Coverage: Last 72 hours

Today’s Highlights

Active exploitation and widespread vulnerability disclosure this week put defenders in a reactive stance. Unpatched remote code execution flaws across common enterprise platforms, coupled with advanced credential-harvesting malware and persistent supply chain breaches, demand rapid risk triage and targeted remediation. AI and automation are catalyzing both attacker agility and enterprise exposure, with evidence of misused agent systems and emerging ransomware tactics expanding across sectors.

Defensive Actions

• Apply Hotfix 4 to all on-premises N-able N-central servers below version 2026.3.1.14 and audit for unusual RMM activities.
• Deploy detection rules for JSCeal malware indicators in endpoint security solutions and review Google session token access for anomalies.
• Disable public SSH on MikroTik routers and update firmware to the latest release, hunting for unauthorized SSH key additions.
• Monitor endpoints for programs like ProManager, WinUpdate, and unauthorized disabling of Defender/Windows Update, with automated restoration controls.
• Deploy EDR/XDR threat hunts for DIREWOLF ransomware indicators, especially in critical infrastructure and cross-sector environments.
• Patch all enterprise software impacted by recently disclosed RCEs: HPE AOS-CX (CVE‑2026‑73749), Citrix NetScaler (CVE‑2026‑19490), Sangoma Switchvox (CVE‑2026‑9586), Elementor Pro (CVE‑2026‑32475), and Chrome (CVE‑2026‑85046).
• Immediately revoke and rotate credentials/secrets tied to JetBrains Cadence and unpatched TeamCity integrations, and audit AWS IAM activity.
• Notify Trezor customers impacted by ShipMonk breach of heightened phishing risk; collaborate with ShipMonk to audit data deletion guarantees.
• Restrict access to abandoned or legacy wikis, and review for unexpected OpenAI agent-like activity.
• Apply PaperCut patches for CVE-2026-81578 and CVE-2026-82078, and hunt for credential theft or RCE indicators in print server logs.

Table of Contents

1. N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
2. JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies
3. Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication
4. Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner
5. Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
6. Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
7. Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
8. Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers’ Data It Said Was Deleted
9. Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel
10. Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities

Top Stories

N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw

Source: The Hacker News | Risk: CRITICAL | Impacted: MSPs using N-able N-central on-premises, Organizations with delegated RMM access, IT services outsourcing environments

Summary: Every on-premises N-central build below 2026.3.1.14, including servers updated to Hotfix 3 a day earlier, needs Hotfix 4. N-able’s incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed. N-able has released its fourth hotfix in five weeks for the N-central remote monitoring and management (RMM) platform, this time for a

Why it matters: Unpatched RCE flaws in remote management tools create high-leverage entry points for attackers to compromise MSP environments, potentially exposing network-wide administrative access and customer systems.

Practitioner Perspective

Managed service providers and organizations running N-able N-central on-premises are facing sustained zero-day risk. Patch velocity alone has not curtailed exploitation attempts: each lagging hotfix cycle creates a widening window where attackers establish persistence or move laterally. Situational ambiguity around in-the-wild exploitation further complicates risk assessment, assume compromise if unpatched and review for malicious RMM activity. Prioritize N-central isolation and rapid hotfix deployment as this class of unauthenticated RCE is a prime vector for supply chain targeting. The real risk is not the individual flaw, but the recurring patch churn and detection gap for unusual remote access activity.

Recommended Actions – Apply Hotfix 4 to all N-able N-central servers below version 2026.3.1.14, including those patched with Hotfix 3 – Audit RMM administrative actions and review endpoint logs for unusual remote management activity from before hotfix deployment

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

Source: The Hacker News | Risk: HIGH | Impacted: Organizations using Google Workspace, Users logging in from unmanaged or BYOD devices, Email and cloud app environments relying on Google SSO

Summary: Cybersecurity researchers have unpacked JSCeal, a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-interception capabilities. “The payloads are protected with javascript-obfuscator, using multiple techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers,” Check Point Research said in a

Why it matters: Session cookie hijacking that bypasses MFA has immediate implications for account takeover, exposing sensitive data and allowing attackers to persist even when password resets and credential changes are enforced.

