🔴 N-able N-central CVSS 10.0 RCE actively exploited, 🌐 Chrome 153 fixes exploited V8 zero-day, 🪟 Record Microsoft Patch Tuesday with 2 zero-days, 🐧 PoisonedRefresh F5 rootkit deep-dive, 🛒 StyleSmuggler enters CISA KEV, 🛡️ Defender ShieldCrash 0-day PoC

N-able released Hotfix 4 (build 2026.3.1.14) on September 6 to close CVE-2026-86218, a CVSS 10.0 pre-authentication RCE in N-central that is actively exploited in the wild and has entered CISA's KEV catalog. The hotfix follows an incomplete Hotfix 3 from September 5 for CVE-2026-86206 and CVE-2026-86207, after Huntress traced a customer compromise on September 4 to a fully patched instance. The N-able N-central auth bypass cascade grants unauthenticated attackers full administrative control of the RMM server, including script push to managed endpoints, agent tooling abuse, Take Control sessions and Cloudflare tunnel persistence, with scanning reported from 23.234.64.0/18 and Huntress measuring 55.6 percent of reachable cloud servers still unpatched. MSPs should upgrade on-premises instances immediately and hunt for rogue accounts, suspicious IIS worker activity and unexpected outbound connections, since one compromised RMM server pivots into every managed customer network.

Google released Chrome 153 to Stable on September 9 with 230 security fixes, including CVE-2026-87491, a medium-severity V8 out-of-bounds write confirmed exploited in the wild. The Chrome zero-day update also fixes five critical flaws, four in WebGL plus CVE-2026-87628, a Cast use-after-free, and starts the new two-week release cycle on versions 153.0.8010.36/.37. Separately, CISA added the September 3 V8 type confusion zero-day CVE-2026-85046 (CVSS 8.8, reported by Salvatore Gulizia) to KEV, the sixth Chrome zero-day of 2026. Push the update to managed endpoints and require a browser restart to complete installation.

Microsoft published its largest Patch Tuesday on record with 999 CVEs, 974 in Microsoft products plus 25 third-party entries, 723 of them in Windows. The record September Patch Tuesday confirms two exploited zero-days: CVE-2026-85880, a Windows ALPC heap buffer overflow, and CVE-2026-81963, a Windows Update Stack link-resolution bug, both CVSS 7.8 local privilege escalations to SYSTEM. The release also carries RCE clusters in Remote Desktop Client, Hyper-V, DHCP Client (CVE-2026-44815) and Azure Kubernetes Service (CVE-2026-32193), plus the HTTP/2 Bomb denial-of-service CVE-2026-49160 that can crash a server in about 20 seconds from a single machine. Patch the two exploited zero-days first, then work the RCE cluster by severity.

Sophos and ESET published deep technical analyses on September 8 and 9 of PoisonedRefresh, the Linux rootkit deployed as a second stage after CVE-2025-53521 RCE in F5 BIG-IP APM. The rootkit hooks __libc_start_main and the Apache module loader apr_dso_load to inject a fileless PHP web shell into in-memory copies of apm_css.php3, full_wt.php3 and webtop_popup_css.php3, leaving disk files untouched while hiding strings with RC4, delaying its socket backdoor until routine Apache time calls, and persisting across upgrade images with SELinux changes. Shadowserver counts 795 APM endpoints still exposed, and the published IOCs include Apache workers reading /proc/self/maps, libphp memory protection changes, creation of /run/bigtlog.pipe and /bin/bash launches, plus HTTP 201 responses with text/css content on the targeted .php3 endpoints.

CISA added CVE-2026-75650, the StyleSmuggler Magento and Adobe Commerce RCE, to KEV on September 8 with a September 11 remediation deadline, one day after Adobe's APSB26-146 emergency hotfix. Active exploitation has run since September 4 with a Rust backdoor plus PHP dropper payload set, a 50-minute compromise observed by Disrex, and 12 attempts from two IPs in Previdian telemetry. Affected versions span Commerce 2.4.4 through 2.4.9 plus B2B and Open Source lines, so operators must apply VULN-39341 and rotate encryption keys, treating any store unpatched since September 8 as potentially compromised.

Researcher MSNightmare published ShieldCrash on September 9, a proof of concept showing the ShieldBreak remediation for CVE-2026-69414 in the Malware Protection Engine is incomplete and still permits arbitrary file reads as NT AUTHORITY\SYSTEM. The disclosure landed hours after Patch Tuesday across three outlets, putting Microsoft on the clock for a follow-up fix. No in-the-wild exploitation is reported, but SYSTEM-context reads reach registry hives, quarantine data, secrets and other users' files, so restrict local attacker access on Defender-dependent endpoints until a complete patch ships.

