Breaking-Alert

Published Saturday, September 05, 2026 at 05:04 PM PT BLUF: Attackers are actively exploiting unpatched zero-day vulnerabilities in Magento and Adobe Commerce to deploy persistent backdoors and hijack customer accounts on affected e-commerce stores. Exploitation is live; patch status and scope confirmation in progress. DETAILS: Multiple sources report zero-day exploitation targeting Magento and Adobe Commerce platforms; attackers achieving backdoor deployment and customer account compromise Adobe Commerce vulnerability (CVE-2026-71362 referenced in secondary reporting) targeted immediately post-disclosure; exploitation attempts observed within hours Attack vector described in related disclosures as SQL injection enabling unauthorized data access and system compromise Unpatched systems confirmed as primary target; patched versions reported available but deployment status across customer base unknown Backdoor persistence capability confirmed — not opportunistic access, but sustained foothold establishment IMPACT: ...

Published Friday, September 04, 2026 at 11:00 AM PT BLUF: CrowdStrike Falcon contains a zero-day vulnerability (FalconFlank) enabling unprivileged attackers to escalate to SYSTEM privileges. Proof-of-concept code has been released publicly. Organizations running CrowdStrike Falcon should prioritize immediate patching or isolation of affected endpoints pending vendor mitigation guidance. DETAILS Vulnerability: FalconFlank zero-day in CrowdStrike Falcon allows local privilege escalation to SYSTEM level; specific CVE ID and affected version range not confirmed in available material. PoC Availability: A researcher has released working proof-of-concept code; unconfirmed attribution to group “Chaotic Eclipse” appears in secondary sources. Attack Surface: Local/unauthenticated privilege escalation; requires initial access to a system running vulnerable Falcon agent. Vendor Status: No official CrowdStrike patch or advisory statement confirmed in provided material; no remediation timeline available. Active Exploitation: No confirmed in-the-wild exploitation beyond PoC release; threat actor interest is inferred from PoC availability. IMPACT ...

Published Friday, September 04, 2026 at 10:59 AM PT BLUF: Google has released emergency patches for CVE-2026-85046, a high-severity type confusion vulnerability in Chrome’s V8 JavaScript engine (CVSS 8.8) that is actively being exploited in the wild and enables arbitrary code execution. Update Chrome immediately to the latest version; no workaround available. Users and enterprises with Chrome deployments are directly at risk. ...

Published Thursday, September 03, 2026 at 04:57 PM PT BLUF: Cisco has released patches for a critical remote code execution vulnerability affecting Nexus 9000 Series switches that allows unauthenticated attackers to execute commands as root. Immediate patch deployment required for all affected Nexus 9000 devices exposed to untrusted networks. DETAILS: Cisco Nexus 9000 Series switches contain a critical RCE flaw exploitable by unauthenticated remote attackers Successful exploitation grants root-level code execution on affected devices Patches have been released; specific CVE identifier and affected software versions not detailed in available materials No confirmed exploitation in the wild at publication, though related Cisco vulnerabilities (CVE-2026-20230, CVE-2026-20349, CVE-2026-20200) have seen active exploitation Cisco has concurrently patched multiple critical vulnerabilities in Crosswork, Secure Workload, SD-WAN, IOS XE, and FMC products, suggesting a broader advisory cycle IMPACT: ...

Published Thursday, September 03, 2026 at 04:56 PM PT BLUF: A prolific Microsoft 0-day researcher has published working exploit code for CrowdStrike Falcon, enabling privilege escalation attacks. Organizations running CrowdStrike Falcon on Windows systems face immediate risk of weaponized exploitation. Isolate endpoints from trusted networks, monitor EDR logs for abnormal privilege escalations, and contact CrowdStrike for patch/mitigation status immediately. DETAILS What: Public release of working proof-of-concept exploit code targeting CrowdStrike Falcon (endpoint detection and response platform widely deployed across enterprise). The exploit: Enables privilege escalation on affected systems, allowing low-privileged attackers to gain elevated code execution. Source: Attributed to a prolific researcher known for finding and disclosing Microsoft 0-days; historical pattern suggests technical credibility and functional PoC code. Related precedent: Same source / research community has previously released FalconFlank PoC (also Falcon privilege escalation) and multiple Windows zero-day exploits. Confidence level: Confirmed via The Register; technical details of exploit vector NOT fully detailed in available reporting. IMPACT Scope: Any organization running CrowdStrike Falcon on Windows endpoints. ...

