VulnHub

Recent reports indicate that the BlueMoon exploit kit is being used by various espionage-focused threat actors to target vulnerabilities in Google Chrome and Windows. These attackers are taking advantage of zero-day vulnerabilities to deploy their exploits quickly and opportunistically. This poses a significant risk to users of these platforms, as the vulnerabilities are actively exploited, potentially allowing unauthorized access to sensitive information. Organizations and individuals using affected versions of Chrome and Windows should prioritize updating their systems to mitigate these risks. The situation underscores the continuing need for vigilance in cybersecurity practices, particularly for software that is widely used.

On Patch Tuesday, Microsoft addressed a record-breaking 974 vulnerabilities across its software, including two that are currently being exploited. The vulnerabilities include 723 in Windows, 111 in Office, 62 in SQL, and 22 in Developer Tools. Over 110 of these flaws are classified as critical, meaning they could allow attackers to gain significant control over affected systems. The fact that two of these vulnerabilities are actively exploited in the wild raises serious concerns for users and organizations using these products. It is crucial for users to apply the patches as soon as possible to protect their systems from potential attacks.

The Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, indicating that these flaws are actively being exploited in the wild. The vulnerabilities include CVE-2026-75650 affecting Adobe Commerce and Magento, CVE-2026-81963 and CVE-2026-85880 impacting Microsoft Windows, and CVE-2026-86218 concerning N-able N-central. These vulnerabilities are particularly concerning for federal agencies, as they could allow attackers to gain total control over compromised systems. CISA's Binding Operational Directive 26-04 emphasizes the need for federal agencies to promptly address high-risk vulnerabilities, and while it specifically applies to federal entities, CISA encourages all organizations to adopt similar practices for managing and mitigating risks associated with these vulnerabilities.

CloudSEK has discovered a new phishing-as-a-service campaign known as BigBear 2.0, which has successfully stolen over 5,000 Microsoft 365 credentials. This operation primarily targets users of Microsoft 365, putting their accounts and sensitive information at risk. The attack leverages deceptive tactics to trick users into providing their login details, which can lead to unauthorized access to corporate and personal accounts. As phishing campaigns continue to evolve, it is crucial for organizations and individuals to remain vigilant and implement strong security measures to protect against these types of attacks. Users are advised to enable multi-factor authentication and be cautious of suspicious links and emails.

Researchers at Elastic Security Labs have identified four previously unknown programs connected to REVSTEALER, a Windows information-stealing malware. These programs persist on infected systems even after REVSTEALER removes itself. Notably, one of the modules disables Windows Update and Microsoft Defender, allowing a cryptocurrency miner to operate without interference. This poses a significant risk to users, as it not only compromises their data but also hijacks system resources for mining operations. Users and organizations need to be aware of these threats to protect their systems from potential exploitation.

Google has released a patch for several vulnerabilities in its Chrome browser, including a serious zero-day flaw identified as CVE-2026-85046, which is currently being exploited by attackers. The company confirmed that exploits for this vulnerability are circulating in the wild, prompting the urgent update. Users on Windows, macOS, and Linux should ensure they are running the latest version, which includes Chrome 152.0.7977.82/.83 for Windows and macOS, and Chrome 152.0.7977.82 for Linux. Keeping browsers up to date is crucial to mitigate risks from such vulnerabilities, which could allow attackers to gain unauthorized access or execute malicious code. This incident serves as a reminder of the importance of regular software updates to protect against emerging threats.

Rockwell Automation's FactoryTalk Activation Manager, specifically versions V5.02 and earlier, has a serious privilege escalation vulnerability (CVE-2026-16675). This flaw allows authenticated attackers with Windows credentials to gain SYSTEM-level access by hijacking console windows that appear during installation or repair processes. This could potentially give attackers full control over files and system resources. Users are urged to update to version V5.03 to mitigate this risk. For those unable to upgrade, implementing Rockwell Automation's security best practices is recommended to reduce exposure. The vulnerability affects critical manufacturing sectors globally, emphasizing the need for organizations to prioritize cybersecurity in their operational technology environments.

Microsoft has acknowledged a problem with the KB5120998 update for Windows 11, released in August 2026. Users have reported that their mouse settings revert back to default after installing this non-security preview update. This issue affects a wide range of Windows 11 devices, potentially disrupting user experience as people may have customized their settings for better functionality. Microsoft has not provided a specific timeline for a fix, which means users will need to manually adjust their settings after each update until a solution is implemented. This situation highlights the importance of user feedback in identifying software issues that may not be critical but still impact usability.

Researchers have identified 19 browser extensions—18 for Google Chrome and one for Microsoft Edge—that contain malicious code designed to steal cryptocurrency wallet secrets and drain funds. These extensions were published in the last six months and share similar coding techniques, suggesting they may be part of a coordinated attack. Users of these browsers who have downloaded these extensions are at risk of losing their cryptocurrency assets. This discovery highlights the need for users to scrutinize extensions before installation and for browser vendors to enhance their review processes to prevent such malicious software from being available in their stores.

Vercel has issued security patches for two serious vulnerabilities in the Next.js framework that could allow attackers to execute code remotely without authentication. The first vulnerability arises from the handling of AVIF image files, which can be manipulated to exploit the system. The second flaw is a path traversal issue that affects installations on Windows filesystems, enabling unauthorized access to files. These vulnerabilities are particularly concerning because they can be exploited without any user interaction, putting many applications at risk if they use Next.js. Developers using this framework should prioritize updating to the latest version to mitigate these risks.

On August 26, CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog, indicating that these flaws are being actively exploited by attackers. The affected products include software from Microsoft, Linux, Red Hat, and Citrix, which are widely used in various computing environments. This is a significant concern for organizations relying on these systems, as attackers could leverage these vulnerabilities to gain unauthorized access or disrupt services. Companies should prioritize patching these flaws to mitigate potential risks. The ongoing exploitation of these vulnerabilities underscores the need for vigilance in maintaining software security.

The Cybersecurity and Infrastructure Security Agency (CISA) has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating they are currently being exploited in the wild. These vulnerabilities affect a variety of systems, including Red Hat Libuser, Microsoft SQL Server, and Citrix NetScaler, among others. The identified vulnerabilities range from privilege escalation to remote code execution, posing serious risks to federal agencies and potentially impacting other organizations as well. CISA urges all entities to prioritize fixing these vulnerabilities to protect their systems, especially those that expose critical assets to attackers. The agency encourages reporting any additional exploited vulnerabilities that are not yet in the KEV Catalog for potential inclusion.