🔴 Elementor Pro RCE flaw hits 6M WordPress sites, ⛓️ 5,400 sites serve ClickFix via blockchain, 🟠 Chrome V8 zero-day added to CISA KEV, 🎯 Qilin claims UK financial and Canadian construction targets, 🔶 Akira expands into Austrian manufacturing

Elementor Pro versions before 4.2.2 contain CVE-2026-32475, a critical file-upload vulnerability that lets unauthenticated attackers drop PHP webshells and execute arbitrary code on WordPress servers. The flaw lives in a mismatch between the validation loop and the processing loop in the File Upload module: an empty-filename entry causes the validator to exit early while the processor skips it and moves the next part, a PHP payload, to wp-content/uploads/elementor/forms/. Exploitation began on August 19, the same day Elementor shipped the fix, and Wordfence has since blocked nearly 200,000 exploitation attempts across its customer base. With roughly 6 million sites running Elementor Pro and the Form widget with file upload fields being a common configuration, the attack surface is substantial and mass scanning is ongoing.

More than 5,400 small-business websites, primarily WordPress and PrestaShop installations, have been compromised and are serving ClickFix payloads stored in smart contracts on the BNB Smart Chain Testnet, a technique known as EtherHiding. Netskope researchers found that each site was injected with a script that fetches its next-stage payload from a BSC Testnet smart contract, giving attackers a free, censorship-resistant delivery channel. The injected script presents a fake CAPTCHA page instructing visitors to paste a PowerShell command into the Windows Run dialog. Because the payload lives on-chain, operators can swap it without touching the compromised sites again, and Netskope observed the campaign evolve in the field: the ClickFix payload was later replaced with a WebRTC data-channel stager. The initial compromise vector for these sites has not been identified.

CISA added CVE-2026-85046, a Chrome V8 type confusion flaw, to the Known Exploited Vulnerabilities catalog on September 4, two days after Google patched it. The CVSS 8.8 vulnerability allows remote code execution when a victim visits a crafted HTML page, and Google confirmed an exploit exists in the wild but withheld technical details. The fix brings Chrome to version 152.0.7977.82/.83. This is the sixth Chrome zero-day patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645. The Canadian Centre for Cyber Security issued advisory AV26-883 urging immediate patching, and the sustained pace of V8 zero-days suggests ongoing targeting of Chrome's JavaScript engine.

Qilin added two new victims to its campaign: AP Capital Partners Limited, a UK financial firm, and the Commission de la construction du Quebec (CCQ), a key Canadian construction-sector body. Both claims came on September 4 with threats to leak sensitive data unless negotiations begin. The campaign, running since at least August 10, now spans at least nine organizations across Canada, the US, the UK, Cyprus, and Austria, with the CCQ hit reinforcing Qilin's sustained focus on the Canadian market and the ATF "major incident" still under DOJ-coordinated forensics.

Akira claimed Stransky Heiz-Mess-Regeltechnik GmbH, an Austrian sustainable energy manufacturer, with a threatened 50GB data exfiltration including employee information and financial details. This adds a third country to Akira's recent stretch of healthcare, manufacturing, and energy targets between late August and early September, following the Oral and Maxillofacial Surgery hit in Brockton, MA and the PA-ID GmbH claim in Germany.

Watchlist: update Elementor Pro to 4.2.2 immediately and audit for published form widgets with file upload fields; monitor for EtherHiding and ClickFix campaigns targeting WordPress and PrestaShop sites; enforce Chrome 152.0.7977.82+ across managed endpoints; track Qilin's leak site for additional financial-sector disclosures and ATF investigation findings; continue monitoring Akira's expanding manufacturing and energy targeting across Europe.