44 issues

All briefings

September 2026

21 Sept 2026 — Google names fixed Chrome releases for six critical flaws as CISA flags active exploitation in Linux and Zyxel gear Six 9.6-rated Chrome vulnerabilities arrived with fixed releases named, alongside confirmed in-the-wild exploitation of three Linux kernel flaws and a Zyxel switch flaw, and a fake LastPass Authenticator installer that disables security software.

20 Sept 2026 — Six critical Chrome flaws fixed at 9.6; supply-chain and sandbox-escape research fills out the day Google's advisory lists six remote, high-impact Chrome vulnerabilities fixed in one stable release, alongside separate reporting on npm malware, an OpenAI Codex sandbox escape, and the Cisco and Revolut incidents recapped in Help Net Security's week-in-review.

18 Sept 2026 — Unauthenticated root RCE in Check Point management servers leads a heavy Friday of critical fixes The Hacker News reports an unauthenticated code-execution flaw in the Check Point server that controls firewall policy, while Google's advisory lists six Chrome bugs each scored 9.6.

17 Sept 2026 — Cisco Rushes Emergency Patch for Actively Exploited ISE Zero-Day as Apple Ships Six Critical macOS Fixes An unauthenticated authentication-bypass flaw in Cisco Identity Services Engine is under active exploitation, while Apple patches six critical macOS holes and Microsoft investigates a Windows 11 update breaking domain trust.

16 Sept 2026 — CISA flags two actively exploited flaws in Cisco ISE and Acronis Backup; Google patches six critical Chrome bugs Wednesday brought active exploitation of enterprise network gear and a PBX framework, a six-bug Chrome release rated critical, a local-root flaw on Macs, and a Windows update breaking domain logins.

15 Sept 2026 — Actively exploited Chrome flaw and an exploited Acronis backup plugin headline Tuesday's fixes Two flaws under active exploitation — one in Google Chrome, one in Acronis's backup plugin — landed alongside a record Apple patch run, a backdoored WordPress plugin, and fresh Iranian and Brazilian malware reporting.

14 Sept 2026 — CISA flags an actively exploited Cisco email-gateway flaw as a ClickFix malvertising blitz hits Windows and Mac Monday brought one new actively-exploited vulnerability onto CISA's catalogue and a two-day malvertising campaign, run through a hijacked HBO Max Reddit account, aimed at both major desktop platforms.

13 Sept 2026 — Three actively exploited flaws land on CISA's KEV list; Google ships a Chrome release fixing four bugs CISA lists one Chrome flaw and two Windows Server flaws as known to be exploited, while Microsoft discloses two active campaigns and BleepingComputer reports a China-aligned group deploying a backdoor through a Tencent app.

11 Sept 2026 — Actively exploited GitLab, Artifactory and browser flaws all have fixes — patch these first Friday's reporting was dominated by vulnerabilities already under attack with patches available, alongside a run of AI-assisted intrusion campaigns.

10 Sept 2026 — Three actively exploited flaws hit CISA's KEV list — Chrome and Windows Server both named CISA lists one Google Chrome flaw and two Microsoft Windows Server flaws as known to be exploited, while SecurityWeek reports a new zero-day exploit that provides full System privileges on Windows machines running the September 2026 patches and targets Microsoft Defender.

8 Sept 2026 — A Chrome flaw CISA lists as known-exploited tops six Google fixes; PEEP turns Chrome and Edge into backdoors CISA lists CVE-2026-85046 in Chrome as known to be exploited, Google has shipped fixes for six Chrome flaws in total, and The Hacker News reports that researchers have disclosed a Chromium post-exploitation toolkit named PEEP.

7 Sept 2026 — Google Chrome zero-day added to CISA KEV — actively exploited, patch now Monday brought an exploited Chrome flaw on CISA's KEV list, an emergency N-able N-central RCE hotfix, an Adobe Commerce zero-day backdooring stores, and breaches hitting Mathspace, Trezor and Berlin.

6 Sept 2026 — Unpatched Magento and Adobe Commerce zero-day is being used to backdoor stores; Chrome flaw added to CISA's exploited list Recent reporting centres on two flaws already under attack — an unpatched remote-code-execution bug in Magento and Adobe Commerce, and a Google Chrome vulnerability CISA now lists as exploited — alongside MikroTik router takeovers, new browser fixes, and a stealer that disables Windows defences.

5 Sept 2026 — Sansec reports an unpatched, actively exploited zero-day backdooring Magento and Adobe Commerce stores A no-login remote code execution flaw in Magento Open Source and Adobe Commerce is under active exploitation with no fix available, the day's most urgent item among a run of exploited flaws and breaches.

← Newer Page 2 of 2