Practitioner Perspective

Organizations relying on Google Authentication are at heightened risk from JSCeal, which exfiltrates session cookies to bypass authentication controls. Credential harvesting alone is no longer the only concern; browser and endpoint telemetry must be reviewed for abnormal cookie access. Targeted surveillance and traffic interception capabilities mean confidential business email and applications are at risk even from well-secured endpoints. The sophistication of obfuscation in JSCeal’s payloads complicates traditional static detection. Defenders must expand hunting to anomalous session re-use and replay, not just credential sprays. The core takeaway: endpoint compromise can now nullify MFA assurances for Google accounts.

Recommended Actions – Deploy endpoint detection rules tuned for known JSCeal behaviors such as RC4-protected strings and V8 JavaScript process anomalies – Review recent Google session tokens for unexpected geographic or device mismatches indicative of cookie re-use

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

Source: The Hacker News | Risk: HIGH | Impacted: Organizations using MikroTik routers, ISPs managing customer CPE devices, Small businesses relying on default router configurations

Summary: Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska’s attack warning, published on September 5. Successful attacks date to at least September 2. The Hacker News’s September 6 review of the warning found no victim count or

Why it matters: Internet-exposed remote access (SSH) on network devices creates a single point of compromise, enabling attackers to hijack routing, eavesdrop, or pivot deeper into organizational networks.

Practitioner Perspective

Owners of MikroTik routers are likely exposed if SSH is open to the internet without strong authentication. Ongoing exploitation campaigns leveraging unauthenticated access can yield immediate network-wide impact, especially where routers are unpatched or poorly segmented. This risk typifies the persistent threat of default settings and unnecessary exposure in critical infrastructure gear. There is high potential for attackers to deploy proxy or tunneling malware, facilitating stealth persistence. Reducing router exposure is a necessary control, do not assume obscurity or low volume means safety.

Recommended Actions – Disable public-facing SSH access on MikroTik routers unless operationally essential, and restrict by IP if required – Update all MikroTik firmware to the latest available

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Source: The Hacker News | Risk: HIGH | Impacted: Organizations running Windows endpoints, Environments lacking EDR or centralized patching, Users with local administrator privileges

Summary: Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on an infected machine after the stealer deletes itself. One of them switches off Windows Update and Microsoft Defender before running a cryptocurrency miner. The company named the four programs ProManager, WinUpdate, SoftManager, and

Why it matters: Malware disabling endpoint protection and updates creates persistent risk windows, allowing commodity threats like crypto miners to evade detection and remediation.

Practitioner Perspective

Enterprises with insufficient control over endpoint security may see increased dwell time from malware like REVSTEALER. The documented programs demonstrate an intentional effort to disable both Microsoft Defender and Windows Update, neutralizing primary lines of defense. This technique is a growing trend seen in commodity stealers and ransomware loaders, serving as infrastructure for multiple follow-on attacks. Disabling updates not only raises malware risk, but allows attackers to exploit subsequent vulnerabilities left unpatched. The priority: tighten controls over endpoint management and escalate incidents where core protective services are unexpectedly disabled.

Recommended Actions – Monitor for processes named ProManager, WinUpdate, SoftManager, and MultiCare along with Defender and Windows Update service disruptions – Deploy EDR rules to alert on unauthorized disablement of security features linked to REVSTEALER modules

Emerging Signals

Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code

Source: The Hacker News | Risk: HIGH | Impacted: Workstations using VMware Workstation or Fusion, Lab and developer desktops with elevated VM privileges, IT environments using VMs for access isolation

Summary: Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution under certain conditions. The vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges can exploit to run arbitrary code. “A

Why it matters: Privileged VM escape exploits undermine host security in desktop and lab environments, enabling attackers to pivot from compromised VMs directly into administrator workstations or development hosts.

