Google released the September 2026 security patches for Pixel devices addressing 110 vulnerabilities, including one zero-day flaw that was actively exploited in targeted attacks. The update mitigates this actively exploited vulnerability to protect affected devices.
AI is shrinking the time between vulnerability disclosure and exploitation, leaving defenders less time to wait for patches or public exploits. Picus Security explains how exploitability validation, security control testing, and autonomous pentesting can help teams close exposure gaps before attackers arrive. [...]
The BlueMoon exploit kit is a modular tool used by multiple cyber-espionage groups to chain zero-day vulnerabilities in Microsoft Windows and Google Chrome. It combines two Chromium-based browser flaws allowing remote code execution and sandbox escape with a Windows kernel local privilege escalation. Observed since August 2026, BlueMoon has been deployed by Chinese state-sponsored actors targeting NGOs, aerospace, defense, and manufacturing sectors. The kit exploits delays in Chrome stable releases to weaponize recent Chromium fixes. It executes payloads by elevating Chrome renderer privileges and injecting commands to download and run malware loaders.
ShieldCrash is a zero-day exploit targeting Microsoft Defender on fully patched Windows systems as of September 2026. It enables privilege escalation to full System privileges, allowing attackers to perform sensitive actions such as dumping the SAM database. This exploit bypasses previous patches for related vulnerabilities including ShieldBreak and RoguePlanet, indicating incomplete remediation by Microsoft. The underlying vulnerability is tracked as CVE-2026-69414. No official patch specifically addressing ShieldCrash has been confirmed at this time.
Google released Chrome 153, addressing 230 security vulnerabilities including the seventh zero-day of 2026. The zero-day, tracked as CVE-2026-87491, is a medium-severity out-of-bounds write flaw in the V8 JavaScript and WebAssembly engine, with known exploitation in the wild. The update also fixes five critical vulnerabilities and 41 high-severity issues affecting components like WebGL and Cast. Users are strongly advised to update to Chrome 153.0.8010.36/.37 on supported platforms promptly.
Google has patched a new zero-day vulnerability in Chrome that was actively exploited in attacks. This is the seventh Chrome zero-day patched by Google since the start of the year. The patch was released as part of a batch fixing 230 vulnerabilities. Specific technical details about the vulnerability and exploitation methods have not been disclosed.
Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including two zero-day flaws that are actively exploited. This update represents a significant security release covering a broad range of issues across Microsoft products.
A critical zero-day vulnerability (CVE-2026-86218) in N-able's N-central endpoint management platform allows unauthenticated remote code execution. The vulnerability has been exploited in the wild, prompting N-able to release an urgent hotfix (2026.3 HF4) for on-premises deployments. Cloud-hosted N-central environments have been patched server-side by the vendor. Administrators are advised to check for suspicious new user accounts and review logs for scanning activity from a specific IP range. No confirmed production exploitation has been reported, but unpatched systems remain at risk.
A zero-day vulnerability dubbed "StyleSmuggler" affecting all versions of Magento and Adobe Commerce is being exploited in attacks to deploy a backdoor. [...]
A security researcher known as Nightmare Eclipse has released proof-of-concept zero-day exploits targeting Avast, CrowdStrike, and Nvidia products. These exploits enable privilege escalation, allowing attackers to spawn shells with system-level privileges. The vulnerabilities affect Avast's sandbox, CrowdStrike Falcon Sensor's Office macro remediation feature, and an out-of-bounds memory write in Nvidia user-mode components. GenDigital (Avast) has patched the vulnerability, and CrowdStrike is investigating and advising mitigation steps. Nvidia has not yet publicly responded. The exploits demonstrate active research and disclosure but no confirmed active exploitation in the wild.
A zero-day vulnerability named StyleSmuggler in Adobe Commerce and Magento e-commerce platforms allows attackers to execute remote code and deploy a stealthy backdoor. The flaw affects Magento versions 2.4.7, 2.4.8, and 2.4.9, including installations with July and August 2026 patches. Attackers inject PHP code via Magento's template system using the 'styles' properties and trigger execution through failed payment email notifications without user interaction. The backdoor, written in Rust, disguises itself as system processes and communicates with a command-and-control server using covert channels. Adobe is expected to release a fix on September 8, 2026, but the exact patch addressing this zero-day is not yet confirmed.
A zero-day privilege escalation vulnerability named 'FalconFlank' affects CrowdStrike Falcon Sensor on up-to-date Windows 11 and Windows Server systems. The exploit abuses the Office malicious macros remediation feature in CrowdStrike Falcon to spawn a command prompt with SYSTEM privileges. CrowdStrike is investigating and advises disabling the Microsoft Office File Suspicious Macro Removal policy setting as a mitigation. The vulnerability has not yet been assigned a CVE ID or publicly patched. The exploit was released by a security researcher known as 'Nightmare Eclipse'.
Google has updated the Chrome browser to address an actively exploited high-severity zero-day flaw in the V8 engine and 11 other vulnerabilities. [...]
Google released Chrome 152 security updates addressing 12 vulnerabilities, including a high-severity type confusion zero-day in the V8 JavaScript and WebAssembly engine (CVE-2026-85046). This is the sixth Chrome zero-day patched in 2026. The flaw allows potential memory corruption that could lead to crashes or remote code execution. The update fixes this and other high-severity bugs across Windows, macOS, and Linux versions.
OpenAI's Astra model has achieved a 'Critical' cybersecurity capability level by independently finding and exploiting zero-day vulnerabilities across multiple well-defended systems. It demonstrated the ability to carry out complete cyberattacks from high-level instructions, including breaking out of browser sandboxes and gaining root access on hardened operating systems. Astra scored perfectly on ExploitBench and uncovered two zero-day vulnerabilities autonomously. The model also shows improved resistance to cyber-related jailbreak attempts and safety bypasses compared to its predecessor. OpenAI plans to restrict full access initially and implement additional safeguards before wider release.
PaperCut has released an emergency patch for a zero-day vulnerability actively exploited in the wild affecting its NG and MF print management solutions. The vulnerability allows unauthenticated attackers to gain remote control over PaperCut's trusted configuration and execute arbitrary Java code within the application process. PaperCut urges users to install the emergency patches and implement mitigations such as disconnecting the application server from the internet and restricting access to trusted IPs. Indicators of compromise include suspicious activity related to pc-app.exe and truncated or deleted server.log files, suggesting attackers may attempt to cover their tracks. The vulnerability has been assigned CVE identifiers CVE-2026-81578 and CVE-2026-82078. The investigation is ongoing, and the attacker identity remains unknown. Approximately 1,000 PaperCut instances remain exposed to the internet, primarily in North America and Europe.
PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. [...]
The security defect is described as an SQL injection that could allow attackers to achieve remote code execution. The post Hackers Exploiting Unpatched GeoServer Zero-Day appeared first on SecurityWeek .