Calif demonstrated a zero-click WeChat worm that seizes accounts through incoming calls with no user action, hopping from Android to iPhone to Android while inheriting each victim's contact list for propagation. The flaw was reported in July and blocked by WeChat 8.0.77/8.0.76 on August 21 with server-side confirmation August 28, but there is no CVE, no Tencent advisory and no IOCs, desktop and HarmonyOS clients are untested, and the contact-list requirement doubles as the worm's spread mechanism. Calif claims AI-assisted discovery in about two days, which signals falling costs for messaging zero-click research, so high-value targets in WeChat-dependent markets should verify client versions.

The NSA, CISA and FBI issued a joint advisory on September 8 accusing Chinese AI firms including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI of industrial-scale distillation of U.S. frontier models since late 2024. The agencies cite billions of tokens across millions of queries against Claude, ChatGPT, Gemini and Grok, with DeepSeek singled out for distilling outputs across Claude, Gemini, ChatGPT and Grok 4 versions into its R1 and R3 models. U.S. agencies are now asking AI firms to silently degrade responses to suspected distillation traffic, so expect tighter API inspection, rate limits and possible disruption for legitimate international users.

Cisco Talos documented a ClickFix campaign that uses Google Sheets and the Visualization API as command and control, with victims pasting JavaScript into Chrome's address bar or installing a Tampermonkey script lured by fake crypto-swap exploits on Telegram, DarkForums and Pastebin. The loader pulls obfuscated fragments from spreadsheet cells, reassembles them in the browser and injects a crypto skimmer, blending C2 with legitimate docs.google.com traffic while stealing funds. The move from PowerShell lures to in-browser execution via trusted SaaS is the technique shift to track, so monitor for rogue Tampermonkey installs and out-of-workflow browser script execution.

Attackers exploited CVE-2026-82329, the CVSS 9.8 JFrog Artifactory authentication bypass, within three days of the August 28 patch, minting admin tokens and enumerating users, credentials and federation relationships. The CWE-287 default-configuration flaw needs only network access, JFrog Cloud is secured by the vendor, and self-hosted branches must upgrade to their fixed release. Treat exposed instances as priority one given downstream pipeline trust, a blast radius flagged by the Vercel CEO and Black Duck researchers alike.

ReliaQuest showed Microsoft 365 RejectDirectSend can be bypassed with an empty SMTP envelope sender (MAIL FROM:<>), because the control has no domain to evaluate while the visible From header can still spoof any internal identity. Controlled tests delivered unauthenticated Direct Send messages to a protected tenant, a design limitation rather than a code bug in a path that printers and apps use legitimately. Tenants relying on RejectDirectSend should add DMARC enforcement, external tagging and transport rules keyed on connecting source.

Hunt.io found a Redis cryptomining botnet operator's exposed working directory on September 8, revealing 3,562 compromised servers out of 12,966 targeted via replication abuse deploying XMRig cron jobs for Monero. Victims span eight years of Redis versions, pointing to missing authentication rather than patch gaps, and the wallet links back to a February 2026 operation. Keep Redis off the internet, require authentication and bind to localhost.

CERT Polska disclosed MikroTrick on September 5, a chain of CVE-2026-67276 and CVE-2026-86060 (both CVSS 9.2) giving unauthenticated full admin over RouterOS SSH via an RSA modulus-only comparison flaw plus a crafted-username escalation, exploited since at least September 2 from 82.192.72.4. Fixed builds are 6.49.21, 7.23.5, 7.24.2 and 7.25beta3, with about 122,500 devices SSH-exposed per Shadowserver, and the flaws were found with AI assistance from GPT-5.5-cyber and GPT-5.6-sol. Patch now or remove SSH from untrusted networks.

Ivanti's September 8 advisory covers ten flaws across EPMM, Neurons for ITSM and Sentry, led by CVE-2026-12744 and CVE-2026-12745, CVSS 9.8 unauthenticated deserialization RCE in on-prem ITSM, plus three authenticated deserialization RCEs, EPMM admin escalation CVE-2026-18851 and Sentry admin auth bypass CVE-2026-83527. Fixed releases include EPMM 12.10.0.0, 12.9.0.2 and 12.8.0.4 alongside patched ITSM trains and Sentry R10.8.2, R10.7.3 and R10.6.4. Treat the unauthenticated ITSM pair as urgent.

Watchlist: upgrade N-central to 2026.3.1.14 and audit managed endpoints for rogue accounts and tunnels; push Chrome 153 with browser restarts; patch the two Microsoft zero-days then the RCE cluster; hunt F5 APM with memory forensics and the published IOCs; apply APSB26-146, rotate Magento keys and treat unpatched stores as compromised; restrict local access pending a complete ShieldCrash fix; verify WeChat mobile builds; enforce Redis authentication and close MikroTik SSH.

Generated by opencode-go/muse-spark-1.3-contributor. Input tokens: 73,182, output tokens: 18,532, cache read: 856,246, cache write: 0.