Published Wednesday, September 09, 2026 at 09:01 AM PT
BLUF: The patch Tuesday gods are furious, zero-day hunters are having the time of their lives, and somehow your browser, your Windows box, your SAP kernel, and your dentist’s Plex server are all on fire simultaneously. Mostly routine apocalypse at this point.
CYBER
Microsoft just dropped 974 patches in one sitting, which is either the most responsible thing they’ve done this year or a sign that their QA department fought someone with a flamethrower and lost. The roster includes two actively exploited Windows zero-days and a Defender flaw called “ShieldCrash” that lets an attacker escalate straight to SYSTEM if they can touch your endpoint — which, congratulations, you probably let them do three months ago [The Hacker News] [HIGH CONFIDENCE]. A researcher’s already dropped a PoC showing the initial patch got kneecapped and you can bypass it anyway, so basically Microsoft published a security theater roadmap for free [The Hacker News].
Google’s also having a real moment. They patched a Chrome V8 zero-day (CVE-2026-87491) that’s being actively exploited in the wild to break out of the sandbox, plus 229 other vulnerabilities you haven’t heard of and will never fix [Help Net Security] [Google] [HIGH CONFIDENCE]. V8 escapes are the kind of thing that makes you understand why browser vendors occasionally just start drinking straight from the bottle.
SAP shipped a CVSS 10.0 (that’s a perfect score in the “you are completely fucked” department) kernel vulnerability that allows unauthenticated remote code execution. If you’re running SAP and your threat model doesn’t include “someone who knows your FQDN,” congratulations, you’re about to learn why it should [The Hacker News] [HIGH CONFIDENCE]. F5 BIG-IP APM got compromised to deliver fileless malware injected straight into RAM, which means your disk scans are useless and the machine spirit is, in Adeptus Mechanicus terms, thoroughly angered [The Hacker News]. cPanel’s latest gift is an RCE that runs as root if literally anyone with mail privileges on any hosted account decides to get creative [The Hacker News].
MikroTik’s RouterOS is being actively chain-exploited by something called “MikroTrick” — attackers are leveraging six vulnerabilities in sequence to plant persistent backdoors in the operating system itself [CERT Polska] [MODERATE CONFIDENCE]. That’s the kind of attack where by the time you patch the first one, they’re already living in layer 3. RouterOS runs a frankly unreasonable chunk of the internet’s edge, so this is the sort of thing that makes infrastructure people wake up in cold sweats.
The supply chain is getting absolutely shredded. U.S. intelligence agencies are publicly accusing Chinese AI firms (DeepSeek, Qwen, and others) of systematically distilling Claude, GPT-4, Gemini, and Grok to build cheaper knockoffs — which is morally somewhere between “aggressive competitive advantage” and “literally stealing your homework” depending on which side you’re sitting on [The Hacker News] [MODERATE CONFIDENCE]. DeepSeek’s own harness had a critical flaw that let AI agents disable their own file sandbox without approval, which is what happens when you’re shipping research that ships shipping tools without anyone asking the hardest questions first [The Hacker News].
ChatGPT had a flaw (patched) that let attackers extract Gmail data from connected accounts through hidden channel prompts — a user’s Gmail account would just start exfiltrating if you knew which prompt string to use [The Hacker News]. The prompt becomes the payload, as they’re now calling it, and honestly the whole “AI reads your email without telling you” situation is exactly the kind of thing that should concern you more than it does [CSO Online].
Criminal groups are having a banner year. ShinyHunters is now claiming the Florida DMV database (driver records, licensing, sensitive personal data), and they’re using the extortion clock playbook — data goes on the auction block unless you pay [CSO Online]. They’re also targeting the health sector with vishing (social engineering calls), credential theft, and MFA bypass, which is just old-fashioned crime wearing a 2026 hat [Health-ISAC] [MODERATE CONFIDENCE]. A nationwide crackdown in Hyderabad netted 47 suspects across 7 states in online fraud rings; Indore got 13 more in a stock-market scam; and a man in the U.S. got 15 years for extorting women with AI-generated porn videos, which is the kind of development that makes you realize the tools are accelerating already-criminal behavior faster than the law can keep up [news4hackers] [CSO Online] [HIGH CONFIDENCE].
