12 stories · 3 sources · 2 critical · 4 high · ~13 min read

Coverage: Last 24 hours

Today’s Highlights

Attackers are ramping up the use of chained vulnerabilities, especially privilege escalation and remote code execution, to compromise enterprise infrastructure. The lead stories focus on the BlueMoon exploit kit targeting Chrome and Windows users with zero-days, and on the widespread exploitation of JFrog Artifactory via chained bugs for software supply chain compromise. Ongoing themes: rapid exploitation of network management platforms, large-scale vulnerability automation with AI, and persistent threats to both cloud and SaaS assets.

Table of Contents

1. BlueMoon exploit kit leveraging Windows and Chrome zero‑days in the wild
2. Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
3. China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
4. PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
5. Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
6. CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline

Critical   High   Medium   Low

Top Stories

BlueMoon exploit kit leveraging Windows and Chrome zero‑days in the wild

Source: BleepingComputer (Proofpoint primary research) | Published: Sep 10 | Risk: CRITICAL | Impacted: Windows desktop/laptop fleets, Organizations with high-value web/email users, Security teams defending against APT campaigns | Topics: Exploit Kit / Zero‑Day

What happened: BlueMoon exploit kit, observed since August 28, combines Windows kernel privilege escalation and Chromium sandbox‑escape zero‑days to deliver RCE in spear‑phishing campaigns by APT31 and UTA0560.

Why it matters: Active attacker exploitation of zero-days in both Windows and Chrome enables state actors to breach hardened environments through email or web-based spear-phishing, bypassing layered controls.

How it works: Exploit kits like BlueMoon automate delivery of chained browser and OS exploits, enabling attackers to gain code execution even in environments with up-to-date endpoint protection. The specific zero-days target Chrome’s sandbox and the Windows kernel privilege model.

Practitioner Perspective

The BlueMoon exploit kit ties together a Windows kernel privilege escalation with a Chrome sandbox escape to enable total system compromise via browser phishing campaigns, chiefly executed by APT31 and UTA0560. This level of offensive tooling signals a moving target for defenders relying solely on current patch states or browser isolation: assume recurring attacker adaptation. Threat hunting and browser/email isolation strategy need to incorporate regular review for exploit kit-level activity. OS/browser patch cadence can never lag active in-the-wild exploit cycles for users in targeted verticals.

Recommended Actions

• Push emergency updates for Chrome/Chromium browsers and Windows kernel components as they become available
• Deploy detections for exploit kit landing pages and user behavioral anomalies tied to BlueMoon IOCs
• Educate users in sensitive roles about high-quality spear-phishing and drive-by download risk
• Use browser isolation or remote session sandboxes for high-risk accounts

Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Source: The Hacker News | Published: Sep 11 | Risk: CRITICAL | Impacted: Self-hosted JFrog Artifactory admins, CI/CD infrastructure, Software supply chain, DevOps teams | Topics: Exploit / Vulnerability

What happened: Attackers exploited two vulnerabilities in JFrog Artifactory to gain administrative control and deploy backdoors on self-hosted servers. By chaining CVE-2026-42018 and CVE-2026-42016, they obtained admin tokens and installed malicious plugins, leading to unauthorized access and potential code execution.

Why it matters: A chain of flaws enabling admin access to self-hosted artifact repositories exposes build pipelines and software distribution to attacker persistence, potentially leading to widespread supply chain compromise.

How it works: JFrog Artifactory is a software artifact repository used for storing and distributing binaries in CI/CD pipelines. The vulnerabilities allow attackers to escalate from user to admin by chaining authentication bypass with token theft, enabling persistence and code execution on server infrastructure.

Affected / Fix: CVE-2026-42016 and CVE-2026-42018 affect self-hosted versions; patch now available per source.

Practitioner Perspective

Organizations running self-hosted JFrog Artifactory are in scope: attackers exploiting CVE-2026-42018 and CVE-2026-42016 can escalate from initial access to full control of software packaging and deployment. Successful compromise typically results in malicious plugins or backdoors that may persist across patch cycles or allow code injection into downstream developer workflows. Given the material role of artifact repositories, this is a high-priority risk for any CI/CD-dependent shop. Teams should treat all artifacts and plugin code as possibly affected after an incident. Detecting lateral movement or supply chain taint must be a central focus for incident response.

Recommended Actions

• Patch JFrog Artifactory instances for CVE-2026-42016 and CVE-2026-42018 immediately, validate plugin integrity and admin tokens
• Audit Artifactory plugin directories and configuration for signs of unauthorized changes or rogue plugins
• Revoke and reissue admin API tokens and credentials in Artifactory post-patch
• Hunt for unauthorized artifact uploads or modifications, especially recent admin actions
• Rebuild compromised Artifactory instances from known-good backups where tampering is suspected

Emerging Signals

China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

Source: The Hacker News | Published: Sep 11 | Risk: HIGH | Impacted: Chinese-language user endpoints, Organizational workstations in Asia, High-value business users, Enterprises using Sogou Input Method | Topics: Exploit / Vulnerability

What happened: The Hacker News article reports that the China-linked threat actor UNC3569 exploited a vulnerability in Tencent’s Sogou Input Method to deploy the GRAYRABBIT backdoor. This backdoor enables remote access and control over infected systems, facilitating espionage activities. The exploitation of this flaw underscores the ongoing security risks associated with widely used input method software.

