🇨🇳 UNC3569 one-click Sogou RCE confirmed in the wild, 🌑 BlueMoon kit gains Defender patch bypass, 🇬🇷 Anubis details Greek healthcare attack, ☁️ AWS SSM Agent flaw exposes IAM credentials, 🚪 Suprema BioStar 2 leaks AD bind password, 🐧 Twin nfsd batches drop kernel 9.8s

Gen Digital's Threat Labs confirmed over the weekend that China-aligned UNC3569 is actively exploiting CVE-2026-51990, a critical one-click RCE in Tencent's Sogou Input Method for Windows, to install the GrayRabbit backdoor through a crafted link, and this is a sharper picture than the update-path framing we carried on September 11. The verified chain now runs from a crafted sgbiz: URI, through biz_helper.exe passing attacker-controlled arguments to SGMyInput.exe, into the skincenter component's embedded Chromium webview navigating to an attacker URL, with the outdated unsandboxed engine completing code execution and the GrayRabbit sideload. Sogou ships to hundreds of millions of Chinese Windows desktops, so any managed environment with it installed should update immediately or restrict sgbiz: URI handling; IOCs are public.

The BlueMoon exploit kit story moved on the defensive side: ShieldCrash, a claimed bypass of the CVE-2026-69414 patch in Microsoft Defender, surfaced September 13, while weekend roundups reconfirmed the kit's core chain of the CVE-2026-85046 and CVE-2026-87491 V8 flaws with the CVE-2026-85880 Windows ALPC overflow, in use by four China-aligned groups since August 28. Verify browser and OS patch levels and make sure endpoint detection covers the V8-corruption-then-ALPC pattern.

Anubis ransomware's leak post for Interim Healthcare, a Greece-based healthcare organization, claims 335,093 encrypted files totaling 530 GB with backup systems included, and the operators referenced CVE-2025-5777 as a likely initial-access vector, per SuspectFile's report today. Encryption that broad plus destroyed backups in healthcare means lateral movement ran uncontained; verify backup isolation with separate credentials and check exposure to the referenced flaw.

A critical flaw in AWS Systems Manager Agent, CVE-2026-89049, lets an authorized user evade the denylist on Session Manager's AWS-StartPortForwardingSessionToRemoteHost capability by submitting alternative representations of blocked addresses, reach link-local services such as the IMDS endpoint at 169.254.169.254, and steal the instance's temporary IAM credentials, per GitHub security advisory GHSA-w9jw-h72g-6hxc3. The fix is SSM Agent 3.3.4851.0, and fleets that treat Session Manager as their SSH replacement should patch and review who holds port-forwarding permissions.

Suprema BioStar 2, the door-access platform, hands out its Active Directory service-account password in cleartext: CVE-2026-31278 (CVSS 7.7) lets any operator-level account read the bind account name, password, LDAP server address and SSL configuration from the adserversetting endpoint, affecting BioStar 2 before 2.9.12 and BioStar X before 1.0.2, with a public proof of concept. Rotate that service account before upgrading, since the patch stops future reads but not leaked credentials, and start treating physical-access appliances as part of the identity attack surface.

Two independently disclosed batches of Linux kernel nfsd flaws are remotely reachable by NFS clients. The first pairs CVE-2026-89688 and CVE-2026-89689, twin CVSS 9.8 state-handling bugs in the NFSv4 server where nfsd drops the stateid instead of the stateowner and frees session slots still in use, with CVE-2026-89687, a race in file acquisition. The second has CVE-2026-89686, a 9.8 delegation-revoke race in nfsd4_alloc_layout_stateid that two cooperating clients can turn into a kernel crash, and CVE-2026-89685, a clock-domain bug that lets one client hold the server in grace indefinitely and freeze every other client. These ship as kernel patches, so confirm your distribution's backport status on NFSv4 servers rather than trusting package presence.

ConnectWise has patched a ScreenConnect vulnerability that SecurityWeek reports is being exploited in worm-like attacks, days after the ScreenConnect flaw CVE-2026-84869 hit the KEV catalog, and worm behavior in an RMM product is how one provider becomes hundreds of breached clients. Patch ScreenConnect servers now and watch for re-exploitation against lagging versions.

SAP's OVERPASS vulnerability, CVE-2026-44756, a CVSS 10.0 kernel flaw reachable before authentication over HTTP, SAP GUI and RFC, was patched on September 8 but drew fresh attention today with researchers at DiSEC counting more than 10,000 SAP interfaces exposed on the public internet, many on vulnerable versions. Protocol breadth defeats single-protocol restrictions, so verify kernel patch levels and audit which systems can reach RFC.

GitHub paid a $100,000 bounty for CVE-2026-3854, a critical unauthenticated RCE triggered by crafted repository URLs or Git push input, disclosed July 22 after coordinated patching; researcher Saif Ghani's proof of concept showed shell access able to read repository secrets and alter code mid-service, a direct path into the software supply chain. Self-hosted GitHub Enterprise administrators should confirm they run the patched release.

The Revolut breach has moved from confirmation to publication: the attackers who filed fake government data requests are now leaking stolen customer documents and threatening daily releases, and the confirmed inventory is broad, spanning passport and driving-license copies, verification selfies, account statements, IBANs and full transaction histories, while Revolut maintains its core systems and customer accounts were never compromised. Expect convincing impersonation attempts against exposed customers, built from real transaction patterns.

A 15.5 GB dump of 7,337,395 Chess.com user records surfaced free on two leak forums under the handle V0idix, and the technical verification argues scraping rather than a breach: version-1 UUID timestamps matched registration dates across 200,000 sampled records, the data arrived in daily batches over nine consecutive days, and duplicated rows do not occur in genuine database exports. The internal Google Ad Manager audience segments on every row are the anomaly, hinting at an authenticated or internal endpoint; no passwords or payment data are included.

CVE-2025-59374, flagged over the weekend, involves malicious code in ASUS Live Update, the auto-update utility bundled with ASUS desktops and laptops, actively exploited and on CISA's KEV catalog, with the obvious echo of 2019's ShadowHammer supply-chain attack. The practical move is unusual: remove Live Update on managed fleets and fetch firmware and drivers manually from ASUS support instead.

Acronis is urging immediate updates of its cPanel plugin to 1.9.3 HF3 or 1.9.4 after in-the-wild exploitation, and backup software sitting on hosting boxes is exactly what ransomware crews look for first.

The Path Traversal Tourist tracking story added a Vietnam-linked source today, 160.250.132.238 in AS150895, joining the Singapore-linked 47.236.173.77 in chaining CVE-2017-9841 PHPUnit RCE and CVE-2021-41773 Apache path traversal against legacy servers, all KEV-listed and all still widely unpatched in the private sector. Rotating, distributed scan infrastructure makes IP blocking a losing game; the fix remains shrinking the unpatched tail.

Watchlist: update SSM Agent to 3.3.4851.0 or later and audit Session Manager port-forwarding permissions, rotate the BioStar 2 AD bind account before upgrading, confirm kernel backports for both nfsd batches on NFSv4 servers, remove ASUS Live Update from managed endpoints, get the Acronis cPanel plugin to 1.9.4, patch ScreenConnect before the worm-like attacks find lagging versions, deploy Chrome 153 and hunt V8-corruption-plus-ALPC chains for BlueMoon, and watch Revolut-exposed inboxes for transaction-informed phishing.

Generated by zai/glm-5.3-flash. Input tokens: 126,554, output tokens: 51,132, cache read: 3,528,064, cache write: 0.