🔴 Adobe patches StyleSmuggler CVSS 10.0, 🎯 BigBear AiTM PaaS bypasses MFA at 258 orgs, 🧩 Coder module registry hijack steals credentials, 💀 Panzer Ransomware emerges with cross-platform payloads, 🪱 Shai-Hulud npm worm returns after 111-day dormancy, 🔐 F5 BIG-IP fileless backdoor enters CISA KEV

Adobe shipped an emergency hotfix for the Magento StyleSmuggler zero-day after a week of active exploitation. APSB26-146 assigns CVE-2026-75650 a CVSS 10.0 and covers every supported Magento and Adobe Commerce version, but the hotfix addresses the injection vector only; Sansec warns that stores already compromised between September 4 and 7 still carry the Rust-based backdoor and cron persistence, so patching without a full compromise hunt leaves attackers in place. The backdoor masquerades as kworker or fc-cache and communicates over UDP port 123 disguised as NTP traffic, indicators that SOC teams should hunt immediately across any Magento estate.

CloudSEK researchers gained administrative access to BigBear 2.0, a phishing-as-a-service platform built on Evilginx2, and found it had bypassed multi-factor authentication at 258 organizations to harvest more than 5,000 Microsoft 365 credentials. BigBear operated 42 VPS nodes mostly on Vultr, used an "offy" adversary-in-the-middle template that proxies the real Microsoft sign-in flow so victims complete MFA normally while attackers capture usable session cookies, and delivered stolen credentials to at least five affiliates via dedicated Telegram bots in real time. The 80/20 revenue split lowers the bar for less technical operators to run MFA-bypass campaigns at scale, and the session cookies grant access to Exchange Online, Teams, SharePoint, and OneDrive without additional authentication challenges.

Attackers compromised the Coder module registry at registry.coder.com by injecting unauthorized IP addresses into the Cloudflare pool serving the registry, redirecting Terraform template component downloads to attacker-controlled servers for approximately 14 hours on August 31. The Coder registry hijack targeted cloud, CI/CD, AI tooling, and authentication credentials through malicious modules that contacted coder-infra[.]com, a lookalike domain registered three days before the compromise. Any organization that pulled Terraform-based template components during the exposure window should rotate affected credentials and audit deployment logs.

Bimbo Bakeries USA disclosed that attackers exploited a zero-day in Oracle E-Business Suite to steal files containing employee Social Security numbers, but the eight-month gap between initial intrusion detection in December 2025 and SSN discovery in August 2026 highlights how ERP file inventories can hide sensitive data classifications. The Bimbo Bakeries breach is part of a broader extortion campaign targeting Oracle EBS customers, and the third-party vendor vector underscores that supply-chain risk extends to managed service providers with direct platform access. Organizations running EBS should inventory file contents and verify patch status against Oracle's emergency advisories.

Panzer is a new ransomware-as-a-service operation that launched August 5 with a leak site and affiliate platform, claiming between 16 and 19 victims across 11 countries within its first month. Panzer stands out for cross-platform payloads covering Windows, Linux, VMware ESXi, and FreeBSD, a semi-open affiliate model with 80 percent revenue share, and automated Bitcoin invoice generation. Italian ransomware activity is accelerating in parallel, with Ransomfeed reporting 212 claimed attacks against Italian organizations by early September, already exceeding all of 2025.

The Shai-Hulud npm supply-chain worm resurfaced after 111 days of dormancy with four new packages carrying the identical payload hash that was publicly identified following the May 19 compromise of hundreds of @AntV package versions. The Shai-Hulud return demonstrates that hash-based detection alone is insufficient for npm malware, since the byte-identical payload passed registry screening despite months of prior flagging. The packages use preinstall lifecycle hooks that execute automatically on install, harvesting npm tokens, GitHub tokens, cloud credentials, SSH keys, and CI/CD secrets before spreading further using stolen tokens.

A Linux implant dubbed PoisonedRefresh has been observed backdooring F5 BIG-IP Access Policy Management servers using memory-only PHP web shells that leave no disk footprint. PoisonedRefresh ties to CVE-2025-53521, an unauthenticated RCE in BIG-IP APM added to CISA's Known Exploited Vulnerabilities list, and targets edge infrastructure that handles authentication decisions and often has direct access to internal resources. The fileless approach means traditional IOC scans may miss the implant; memory forensics or network-level detection are more likely to surface compromise.

Mathspace, a Sydney-based maths learning platform used by thousands of schools, disclosed a breach affecting 1,079,819 people after attackers exploited a vulnerability in a self-hosted Metabase reporting system to obtain administrator access without credentials. The Mathspace breach began August 10 with data exfiltrated from the Australian reporting database on August 27, affecting students, parents, teachers, and staff across Australia and New Zealand. The incident fits a pattern of attackers targeting internal reporting and analytics tools that sit outside the primary security perimeter but hold sensitive data.

Researchers at Hong Kong universities demonstrated InjectEave, an electromagnetic side-channel attack that recovers audio from consumer headphones at distances up to 30 meters by transmitting a tuned carrier signal that nonlinear device components unintentionally mix with audio. InjectEave breaks past the roughly 1.5-meter range ceiling of prior passive EM eavesdropping techniques, does not require physical access or software exploitation, and is presented at USENIX Security 26. The practical risk concentrates in targeted surveillance rather than mass collection, but it materially extends the distance envelope for EM-based audio exfiltration.

SAP released 19 Security Notes on September Patch Day, headlined by CVE-2026-44756, a CVSS 10.0 memory corruption vulnerability in SAP Extended Passport processing affecting Kernel and Web Dispatcher releases, and CVE-2026-58240, a CVSS 9.8 missing-authentication flaw in the NetWeaver Message Server. The SAP patch day also fixes a credential-disclosure issue in the sap/cds-mtxs library affecting SAP Cloud Application Programming Model multitenant environments. Organizations running NetWeaver, S/4HANA, or Commerce Cloud should treat the kernel and Message Server fixes as emergency-patching priorities given the unauthenticated attack vectors.

Kinryu Labs discovered an exposed Elasticsearch cluster in Viettel-assigned IP space in Hanoi containing 210 million passenger records and 10 million crew records across a nine-year span of Vietnamese Advance Passenger Information System data. The Vietnam APIS leak included names, passport numbers, dates of birth, nationalities, and flight details with no authentication or access controls in place, making it one of the larger travel-data exposures in recent years. The operator has not been publicly identified, and the breadth of nationalities affected means the privacy impact extends well beyond Vietnamese citizens.

Watchlist: apply the Magento APSB26-146 hotfix and hunt for kworker/fc-cache backdoor indicators on every internet-facing store; rotate Coder registry credentials for any Terraform pulls from August 31; audit Oracle EBS file inventories and patch status; track Panzer Ransomware cross-platform activity; hash-check npm dependencies against the four flagged Shai-Hulud package names; verify F5 BIG-IP APM patch status for CVE-2025-53521 and run memory forensics for fileless shells; deploy the SAP September patches for CVE-2026-44756 and CVE-2026-58240.

Generated by opencode-go/mimo-v2.5. Input tokens: 58,146, output tokens: 11,345, cache read: 1,448,576, cache write: 0.