Why it matters: A widely deployed input method application serving as an initial access vector enables persistent remote control of endpoints, providing attackers durable presence in user environments.

How it works: Sogou Input Method is a popular input software supporting Chinese character entry, used by hundreds of millions of users. The vulnerability enables code execution that installs malware such as the GRAYRABBIT backdoor, granting attackers persistent remote access.

Practitioner Perspective

UNC3569’s exploitation of a Tencent Sogou Input Method bug is an example of how core user applications in Asia can be leveraged for espionage beyond traditional malware vectors. Because input methods often run at high privilege and persist across user sessions, compromise enables stealthy collection and remote operations. Security teams supporting environments with Chinese-language users should consider Sogou Input Method as part of application risk and focus on post-exploitation detection as well as patch cadence. Underestimating the risk of “utility” applications is a recurring gap in endpoint security strategy.

Recommended Actions

• Identify and patch Tencent Sogou Input Method across Windows/Mac fleets
• Search for GRAYRABBIT backdoor indicators of compromise on affected endpoints
• Audit endpoint privilege levels granted to Sogou Input Method processes
• Hunt for unusual remote connections originating from Sogou-related processes

PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws

Source: The Hacker News | Published: Sep 11 | Risk: HIGH | Impacted: PaperCut NG/MF print servers, Networked printing environments, IT and print admin teams | Topics: Exploit / Vulnerability

What happened: PaperCut has released maintenance updates for versions 24.1.10, 25.0.13, and 26.0.5, replacing previous emergency patches. These updates address two actively exploited vulnerabilities, CVE-2026-81578 and CVE-2026-82078, which allowed attackers to bypass authentication and execute arbitrary code. Users are advised to apply these updates promptly for enhanced security.

Why it matters: Failure to implement updated remediation for actively exploited code execution flaws leaves core print management systems at risk for lateral attacker movement across campus or enterprise networks.

How it works: PaperCut is a print management solution controlling print jobs, quotas, and user authentication in enterprise networks. The bugs enable attackers to bypass authentication and achieve system-level code execution through crafted requests.

Affected / Fix: Patched in PaperCut versions 24.1.10, 25.0.13, and 26.0.5 per source.

Practitioner Perspective

PaperCut NG/MF servers are widely targeted by threat actors due to their network presence and weaknesses in legacy authentication. Attackers exploiting CVE-2026-81578 and CVE-2026-82078 achieve code execution, often using this for credential proxying or as a foothold for further compromise. If you relied solely on the initial emergency fixes, those are no longer sufficient: install the newest patched versions. Apply the fixes and audit for prior exploit attempts, as opportunistic actors have targeted these flaws in real environments.

Recommended Actions

• Deploy PaperCut maintenance updates for 24.1.10, 25.0.13, 26.0.5 to all servers
• Assess logs and recent admin actions for possible exploit or authentication bypass attempts (CVE-2026-81578, CVE-2026-82078)
• Isolate servers running legacy or unsupported PaperCut versions pending patching
• Hunt for persistence (e.g., rogue service accounts or scripts) established before remediation

Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

Source: The Hacker News | Published: Sep 11 | Risk: HIGH | Impacted: Cisco Secure FMC administrators, Network security teams, Organizations with exposed firewall management consoles | Topics: Exploit / Vulnerability

What happened: Cisco disclosed that two vulnerabilities in Secure Firewall Management Center (FMC) software were exploited by three threat groups. These groups used the flaws to deploy Qilin ransomware, steal credentials, and conduct extensive reconnaissance. Cisco recommends applying the latest hotfixes to mitigate these risks.

Why it matters: Attackers can convert control of network security management consoles into full network compromise, impacting detection, change workflows, and enabling ransomware deployment at scale.

How it works: Cisco Secure Firewall Management Center (FMC) manages policies and monitoring for firewalls. Vulnerabilities enabled attackers to gain admin access, dump credentials, and push ransomware via compromised management interfaces.

Practitioner Perspective

Compromise of Cisco Secure Firewall Management Center has proven appeal to ransomware operators like Qilin who exploit two Cisco vulnerabilities for credential theft and broad reconnaissance. Security owners of network security infrastructure need to treat the management plane with the same urgency as endpoint patching, since lateral movement from FMC impacts firewall policies and credentials. Treat hotfix installation as a time-critical activity, accompanied by after-action hunting for evidence of deeper compromise. Any delay further increases risk to managed network segments.

