Coverage: Last 24 hours

Today’s Highlights

Active exploitation of critical infrastructure and web application vulnerabilities defines today’s operational priorities for defenders. Both perimeter systems and supply chain SaaS dependencies are being targeted for initial access and persistent compromise. Key threats include rapid mass attacks against WordPress plugins, critical RCE vulnerabilities affecting core network and management infrastructure, and the expanding role of commercial malware access brokers. Practitioners must move quickly to patch, hunt for compromise, and adapt detection logic to evolving attacker tradecraft, especially as AI-enabled tools and social engineering tactics continue to accelerate compromise paths.

Defensive Actions

• Patch CVE-2026-20212 on all Silicon One-based Cisco Nexus 9000 switches immediately
• Apply Elementor Pro and Super Forms updates promptly and hunt for indicators of compromise, such as webshells and unusual uploads in plugin directories
• Patch FreeIPMI installations to version 1.6.19 or later and restrict BMC management network access
• Accelerate organization-wide updates of Google Chrome to version 152.0.7977.82
• Update Plex Media Server and Plex Desktop to the latest available versions, monitoring for unusual activity post-update
• Review SaaS OAuth grant events for abuse and enable alerting on new OAuth consents, especially after hours
• Monitor for suspicious node.exe invocations and restrict developer tools on endpoints where not required
• Isolate and reimage systems compromised by advanced malware toolkits such as BraZetsu, and perform credential resets as part of remediation
• Enforce strict application controls to block unauthorized remote monitoring and management (RMM) tools
• Coordinate with vendors for breach details where SaaS court or legal data may have been exposed, and increase monitoring of privileged access

Table of Contents

1. Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
2. Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day
3. GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests
4. Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws
5. ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories
6. Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root
7. BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory
8. Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data
9. Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
10. FreeIPMI critical buffer overflow (CVE‑2026‑85509) disclosed today

Top Stories

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Source: The Hacker News | Risk: HIGH | Impacted: WordPress hosts using Super Forms, Sites running Elementor Pro, Managed WP hosting providers

Summary: Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are – CVE-2026-14894 (CVSS score: 9.8) – A missing file type validation vulnerability in Super Forms – Drag & Drop Form Builder that allows unauthenticated attackers to upload files of any type, including

Why it matters: Sites running unpatched Super Forms or Elementor Pro are vulnerable to full site takeover by unauthenticated threat actors, which undermines business integrity and exposes sensitive data or customer interactions to manipulation.

Practitioner Perspective

Organizations leveraging WordPress at scale face a real risk of automated mass exploitation, especially as hundreds of thousands of exploit attempts have already been observed. These plugin flaws, CVE-2026-14894 in Super Forms and a critical RCE in Elementor Pro, allow attackers to upload arbitrary files or webshells without credentials. This aligns with recent attacker preferences for rapid takeover of public-facing web assets to support phishing, skimming, or supply chain attacks. If your WordPress fleet is not centrally managed and quickly patchable, assume compromise and proactively threat hunt. The velocity of exploitation here makes lagging patch adoption unacceptable.

Recommended Actions

• Deploy immediate patches for CVE-2026-14894 on all instances of Super Forms
• Apply latest Elementor Pro update to eliminate webshell RCE vectors

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

Source: The Hacker News | Risk: HIGH | Impacted: Enterprises using Windows, macOS, or Linux Chrome, VDI fleets and kiosk systems running Chrome, High-exposure knowledge workers

Summary: Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 (CVSS score: 8.8), has been described as a type confusion bug in V8, Chrome’s JavaScript and WebAssembly engine. “Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote

Why it matters: Any system using Chrome and exposed to active browsing risk is susceptible to remote code execution via exploitation of the V8 engine, permitting direct attacker payload delivery and session hijack.