Plex servers are bleeding everywhere. Over 36,000 Plex servers exposed to the internet have recent vulnerabilities that can be chained to get remote access or media library exfiltration [BleepingComputer] [HIGH CONFIDENCE]. If your Plex box is internet-facing and you haven’t updated it since your last vacation, someone’s probably already watching your home videos. Rule of Acquisition #48: the bigger the smile, the sharper the knife. Your dependency’s minor patch? Probably just sharpening.
CRPx0 is a new ransomware variant making the rounds; it’s not novel enough to warrant deep analysis, but it’s competent enough to ruin your week if it gets in [Graham Cluley].
MILITARY / GEOPOLITICAL
Ukraine’s domestic defense production is running at a pace that should horrify Russian planners. The BTR-4 armored vehicle manufacturer has built over 600 units since the full-scale invasion despite strikes on their facilities [Defence Blog] [HIGH CONFIDENCE]. That’s manufacturing resilience under fire, and the machine spirit there deserves an offering of spare parts and a prayer.
Ukrainian drone operations expanded into the Mediterranean this week — Russian military-affiliated channels are raising alarm that reach now extends well beyond Black Sea operations, signaling either weapons platform improvements or shift in operational theater [Defence Blog] [MODERATE CONFIDENCE]. That’s the kind of tactical expansion that compounds over time.
Russia’s spending profile is absolutely feral: 44% of the federal budget went to military operations in the first half of 2026 [Defence Blog] [HIGH CONFIDENCE]. For reference, that’s not “we’re funding the military,” that’s “the military IS the budget.” Unsustainable doesn’t get the job done if you’re willing to eat everything else.
NATO procurement is clicking into higher gear. Italy’s ordering two more MQ-9A Block 5 Reapers (delivery EOY 2027) [The Aviationist]; Poland’s buying 24 additional ARSUS surveillance systems from Turkey [Defence Blog]; France deployed its first two Falcon 2000 LXS Albatros maritime surveillance aircraft to the Navy [Defence Blog]; Finland agreed to buy 100+ Patria TREMOS mobile mortar systems with options for hundreds more [Defence Blog] [HIGH CONFIDENCE on all]. That’s coordinated rearming, the kind that signals alliance cohesion and long-term commitment, though whether it’s fast enough is a question much smarter people than me are arguing over in Brussels.
The Grenadier (ex-Land Rover Defender replacement on the civilian market) is now competing for British Army service [Defence Blog], and a startup called Poseidon Aerospace just raised $60 million for unmanned cargo aircraft [Defence Blog] — both signs that the force design philosophy is drifting toward autonomous/unmanned and modular platforms.
PHYSICAL / LOCAL
NOSIG — no significant infrastructure security activity or SoCal-specific threats in this cycle. You’re welcome.
NUCLEAR / WMD
NOSIG.
ASSESSMENT
You’re watching a synchronized stress-test across every layer of the stack. Vulnerabilities are shipping faster than patches can catch them, criminal groups are scaling to industrial operations, and state actors are both rearming and distilling each other’s AI. The patch velocity is apocalyptic (Microsoft 974 in one drop), the zero-day burn-rate is brutal, and the supply chain is openly compromised at the frontier-AI layer. The good news: none of this is surprising to anyone who’s been paying attention. The bad news: paying attention doesn’t make you immune.
For your fleet specifically: MikroTik gear needs immediate triage if you’re running RouterOS at any trust boundary; keep Plex internet-facing only if you’ve patched in the last 48 hours; patch Chrome and Defender now, not Tuesday; and if you’re running SAP, treat that network like it’s actively compromised until you’ve validated the full patch chain. The machine spirit is displeased across the board.
KEY JUDGMENTS: The pace of active exploitation is abnormally high, zero-day markets are flush, and the confidence interval on “this code is safe to run” just got wider. Ukraine’s production resilience and NATO rearming are real, but they’re racing against Russian burn-rate and industrial capacity — this is a long game now. The AI supply-chain compromise is unprecedented in scope and ongoing; you should assume Claude, GPT, Gemini code is available to competitors at scale.
Our own posture, for context:
