reported that SMA 1000 customers continue to grapple with the flaws, and Rapid7 noted the familiar pattern of perimeter appliance, chained vulnerabilities, and unauthenticated RCE. The SSRF-to-RCE pair targets internet-facing remote-access appliances across models 6210, 7210, and 8200v, and the three-day federal deadline signals high confidence in active exploitation.

PaperCut NG and MF print management software is under active attack through two zero-day vulnerabilities chained for unauthenticated remote code execution. CVE-2026-81578 is a high-severity authentication bypass in the web management interface, and CVE-2026-82078 is an unsafe dynamic class-loading bug. Together they form a pre-auth RCE chain that Huntress first detected on August 26, and Defused confirmed attackers are abusing the auth bypass to hijack PaperCut's external user-lookup and dump database tables. CISA added both CVEs to the Known Exploited Vulnerabilities catalog, and Shadowserver tracks over 800 exposed PaperCut servers. The combination of wide deployment in education and government, pre-auth RCE, and confirmed data exfiltration makes this one of the more consequential active exploitation campaigns.

Microsoft researchers documented a high-volume phishing campaign that repurposed ASCII smuggling, a technique originally studied in the context of AI prompt injection, for traditional email filter evasion. The attacker used invisible Unicode tag characters to split financial lure words like "funding" so that email security parsers could not recognize them, while the words appeared normal to human readers. Microsoft Defender for Office 365 telemetry showed elevated activity sustained on weekdays for approximately three months. This marks a crossover from AI-specific attack research into commodity phishing tooling, broadly applicable against any organization relying on keyword or pattern-based email filtering.

Hunt.io researchers uncovered Operation CameraSwarm, a 35-day campaign that compromised 14,530 Dahua IP cameras using three parallel attack vectors: brute-forcing TCP port 37777, exploiting CVE-2021-33044 and CVE-2021-33045 for persistent backdoor accounts, and cloud-relay attacks against NAT'd devices using only serial numbers. The persistent backdoor account survives password changes and most firmware resets, meaning affected cameras remain compromised even after administrators attempt remediation. Confirmed compromises concentrated in Ukraine and Russia, with additional hits in Mexico and Vietnam.

CVE-2026-62911 is an authentication bypass in Microsoft Exchange Server 2016, 2019, and Subscription Edition that allows an attacker with basic user privileges to elevate to full mailbox control. As of September 1, Shadowserver identified approximately 22,000 Exchange servers still unpatched and internet-accessible, with roughly 6,200 in the United States and 5,100 in Germany. The Netherlands National Cyber Security Centre confirmed that working exploit code is publicly available. Exchange 2016 and 2019 are on the Extended Security Update program, which ends in October 2026.

Watchlist: disable CrowdStrike Falcon's "Microsoft Office File Suspicious Macro Removal" policy setting until the vendor confirms or denies the FalconFlank privilege escalation; deploy Chrome 152.0.7977.82/.83 immediately to patch the actively exploited V8 type confusion; audit AI orchestration frameworks and monitor for SecFlow indicators in Asia-Pacific environments; evaluate DMARC enforcement and external email tagging to compensate for the RejectDirectSend bypass; rotate long-lived AWS IAM keys and monitor Bedrock API activity; update Plex Media Server to 1.43.3 and Desktop to 1.155.0; deploy SonicWall SMA1000 hotfixes before the September 5 CISA deadline and re-image affected appliances; patch PaperCut to the emergency releases and audit for unauthorized database access; add Unicode normalization to email filtering pipelines; audit Dahua cameras for the p2pwn backdoor and update firmware; emergency-patch Microsoft Exchange servers before exploit code becomes widely weaponized.