Practitioner Perspective

A high-severity, actively exploited type confusion bug in Chrome’s V8 JavaScript engine (CVE-2026-85046) presents immediate risk for organizations with managed Chrome deployments, particularly in high-risk user populations. Given Chrome’s scale and the sophistication of in-the-wild zero-day exploitation, selective patching is inadequate, full fleet updates must be prioritized. Unpatched browsers give adversaries footholds for credential theft, endpoint malware installation, and lateral movement. Endpoint visibility is critical given potential for cross-platform, multi-stage web attack chains.

Recommended Actions

• Roll out Chrome update 152.0.7977.82 to all managed desktops and virtual environments
• Verify Chrome version post-update using enterprise device management tools

Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

Source: The Hacker News | Risk: CRITICAL | Impacted: Networks running Nexus 9000 switches, Environments with IOS XR-based network segments, Critical infrastructure operators

Summary: Cisco has released patches to address a critical security flaw affecting 10 Silicon One-based Nexus 9000 switches that could allow an unauthenticated, remote attacker to execute code as root, alongside an IOS XR hardening release bundling 7 umbrella CVEs, 2 of which are rated 9.8, with no workaround for any IOS XR version. The Nexus vulnerability, tracked as CVE-2026-20212 (CVSS

Why it matters: Critical RCE bugs on Silicon One-based Nexus 9000 switches and bundled IOS XR flaws heighten the risk of direct infrastructure takeover and lateral movement within data center or enterprise environments.

Practitioner Perspective

Exploitable root access on Nexus 9000 gear is an immediate operational concern, especially given the lack of workarounds and potential for automation in exploitation tools. Threat actors look for infrastructure-level RCEs to achieve persistence, sniff traffic, or pivot deeper into high-value networks. Relying on out-of-band management as the only control is risky, as attackers may escalate rapidly before containment. If patch windows cannot be closed at once, strict segmentation and live monitoring become mandatory. Treat these as critical-site risks requiring executive-level visibility.

Recommended Actions

• Apply Cisco patch for CVE-2026-20212 to Silicon One-based Nexus 9000 switches
• Review IOS XR patch bundles and deploy within maintenance windows, no workarounds available

Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws

Source: The Hacker News | Risk: MEDIUM | Impacted: Self-hosted Plex Media Servers, Users of Plex Desktop clients, Organizations with BYOD or personal media servers on the corporate LAN

Summary: Plex is urging users to update their instances to the latest version following the release of an update that patches multiple security flaws. The fixes are available in Plex Media Server 1.43.3 and Plex Desktop 1.115.0. The streaming media service did not elaborate on what those issues are, but said CVE identifiers have been requested for them. “We recommend all

Why it matters: Unpatched Plex servers and desktop clients with unannounced vulnerabilities may be highly attractive for lateral movement and persistence, particularly for adversaries targeting media, entertainment, or home network environments.

Practitioner Perspective

The absence of technical details from Plex raises concern for defenders, since attackers frequently reverse-engineer patches to develop exploits for high-userbase targets. Plex Media Server is commonly internet-exposed and often integrated with wider file or identity services. Assume window for opportunistic scanning and exploit development has already opened. Treat Plex systems as potential entry points for further compromise until validated patched. Prioritize patch testing and deployment, and monitor for unusual traffic or process behavior following any upgrade.

Recommended Actions

• Update Plex Media Server to version 1.43.3 across all internet-exposed and corporate-attached hosts
• Patch Plex Desktop clients to 1.115.0 on managed endpoints

Emerging Signals

ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories

Source: The Hacker News | Risk: MEDIUM | Impacted: Corporate SaaS tenants, Dropbox and OAuth-integrated platforms, Organizations relying on identity federation

Summary: The worst part is how normal these attacks look. A call from IT. A shared file. A trusted app. A simple request to click “Allow.” Why break in when someone might open the door? That idea runs through this edition. Attackers use real tools, fake login pages, old account links, and software guides that point to unsafe downloads. One wrong

Why it matters: Attackers leveraging lookalike IT communications, OAuth abuse, and real software documentation can bypass standard user awareness controls, increasing the likelihood of compromise and credential theft from routine workflow activity.

