8 stories · 3 sources · 2 critical · 4 high · ~12 min read
Coverage: Last 24 hours
Today’s Highlights
Attackers are moving fast to exploit critical vulnerabilities across major enterprise tech, with active campaigns targeting Chrome (V8 JavaScript engine), SAP Extended Passport Processing (CVE-2026-44756), F5 BIG-IP APM, and cPanel management platforms. Defenders face acute strain from patching requirements, especially after Microsoft’s release of nearly 1,000 security updates in a single day. The urgent need is for operational triage: focus remediation first on your most business-critical and internet-exposed controls, get ahead of attacker automation, and double-check defenses around recent high-profile patch bypasses and plugin flaws.
Table of Contents
- New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root
- Microsoft Plugs Nearly 1,000 Security Holes
- SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution
- F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
- Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
- Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC
Critical High Medium Low
Top Stories
New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root
Source: The Hacker News | Published: Sep 9 | Risk: CRITICAL | Impacted: Web hosting providers using cPanel/WHM, Shared server environments, Tenants on multi-customer cPanel infrastructure | Topics: Vulnerability / Ai
What happened: cPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user. cPanel published the advisory on September 8 and says every supported version of cPanel and WHM.
Why it matters: A hosting customer with mail privileges can hijack the entire cPanel-managed server, threatening the integrity of all tenant accounts and exposing sensitive hosted and customer data to complete compromise.
How it works: cPanel and WHM are widely-used web hosting management platforms. The flaw allows an authenticated account with mail privileges to exploit EmailTrack features and gain root-level code execution, breaking isolation between server tenants.
Affected / Fix: Every supported version of cPanel and WHM is affected; patched update released September 8.
Practitioner Perspective
Service providers, shared hosting operators, and web admins running cPanel and WHM need to act now. This bug lets an authenticated user escalate privileges to root, providing a trivial path for a malicious insider or compromised tenant account to take over the whole environment. In a shared context, the blast radius makes lateral movement, data exfiltration, and business service takedown trivial for attackers. Don’t defer applying the vendor patch; attackers will rapidly automate exploitation.
Recommended Actions
- Apply the latest cPanel and WHM update to close the EmailTrack privilege escalation vulnerability across all supported versions
- Audit tenant account activity for suspicious email privilege usage on cPanel servers
Microsoft Plugs Nearly 1,000 Security Holes
Source: Krebs on Security | Published: Sep 8 | Risk: HIGH | Impacted: Organizations operating Windows platforms, IT and security teams with large Microsoft application footprints, Mission-critical servers and endpoints | Topics: Breach / Fraud
What happened: Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and deploying.
Why it matters: The unprecedented volume of Microsoft vulnerabilities requiring remediation can overwhelm IT operations, leaving organizations exposed to opportunistic attackers who target unpatched systems during this window.
How it works: Microsoft released fixes for 974 security flaws across Windows, Office, SQL Server, and developer tools in its largest patch batch to date. Patching delays increase risk to both commodity and targeted attacks exploiting unpatched Microsoft software.
Practitioner Perspective
Defenders managing Microsoft environments need to triage aggressively and sequence patch deployment for internet-facing and business-critical systems first. The volume indicates that prioritization frameworks and automation capabilities are not just helpful, but necessary for modern patch management. Delays in deploying fixes for just a subset of these issues risk creating a backlog that threat actors will quickly exploit, leveraging zero-day and n-day vulnerabilities alike. The most essential action now is to ensure you have real-world asset inventories linked to business impact, so you can cut through the noise and actually reduce risk.
Recommended Actions
- Use vulnerability management tooling to prioritize and stage deployment of September 2026 Microsoft patches on Windows, Office, SQL, and Developer Tools
- Expedite patch deployment for any internet-facing Microsoft services, such as Exchange or RDP endpoints
Emerging Signals
SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution
Source: The Hacker News | Published: Sep 9 | Risk: CRITICAL | Impacted: Enterprises relying on SAP applications, IT teams managing SAP Extended Passport Processing, Finance, HR, logistics operations on SAP stacks | Topics: Vulnerability / Exploit
What happened: SAP has released security updates to address multiple vulnerabilities, including a maximum-severity flaw in SAP Extended Passport (EPP) Processing that could have a severe impact on the confidentiality, integrity, and availability of the application The vulnerability, tracked as CVE-2026-44756 (CVSS score: 10.0), has been described as a case of memory corruption. Discovered and reported by SAP.