Recommended Actions

• Apply the most recent Cisco FMC hotfixes addressing the exploited vulnerabilities
• Audit for Qilin ransomware indicators and unusual admin actions in FMC change logs
• Rotate credentials and review authentication methods for all network devices managed by FMC
• Assess whether exfiltration or previously undetected adversary actions occurred prior to patching

CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline

Source: The Hacker News | Published: Sep 10 | Risk: HIGH | Impacted: Federal Civilian Executive Branch systems, Any org running Cisco, Citrix, or Fortinet products, Regulated critical infrastructure | Topics: Exploit / Vulnerability

What happened: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet, to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026. The vulnerabilities are listed below – CVE-2026-20079 (CVSS score: 10.0) – An authentication

Why it matters: Delayed patching of vulnerabilities already under active exploitation leads to predictable compromise of network segmentation devices, with direct regulatory repercussions for federal or critical infrastructure environments.

How it works: CISA’s Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities being exploited in the wild, often targeting authentication, management, or remote access in high-value infrastructure products.

Practitioner Perspective

CISA’s KEV update includes Cisco, Citrix, and Fortinet bugs with imminent deadlines for patching: while US Federal agencies must comply, private sector defenders are equally exposed. These flaws are already being used in the wild and affect core authentication or remote management paths. Delays in patch adoption will directly map to attacker success, so treat the guidance as more than compliance: prioritize execution based on observed exploitation. Consider running exploitation simulations on systems believed to be patched to confirm remediation effectiveness.

Recommended Actions

• Patch Cisco, Citrix, and Fortinet systems affected by the enumerated CVEs before the regulatory deadline
• Review KEV catalog entries for exact CVE impact/application scope and validate against internal asset inventory
• Run exploitation simulation and patch effectiveness testing on perimeter security appliances subject to KEV mandate
• Hunt for historical and current signs of exploitation on unpatched devices, especially remote management interfaces

Exploits & CVEs

(Stories covered in Top Stories and Emerging Signals)

Also Today

• ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories: This week’s roundup covers large-scale phishing, AI-enabled intrusions, the risk of unapproved AI apps, and a major e-commerce card skimming campaign.
• Google Play Early Access Abused to Push Thousands of Deceptive Android Apps: Fraud actors used Google Play Early Access and AI deepfakes to distribute deceptive apps before public review mechanisms kick in.
• Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE: Two VPN certificate validation flaws (CVSS 9.8) in Check Point firewall and management appliances have received critical patches, but exploitation conditions are not fully public.
• Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks: The Gigabud Android banking Trojan abuses work profiles to hide tampered apps from security checks, posing a risk to mobile transactions.
• PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances: A suspected Russian-speaking threat actor automated exploit attempts against PaperCut servers using hundreds of AI agents and mass scanning.
• Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion: Russian attackers targeted an AI vendor’s own systems to automate malware evasion and steal a pre-release Claude model.

Defensive Actions

• Patch JFrog Artifactory for CVE-2026-42016 and CVE-2026-42018 as well as PaperCut, Cisco FMC, Citrix, and Fortinet products for all disclosed and actively exploited CVEs; confirm completion via asset inventory and not just ticket closure.
• Audit plugin directories, configuration, and admin tokens for unauthorized changes following Artifactory patching.
• Revoke and reissue credentials or tokens that may have been compromised in vulnerable systems (Artifactory, PaperCut, Cisco FMC).
• Monitor for indicators of compromise specific to Qilin ransomware, GRAYRABBIT backdoor, BlueMoon exploit kit, and unauthorized PaperCut or Sogou Input Method activity.
• Limit use of Google Play Early Access and vet Android work profiles to reduce mobile malware exposure.
• Push emergency or vendor-recommended updates to Chrome/Chromium browsers and Windows kernel components, prioritizing users in targeted threat verticals.
• Conduct exploitation simulation and red team testing for perimeter and SaaS systems subject to recent zero-day disclosures.
• Enhance monitoring of internal and supply chain AI model access to detect signs of adversarial probing or theft.

What We’re Watching

• Ongoing weaponization and deployment of BlueMoon exploit kit zero-days against patched Windows and Chrome environments, especially in APT31/UTA0560 spear-phishing campaigns.
• Deadline (September 12) for patching Cisco, Citrix, and Fortinet KEV-listed vulnerabilities in U.S. Federal networks, with increased scanning and possible exploitation expected near term.
• Evidence of new Qilin ransomware variants or intrusion sets leveraging Cisco FMC and associated management plane vulnerabilities.
• Any sign of mass exploitation of JFrog Artifactory or PaperCut by automated AI agent infrastructure and shifts in attacker TTPs.
• Progress of threat actor automation following public discussion of AI abuse in malware evasion and model theft at Anthropic or other major AI vendors.

Found this briefing useful? Follow the blog to get the next one as soon as it is published, and pass it along to a colleague who owns patching.

Categories: Cybersecurity Blog, Cybersecurity News

Tags: AI, CI/CD, daily-digest, Exploit, mobile, Ransomware, vulnerability-management, Zero-Day