Practitioner Perspective

Security teams must adapt to attackers leveraging legitimate-seeming touchpoints and widely trusted SaaS tools to induce risky behaviors such as OAuth consent. These techniques erode the value of conventional phishing training by mimicking normal IT actions and exploiting user trust. Expect increased focus on identity, SaaS platform monitoring, and more granular analysis of cloud access logs. Assume that some users will be tricked, the control focus must shift to rapidly detecting anomalous OAuth consents and account linkage.

Recommended Actions

• Audit historical OAuth grant events for Dropbox and other high-value SaaS accounts
• Implement conditional access for OAuth token issuance to third-party apps

BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory

Source: The Hacker News | Risk: HIGH | Impacted: Windows endpoints in enterprise environments, Organizations with unmanaged remote workers, Firms with privileged access reuse

Summary: Cybersecurity researchers have disclosed details of a sophisticated Python-based Windows malware framework called BraZetsu that fuels an underground marketplace commercializing access to compromised hosts. “Unlike the standard infostealer model, BraZetsu is a comprehensive master toolkit that empowers Initial Access Brokers (IABs) by turning compromised systems into highly valuable commercial

Why it matters: Infection by comprehensive frameworks such as BraZetsu elevates compromised endpoints to discoverable commodities for cybercriminals, increasing the risk of widespread data theft and follow-on attacks across the supply chain.

Practitioner Perspective

The emergence of malware like BraZetsu indicates a maturing supply chain for initial access, where infected Windows hosts are packaged for resale and further exploitation. Unlike generic info stealers, BraZetsu enables attackers to weaponize victims more efficiently and persistently, heightening the risk for organizations that cannot quickly detect endpoint compromise. Investigation must go beyond removal, understand what data or credentials may already have been sold or leveraged. Assume lateral movement if BraZetsu infections are discovered on critical assets.

Recommended Actions

• Hunt for unexpected Python processes and anomalous remote connections on Windows devices
• Review EDR telemetry for BraZetsu behaviors, unusual host enumeration and persistence mechanisms

Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data

Source: The Hacker News | Risk: HIGH | Impacted: Court systems using C-Track, Legal offices integrated with West Publishing, Jurisdictions with dependency on third-party case management SaaS

Summary: Thomson Reuters disclosed on Wednesday that an unauthorized party obtained files from C-Track, the court case management platform sold by its West Publishing Corporation unit, in March 2026, affecting courts in 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. West Publishing said it discovered the activity on June 30, 2026. A subset of court records could contain individuals’

Why it matters: A breach of court management systems containing sensitive personally identifiable information (PII) and sealed records may create long-lasting privacy, legal, and public trust consequences for affected jurisdictions.

Practitioner Perspective

The compromise of Thomson Reuters C-Track highlights the heightened stakes for third-party SaaS platforms holding regulated or confidential judicial data. Discovery months after initial access demonstrates the challenge in identifying SaaS abuse and the criticality of robust vendor risk management. Organizations with similar workflows must assume exposed data could be leveraged for targeting, identity fraud, or further compromise. Enable detection and response controls around privileged SaaS access, not just direct system compromise.

Recommended Actions

• Coordinate with Thomson Reuters for breach and notification details affecting C-Track tenants
• Review SSO and SaaS integration logs for anomalous user or API access between March and June 2026

Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks

Source: The Hacker News | Risk: MEDIUM | Impacted: Organizations with Node.js on endpoints or servers, Government and technology sector networks, Environments with developer tool access

Summary: Threat actors are leveraging the trusted Node.js JavaScript runtime in multiple cyber attacks as a way to deploy malicious payloads. According to a new report published by the Symantec Threat Hunter Team today, the attack method has been put to use in attacks targeting government departments, technology companies, and hotels since February 2026. “The technique’s appeal is that node.exe (the

Why it matters: Abuse of Node.js runtime in targeted malware attacks undermines application whitelisting and can lead to stealthy payload execution in environments where Node.js is trusted or widely used.