Why it matters: A remote attacker can fully compromise SAP Extended Passport Processing systems with no authentication, creating a risk of total loss for organizations whose business operations depend on SAP for finance, logistics, or HR.
How it works: SAP Extended Passport Processing is a middleware kernel handling authentication and integration. The exposed flaw results from a memory corruption bug, allowing attackers to execute arbitrary code remotely without needing to authenticate.
Affected / Fix: CVE-2026-44756 affects SAP Extended Passport Processing; patched versions released, immediate update required.
Practitioner Perspective
SAP customers cannot afford to ignore CVE-2026-44756. This kernel-level flaw is remotely exploitable and carries maximum impact to confidentiality, integrity, and availability, so attackers get a foothold with no valid user required. Given SAP’s business-critical usage and typically complex patch cycles, any delay extends the window for high-impact enterprise breaches, ransomware, or fraud. Risk managers should treat this as a top business continuity threat and push for immediate remediation.
Recommended Actions
- Apply SAP’s update for CVE-2026-44756 to Extended Passport Processing components immediately
- Isolate externally exposed SAP endpoints until patching is confirmed
F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Source: The Hacker News | Published: Sep 9 | Risk: HIGH | Impacted: Enterprises using F5 BIG-IP Access Policy Manager, Organizations with unmanaged or legacy appliance patching, Critical authentication and SSO gateways | Topics: Vulnerability / Exploit
What happened: Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7. When Apache loads any of the three appliances’ own PHP scripts, the malware adds the web shell to the copy held in memory, so a check of.
Why it matters: Memory-resident PHP web shells on F5 BIG-IP APM appliances evade standard disk-based detection, enabling persistent attacker access to sensitive authentication infrastructure without triggering traditional file integrity monitoring.
How it works: F5 BIG-IP Access Policy Manager controls authentication and access policies for web applications and VPNs. Malware implants a PHP web shell into the active memory of Apache-handled scripts, circumventing defenses that check files on disk or traditional malware scanning.
Practitioner Perspective
This campaign highlights the danger of relying only on signature-based or disk integrity solutions for app-layer network devices. Attackers exploiting F5 BIG-IP APMs can persist entirely in memory, enabling stealthy command and control over critical access infrastructure. Without memory analysis and network anomaly monitoring, these intrusions can go undetected indefinitely. If your environment relies on F5 APM, especially exposed to the internet, you must treat these as high-value targets for threat hunting and active containment.
Recommended Actions
- Hunt for indicators of PHP web shell injection in F5 BIG-IP APM appliance memory
- Review recent Apache and F5 logs for anomalous hits to PHP endpoints
Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
Source: The Hacker News | Published: Sep 8 | Risk: HIGH | Impacted: Brazilian financial institutions, Crypto asset custody operators, IT teams managing instant payment platforms | Topics: Vulnerability / Exploit
What happened: A previously undocumented financially motivated threat actor has been linked to attacks targeting Brazilian financial institutions since at least March 2026. Cybersecurity company CrowdStrike is tracking the Brazil-based activity cluster under the name Slim Spider. “The adversary demonstrates deep operational knowledge of Brazilian financial infrastructure, including the instant payment.
Why it matters: Organized financial attackers with a deep understanding of local payment infrastructure are targeting digital asset custodians and banks, risking theft of high-value assets and major regulatory fallout.
How it works: The threat actor ‘Slim Spider’ targets Brazilian financial organizations, leveraging specialized knowledge of instant payment protocols and digital asset management platforms to infiltrate and steal sensitive custodial information.
Practitioner Perspective
Financial institutions in Brazil and similar markets face a sophisticated threat actor leveraging bespoke malware and knowledge of instant payment systems. Defending against these campaigns requires more than generic threat intelligence; defenders must factor in business process attack vectors and regional payment protocols. Monitor for anomalous access to custody systems, prioritize detection of lateral movement indicative of internal fraud or advanced persistent threats, and ensure rapid response playbooks are tested for crypto asset compromise scenarios.
Recommended Actions
- Deploy targeted threat hunting for Slim Spider IOCs in custody infrastructure logs
- Audit instant payment system integrations for suspicious activity and latent malware
Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC
Source: The Hacker News | Published: Sep 8 | Risk: HIGH | Impacted: Crypto exchanges using Liquid, Custody and wallet operators relying on sidechains, Users holding L-BTC or equivalent tokens | Topics: Vulnerability / Exploit
What happened: Whoever took nearly 4,000 bitcoin from the Liquid Network on Sunday, September 6, returned 3,400 of it the next day, Bitcoin’s public record shows. About 598.5 bitcoin has not come back. Liquid is a Bitcoin sidechain that holds real bitcoin to back a token called L-BTC. The network is still paused, so holders cannot turn that token back into bitcoin. The 3,400.
