Breaking-Alert

Published Thursday, September 10, 2026 at 05:05 AM PT BLUF: Four distinct nation-state threat actors deployed the same Chrome zero-day exploit kit (CVE-2026-85046) within 12 days of initial discovery, indicating rapid shared access to exploit infrastructure or coordinated development. Google patched the actively exploited type-confusion vulnerability. All Chrome users should update immediately; Windows users should also patch concurrent zero-day exploits in the same toolkit. ...

Published Thursday, September 10, 2026 at 05:04 AM PT BLUF: Microsoft Defender contains a critical zero-day vulnerability (ShieldCrash/ShieldBreak) enabling local privilege escalation to SYSTEM. Multiple variants confirmed across Windows deployments. Patch in development; at least one variant already has public bypass PoC. Affected systems should assume compromise possible if Defender has processed untrusted input. DETAILS: Vulnerability chain: Zero-day in Microsoft Defender processes enable unauthenticated local privilege escalation to SYSTEM context; exploitation requires code execution as standard user first, then leverages Defender internals to gain full system privileges. ...

Published Thursday, September 10, 2026 at 05:04 AM PT BLUF: Adversaries are actively harvesting encrypted data today for future decryption once quantum computers break current encryption. The vulnerability window is not future—it opened when data was encrypted. Organizations must begin post-quantum cryptography (PQC) migration immediately; business leaders frequently dismiss quantum threats as “ten years out” and delay action, but the operational timeline is NOW. No specific sector or incident yet, but CSO Online reporting signals elevated CISO attention to this threat model. ...

Published Wednesday, September 09, 2026 at 05:32 PM PT BLUF: Microsoft’s September 2026 Patch Tuesday includes fixes for CVE-2026-85880 and CVE-2026-81963, two Windows privilege escalation vulnerabilities already exploited in active attacks. Both allow local attackers to escalate to SYSTEM access. Patch immediately on all Windows systems; exploitation requires local access but no user interaction. DETAILS Both CVE-2026-85880 and CVE-2026-81963 are Windows privilege escalation flaws carrying CVSS 7.8 severity Vulnerabilities are actively exploited in the wild — in-the-wild exploitation is confirmed, not theoretical Attack chain: attacker with initial local access (compromised account, physical access, or lateral movement from network compromise) can escalate privileges to SYSTEM without additional user action Microsoft addressed both in September 2026 Patch Tuesday cycle Both are zero-days — previously unknown and unpatched before this cycle IMPACT ...

Published Wednesday, September 09, 2026 at 05:31 PM PT BLUF: Google has released Chrome 153 to patch CVE-2026-87491, an out-of-bounds write vulnerability in the V8 JavaScript engine that is actively being exploited in real-world attacks. All Chrome users should update immediately to 153 or later. Organizations should prioritize patching workstations, developer machines, and any systems where Chrome is exposed to untrusted content. ...

Published Wednesday, September 09, 2026 at 05:01 PM PT BLUF: Multiple China-aligned threat groups are actively exploiting a chain of previously unknown zero-day vulnerabilities. Proofpoint reports ongoing activity targeting unspecified organizations, with expectation of widened exploitation. Specific CVEs, products, and targets remain unconfirmed pending additional threat intelligence. DETAILS Multiple China-aligned espionage groups have begun rapid exploitation of a “triple-link chain” of zero-day vulnerabilities; temporal scope of exploitation activity unknown. Proofpoint has identified the activity and assessed it as ongoing with high probability of expansion to additional threat actors and targets. Organizations targeted are described only as “various” — specific sectors, geographies, or entity types not yet disclosed. Technical nature of the vulnerability chain (interconnected exploits, privilege escalation sequence, or supply-chain link) is not detailed in available reporting. No CVE identifiers, affected product names, or vendor mitigation guidance available as of publication. IMPACT ...

Published Wednesday, September 09, 2026 at 11:29 AM PT Google Chrome 153, released to stable channel Tuesday, patches 230 security vulnerabilities including an actively exploited zero-day — the seventh confirmed zero-day breach of 2026. All Chrome users must update immediately. Specific CVE, attack vector, and affected component unconfirmed in available reporting. DETAILS • Chrome 153 shipped Tuesday with 230 total security fixes; at least one is an actively exploited zero-day vulnerability. • This marks the 7th zero-day of 2026, continuing a pattern of escalating in-the-wild exploitation: Chrome 152 patched the 6th zero-day; CVE-2026-85046 and CVE-2026-11645 (both in earlier Chrome versions) confirmed active exploitation. • Chrome version number for the zero-day, specific CVE identifier, and technical details (attack vector, component, CVSS score) not yet disclosed in available advisories. • Active exploitation timeline, affected systems, and campaign attribution not specified. ...

Published Wednesday, September 09, 2026 at 11:29 AM PT BLUF: Qualys Threat Research reports that AI/ML models used to discover 10,000 zero-days successfully compromised three companies by exploiting weak passwords. Specific company identities, breach scope, and incident timeline remain unconfirmed. Organizations should assume credential-based attacks are now AI-assisted and prepare immediate password audits, MFA enforcement, and breach-response protocols. ...

Published Wednesday, September 09, 2026 at 10:00 AM PT BLUF: Apple has released iOS 26.6.2 and iPadOS 26.6.2. Support documentation exists at https://support.apple.com/en-us/100100 but CVE details are not accessible for independent confirmation. All Apple devices running affected versions should be assumed at elevated risk pending security advisory details. Recommendation: defer deployment until CVE specifics are published. DETAILS Release confirmed: iOS and iPadOS 26.6.2 released; supported platform documentation exists but contents unverified CVE information: UNABLE TO CONFIRM. Published support article (https://support.apple.com/en-us/100100) not fetched; specific vulnerability counts, severity ratings, and affected components unknown Historical pattern: Prior iOS 26.5.x releases in June–July 2026 patched 25+ vulnerabilities; related macOS updates addressed 87+ iOS vulns and 155+ macOS vulns; WebKit was a common attack surface AI-powered threats noted: Apple’s June 2026 advisories cited acceleration of security cadence in response to AI-assisted threat landscape Version timeline: 26.6.2 follows 26.5.2 (July 2026); rollout scope unknown IMPACT ...

Published Wednesday, September 09, 2026 at 05:28 AM PT BLUF: Google has warned of a new Chrome zero-day vulnerability being exploited in active attacks. Specific CVE, affected versions, and patch status unclear from available reporting. Organizations running Chrome should monitor for emergency updates and apply immediately upon release. Sources confirm exploitation in the wild. DETAILS: BleepingComputer reported Google warning of a Chrome zero-day under active exploitation Attack activity is confirmed (not theoretical) Google’s response posture suggests active patching cycle underway Related context indicates 2026 has seen multiple Chrome zero-days: CVE-2026-87491 (V8 vulnerability), CVE-2026-85046, and references to “the sixth actively exploited Chrome zero-day of 2026” — current CVE assignment for this new zero-day not yet isolated from provided material Google’s engineering has been aggressive on zero-day response this year (230+ vulnerability fixes, 1,072 security bugs patched in two releases per available sources) IMPACT: ...