Practitioner Perspective

Enterprise and developer endpoints running VMware Workstation or Fusion should be treated as exposed if local attackers can gain elevated privilege. CVE-2026-59346 presents a direct host compromise risk, particularly in environments with internet-facing VMs or regular imports of third-party VM images. Desk-based VM escape, especially with a CVSS over 9, is a perennial target for red team and malware operators alike. The window between patch release and update adoption defines exposure, prioritize patching on all non-hardened and heavily used endpoints.

Recommended Actions – Apply Broadcom security updates addressing CVE-2026-59346 to all VMware Workstation and Fusion installations – Restrict installation and execution of VMs from untrusted sources

Exploits & CVEs

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Source: The Hacker News | Risk: CRITICAL | Impacted: Retailers on Magento or Adobe Commerce, Managed e-commerce hosting providers, Third-party developers with code deployment access

Summary: Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store’s server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5. Sansec, which discovered the flaw and named it StyleSmuggler, said attacks started on September 4. “Sansec is

Why it matters: Active exploitation of unpatched e-commerce platforms allows attackers to plant web shells or skimmers, threatening payment data and business reputation due to potential PCI violations and customer fraud.

Practitioner Perspective

Magento Open Source and Adobe Commerce operators are now clear targets, as attackers exploit the StyleSmuggler vulnerability for unauthenticated code execution. This zero-day risk is especially acute for stores lagging in patch hygiene or lacking web application firewalls. The rapid pivot from discovery to exploitation illustrates attackers’ ability to automate large-scale e-commerce compromise, putting all customer transaction data at risk. This is a cardinal example of the need for defense-in-depth: patch, monitor web shell artifacts, and validate alerting for unauthorized admin actions. Assume breach on unpatched systems since September 4.

Recommended Actions – Deploy any interim mitigation recommended by Sansec for the StyleSmuggler vulnerability on Magento and Adobe Commerce – Hunt for web shell and malicious code artifacts on affected store servers since September 4

Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities

Source: The Hacker News | Risk: CRITICAL | Impacted: Educational institutions running PaperCut, IT-managed print server operators, Multi-tenant school/university environments

Summary: Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe. The Arctic Wolf Adversary Research Team said it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 – an authentication bypass and remote code execution chain – to conduct command execution and reconnaissance, as well as

Why it matters: Credential theft via active exploitation of print management platforms can pivot into domain compromise, especially in academic and multi-tenant settings with broad user privileges.

Practitioner Perspective

PaperCut vulnerabilities CVE-2026-81578 and CVE-2026-82078 are being actively weaponized for command execution and credential theft in schools and universities. These environments often lack least privilege architecture and can be slow to update due to academic IT constraints, making them ideal targets for lateral movement. Attackers exploiting combinations of authentication bypass and remote code execution can escalate from print server to domain controller or directory service. This pathway highlights the risk of legacy infrastructure in highly interconnected educational networks, speed of patching is critical.

Recommended Actions – Apply patches for CVE-2026-81578 and CVE-2026-82078 on all PaperCut servers, prioritizing campus and academic environments – Hunt for command execution and credential theft indicators in PaperCut logs and adjacent directory services

What We’re Watching

• Monitor for new exploitation chains targeting HPE AOS-CX (CVE-2026-73749), Citrix NetScaler ADC (CVE-2026-19490), Sangoma Switchvox (CVE-2026-9586), Elementor Pro (CVE-2026-32475), and Google Chrome (CVE-2026-85046), all under active attack.
• Watch for additional ransomware activity linked to DIREWOLF, particularly cross-sector and critical infrastructure incidents.
• Track emerging session hijacking malware strains in Google authentication environments, with a focus on JSCeal-like techniques.
• Investigate any unauthorized mass posting or activity from OpenAI autonomous agents on legacy, unmonitored web platforms.
• Pay close attention to potential follow-on activity connected to exposed AWS credentials following the JetBrains Cadence and TeamCity breach.

Categories: Cybersecurity Blog

Tags: AI Security, Cloud Security, Credential Theft, cybersecurity, endpoint protection, Ransomware, remote code execution, Vulnerabilities