Why it matters: Sidechain trust models in blockchain ecosystems can break down under real attack, locking up assets and creating business and reputational crises for exchanges and their users.
How it works: Liquid is a federated Bitcoin sidechain leveraging the Elements protocol, where bitcoin is locked in custody to mint equivalent tokens. Exploits in custody or sidechain validation logic let attackers seize or freeze significant assets.
Practitioner Perspective
The theft and partial return of assets from the Liquid Network underscores operational risk in sidechains and custody arrangements. Attackers who compromise sidechain validation can seize and withhold large sums, pausing legitimate user transactions for days or longer. Incident playbooks for crypto exchanges must plan for incomplete recoveries, pressure from affected users, and the need for rapid technical remediation alongside public communications. Technical teams should review sidechain validation logic for similar flaws before they’re exploited elsewhere.
Recommended Actions
- Suspend turn-in and withdrawal features on affected Liquid Network assets until compromise is resolved
- Audit and patch Elements protocol implementations for security flaws enabling unauthorized asset movement
Exploits & CVEs
- Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox: Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds bug in V8, Chrome’s JavaScript and WebAssembly engine. “Out-of-bounds write in V8 in Google Chrome prior to.
- Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed: The security researcher known as Chaotic Eclipse has dropped a proof-of-concept (PoC) for yet another zero-day in Microsoft Defender. The vulnerability, codenamed ShieldCrash, is assessed to be a patch bypass for CVE-2026-69414 (CVSS score: 7.8), also called ShieldBreak, which the researcher reported last month. “Microsoft has failed to properly patch ShieldBreak CVE-2026-69414,” Chaotic.
- Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days: Microsoft on Tuesday broke Patch Tuesday records by addressing an earth-shattering 974 vulnerabilities spanning its software portfolio, including two flaws that it said have been actively exploited in the wild. These include 723 flaws in Windows, 111 in Office and Office 2016, 62 in SQL, and 22 in Developer Tools. Of these, over 110 shortcomings have been assigned a critical.
- N-able N-central Pre-Auth RCE Flaw Exploited in the Wild: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by September 11, 2026. The vulnerability in question is CVE-2026-86218 (CVSS score: 10.0), which has been described as a.
Also Today
- Wordfence Highlights Active Exploitation Attempts for Multiple Critical WordPress Plugin Flaws: Tenable reports active exploitation attempts for CVE‑2026‑32475 (Elementor Pro), CVE‑2026‑19490 (NetScaler), CVE‑2026‑81578 (PaperCut), and CVE‑2026‑9586 (Switchvox); emergency patches available.
- ChatGPT Flaw Let a Planted Prompt Send a Victim’s Gmail Data to Another Account: A prompt injection in ChatGPT could secretly exfiltrate data from linked Gmail accounts via a hidden prompt.
Defensive Actions
- Push Chrome updates that include the fix for CVE-2026-87491 to all managed endpoints immediately
- Apply the latest cPanel and WHM update to remediate authenticated root escalation
- Apply SAP’s update for CVE-2026-44756 to Extended Passport Processing
- Apply the vendor patch for CVE-2026-86218 on all N-able N-central installations
- Hunt for memory-resident PHP web shells in F5 BIG-IP APM devices
- Test Microsoft Defender using the public PoC bypass and implement compensating controls
- Expedite patch deployment for critical and internet-facing Microsoft assets in this cycle
What We’re Watching
- Surge of exploit attempts against Chrome V8 (CVE-2026-87491); confirm every endpoint is patched and monitored
- Rapid weaponization of cPanel/WHM privilege escalation across shared hosting providers
- Continued patch bypass research around Microsoft Defender’s ShieldBreak (CVE-2026-69414) and ShieldCrash exploits
- Deadlines for N-able N-central patching, CISA requires fixes by September 11, 2026
- SAP Extended Passport Processing (CVE-2026-44756) patch rollout success, given unauthenticated RCE risk
Found this briefing useful? Follow the blog to get the next one as soon as it is published, and pass it along to a colleague who owns patching.
Categories: Cybersecurity Blog, Cybersecurity News
Leave a Reply