VulnHub

Google has released a patch for several vulnerabilities in its Chrome browser, including a serious zero-day flaw identified as CVE-2026-85046, which is currently being exploited by attackers. The company confirmed that exploits for this vulnerability are circulating in the wild, prompting the urgent update. Users on Windows, macOS, and Linux should ensure they are running the latest version, which includes Chrome 152.0.7977.82/.83 for Windows and macOS, and Chrome 152.0.7977.82 for Linux. Keeping browsers up to date is crucial to mitigate risks from such vulnerabilities, which could allow attackers to gain unauthorized access or execute malicious code. This incident serves as a reminder of the importance of regular software updates to protect against emerging threats.

VMware has released updates for its Workstation and Fusion products to address a serious vulnerability that could be exploited by attackers with administrative access to a virtual machine. This flaw allows them to execute code on the host system, which poses a significant risk to users and organizations relying on these virtualization tools. The vulnerability underscores the necessity of keeping software up to date, especially in environments where virtual machines are used extensively. Users are strongly advised to apply the latest patches to safeguard their systems from potential attacks. Without these updates, systems could be left vulnerable to exploitation, compromising the security and integrity of the host environment.

A recently exploited vulnerability in a voting system has raised concerns about the integrity of elections in Georgia, which utilizes affected ballot scanners. This flaw, first disclosed nearly four years ago, allows individuals to deduce the order in which ballots were cast without needing to access any voting machines or private networks. Using publicly available data, including early-voting lists and cast-vote record files, a researcher successfully analyzed voter behavior during the May 2026 primary. The ability to reconstruct ballot order poses risks to voter privacy and the overall transparency of the electoral process, highlighting the need for enhanced security measures in voting technologies. As this vulnerability is actively being exploited, it’s crucial for election officials to address these weaknesses promptly to safeguard future elections.

Researchers at Hunt.io have revealed a significant cyber campaign linked to Chinese hackers that employs AI agents to automate attacks. This operation has targeted various entities across Asia, including the Kuomintang Party archives in Taiwan and Indonesia’s Ministry of Foreign Affairs, as well as government and educational systems. The use of commercial AI models in these cyberespionage efforts marks a troubling evolution in how attackers conduct operations, enabling them to execute attacks more efficiently and at a larger scale. This situation raises alarms for national security, as compromised government systems could lead to sensitive information leaks and undermine trust in these institutions. Entities in affected regions should enhance their cybersecurity measures to defend against these sophisticated threats.

Kaspersky's GERT team has identified new backdoors linked to the hacking group known as Toy Ghouls. These backdoors utilize two distinct methods for command-and-control: one operates through the HiveMQ MQTT broker, while the other employs the Matrix-based Element messenger. This discovery raises alarms as it indicates the group's ongoing efforts to establish secure communication channels for their malicious activities. The use of these platforms suggests that the attackers may be adapting their techniques to evade detection, which could pose significant risks to organizations relying on these technologies. Understanding and mitigating this threat is crucial for enhancing cybersecurity measures against such evolving tactics.

Researchers from Wordfence have discovered that hackers are taking advantage of two serious vulnerabilities in popular WordPress plugins: Super Forms and Elementor Pro. The first vulnerability, identified as CVE-2026-14894, has a CVSS score of 9.8 and allows unauthenticated attackers to upload files of any type due to a lack of file type validation in the Super Forms plugin. This flaw has led to over 440,000 exploit attempts. The Elementor Pro plugin is also affected, although specific details about its vulnerabilities were not provided. This situation is alarming for website owners using these plugins, as successful exploitation can lead to unauthorized access and potential data breaches. Website administrators should take immediate action to secure their sites against these threats.

Google has rolled out a security update to address 12 vulnerabilities in Chrome, including a high-severity flaw tracked as CVE-2026-85046. This vulnerability, identified as a type confusion bug in V8, the JavaScript and WebAssembly engine used by Chrome, has been actively exploited in the wild. Users of Chrome versions prior to 152.0.7977.82 are particularly at risk, as this flaw could allow attackers to execute malicious code remotely. This situation underscores the urgent need for users to update their browsers to the latest version to protect against potential attacks. Keeping software up to date is crucial in safeguarding against emerging threats.

In August 2026, the Patch Tuesday event resulted in a staggering 398 resolved vulnerabilities (CVEs), marking it as the second-largest patch release in history. Of these, 42 were classified as critical, while 355 were important, and one was deemed moderate. Despite the significant number of patches, only one vulnerability was confirmed to be actively exploited in the wild, with two others disclosed publicly before the patches were released. This trend indicates a growing challenge for organizations to keep their systems secure amidst an increasing volume of patches. Companies need to prioritize these updates to protect against potential exploitation of the vulnerabilities that remain unpatched.