Published Thursday, September 03, 2026 at 04:55 PM PT BLUF: Attackers are actively exploiting multiple zero-day vulnerabilities in SonicWall SMA 1000 remote access appliances, with confirmed attacks hitting dozens of customers. At least five distinct vulnerabilities have been leveraged since late 2025. SonicWall customers should immediately prioritize patching and review access logs for compromise indicators. DETAILS Active exploitation confirmed across multiple zero-day vulnerabilities in SonicWall SMA 1000 appliances; at least five distinct CVEs exploited since late 2025. Exploitation began weeks before vendor disclosure. ...

Published Thursday, September 03, 2026 at 10:54 AM PT BLUF: A Reddit post in r/exploitdev discusses planning a funded, full-time mobile vulnerability research lab and solicits advice on sustainability. No active exploit, vulnerability disclosure, or confirmed security incident present. This is a career/business planning discussion, not a breaking security event. Flagging for monitoring only due to mischaracterization. DETAILS Source: Reddit r/exploitdev subreddit post (thread title only; full post body truncated in provided material) Content: Author states they run a cybersecurity consulting company and are in planning stage for a mobile-first vulnerability research lab Query: Seeks advice on what keeps such labs operational and identifies common failure points Scope: Hypothetical business planning; no active research announced, no targets named, no vulnerability disclosures Confidence: LOW — only post title and opening sentence available; full context missing IMPACT None. This is not a security incident. It is a public business planning discussion in an open forum. No systems affected, no vulnerabilities exposed, no threat actor activity confirmed. ...

Published Thursday, September 03, 2026 at 10:53 AM PT BLUF: Two unpatched zero-day vulnerabilities (CVE-2026-83548 and CVE-2026-83549) in SonicWall Secure Mobile Access (SMA) 1000 series appliances are being actively exploited in the wild. SonicWall has released emergency patches. All organizations running affected SMA 1000 appliances must apply updates within 24 hours. DETAILS: CVE-2026-83548 and CVE-2026-83549 — Two distinct zero-day flaws in SonicWall SMA 1000 series appliances; both confirmed under active exploitation in production environments. Affected product and scope — Secure Mobile Access (SMA) 1000 Appliance Workplace and Appliance Management modules (full component surface area not yet detailed in available source). Threat confirmation — Active exploitation confirmed; not hypothetical or proof-of-concept only. Patch availability — SonicWall has released emergency security updates; patch links and version requirements available from SonicWall support portal (build/version specifics not included in this alert). IMPACT: ...

Published Thursday, September 03, 2026 at 04:52 AM PT BLUF: Food and Ag-ISAC has released a formal threat advisory warning of intensifying cyber risks driven by AI-powered attacks, ransomware operations, and nation-state actors targeting agricultural infrastructure. Food and agriculture organizations face elevated risk from AI-accelerated exploit development and nation-state reconnaissance. Immediate actions: review current defensive posture for SCADA/ICS systems, audit remote access logs, and enable threat monitoring for sector-specific indicators. ...

Published Wednesday, September 02, 2026 at 04:50 PM PT BLUF: SonicWall disclosed September 1 two zero-day vulnerabilities (CVE-2026-83549, CVE-2026-83548) in SMA1000 Secure Mobile Access appliances; both actively exploited in the wild. One permits remote authentication bypass; the second enables arbitrary code execution. Vendors have released patches. Organizations running SMA1000 must apply updates immediately. DETAILS Vulnerability 1 (CVE-2026-83549): Remote attack vector that bypasses authentication on SMA1000 appliances. Attackers can access protected resources without credentials. ...