Practitioner Perspective

Symantec’s report underscores that trusted developer runtimes are now a go-to mechanism for attackers, who use node.exe as a living-off-the-land binary to evade controls. Targets include government, technology, and hospitality sectors, often those with permissive developer tooling on endpoints or servers. Standard software inventory or application control may not flag malicious use of node.exe, highlighting the need for carefully scoped baselining and process monitoring. Defenders must not assume that trusted runtimes are immune to abuse, build detection logic around anomalous process behavior rather than binary presence alone.

Recommended Actions

• Monitor for suspicious invocation of node.exe outside scheduled job or developer contexts
• Alert on Node.js processes exhibiting network connections to untrusted domains

Exploits & CVEs

GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests

Source: The Hacker News | Risk: MEDIUM | Impacted: Organizations leveraging public or private LLMs, Vendors exposing AI developer APIs, Security teams using AI for triage or code review

Summary: OpenAI on Thursday officially unveiled GPT‑6 Astra, which it described as the “world’s most intelligent and aligned model.” The development comes days after the artificial intelligence (AI) company said the model had reached the “Critical” cybersecurity capability threshold under its Preparedness Framework. “Astra is state-of-the-art on computer use, browsing, software engineering,

Why it matters: AI models reaching a high bar for exploit generation or cybersecurity understanding, even with PoC controls, increase the risk of model abuse or high-impact automation if operational security is not tightly maintained.

Practitioner Perspective

The public revelation that GPT-6 Astra meets ‘critical’ capability thresholds for software engineering and computer system understanding signals a new baseline for AI-enabled attacker methods. While OpenAI has blocked PoC exploit requests in current versions, history suggests that operational controls often lag behind adversary creativity, including prompt engineering and API misuse. If your organization is developing or exposing AI interfaces, treat prompt abuse and attack surface modeling as core security disciplines. Watch for signs of AI-assisted vulnerability discovery or exploit scripting in your own telemetry.

Recommended Actions

• Review placement of GPT-6 Astra and comparable LLM APIs exposed to internal or third-party use
• Test AI system guardrails to ensure PoC generation requests are reliably blocked

FreeIPMI critical buffer overflow (CVE‑2026‑85509) disclosed today

Source: CVETodo | Risk: CRITICAL | Impacted: Data centers with FreeIPMI-managed BMCs, Server hardware operators, IT teams with legacy FreeIPMI installations

Summary: A stack-based buffer overflow in FreeIPMI (before 1.6.19) with CVSS 9.8 was published today; it allows unauthenticated remote code execution via BMC FRU data reads.

Why it matters: Unpatched FreeIPMI installations on exposed BMC interfaces enable unauthenticated attackers to achieve remote code execution on critical server hardware, threatening the integrity of infrastructure management systems.

Practitioner Perspective

CVE-2026-85509 is an infrastructure-level RCE bug affecting FreeIPMI prior to 1.6.19, with particular impact for any data center where BMC interfaces remain internet- or production-LAN-exposed. Since BMCs often lack full endpoint protection and can override OS-level controls, compromise permits deep persistence and potential tampering with all connected servers. Do not delay, assume public exploitation scripts will emerge quickly. If patching is not possible, network isolation must be enforced as a top priority.

Recommended Actions

• Patch FreeIPMI to version 1.6.19 or later on all BMC-accessible systems
• Immediately restrict network access to BMC management ports to designated admin subnets

What We’re Watching

• Monitor for new exploit activity against CVE-2026-20212 (Cisco Nexus 9000) and CVE-2026-85509 (FreeIPMI) across data center environments
• Track for Elementor Pro zero-day exploitation attempts, especially on unpatched WordPress instances
• Assess for reports of Chrome CVE-2026-85046 exploitation within enterprise or sensitive user segments
• Observe threat actor innovation in abusing trusted runtimes like Node.js for stealth persistence
• Watch for developments and possible bypasses for AI PoC exploit-blocking within the GPT-6 Astra and comparable LLM landscapes

Categories: Artificial Intelligence, Cybersecurity Blog

Tags: ai-security, cybersecurity, infrastructure, Malware, Phishing, Vulnerability, WordPress, Zero-Day