Comparing 16 September 2026 with the previous day 15 September 2026.
The FortiGate flaw CVE-2025-25249 is actively exploited to deliver the Node.js RAT PivotC2 with interactive shells, tunneling and network scanning , exposed perimeter devices remain the primary initial-access vector.
The flaw is already being actively exploited in the wild and was added to CISA's KEV catalog on September 9, 2026, which goes beyond a mere patch reminder and signals a real threat via crafted web pages.
The vulnerability allows unauthenticated remote code execution with root privileges via a malicious IODD file and persists across reboots.
The BSI reports an active campaign against German institutions, indicating a targeted threat to the DACH region.
Russian state-sponsored hackers are using AI (Claude) to rebuild malware after detection and evade discovery, representing a new TTP for AI-assisted cyber espionage.
Four espionage groups sharing the same exploit kit within a week points to an industrialized, pooled attack infrastructure behind state-backed industrial espionage.
The EU Commission is calling for a joint defence against cyberattacks and sabotage, pointing to recent incidents in Denmark, Lithuania and Poland as well as a drone incident in Leipzig , a signal for a coordinated European response to hybrid threats.
Several Western government agencies for the first time publish a joint technical analysis of an Iranian surveillance malware and confirm the abuse of Telegram as a C&C channel , a signal of the reach of state-sponsored espionage toolkits.
The report shows that generative AI models such as Claude are increasingly used as attack tools for automated exploitation, data theft, and state operations,a strategic risk that goes beyond classic patch information.
The two newly documented implants, Ted and curlRAT, show that North Korean APTs use exposed network components such as HAProxy as an injection point and increasingly target the automotive and supplier industry , a pattern that also matters for European production environments.
The detailed analysis shows that a single crafted HTTP/1.x request over TLS is enough to trigger a memory access fault in the HTTP.sys kernel context , up to code execution with kernel privileges.
Although the flaw requires user interaction, opening a crafted DCM file allows code execution in the context of the Photoshop process , relevant for any workstation that opens third-party files from customer or supplier projects.
The flaw sits in Photoshop's DCM JPEG-LS parsing component, showing that image-parsing libraries in the Creative Cloud toolchain remain an attack surface via crafted files.
The flaw resides in the Reader's annotation handling and requires user interaction; the advisory provides no evidence of active exploitation in the wild.
The flaw lies in the handling of Doc objects and requires active user action (opening a file or visiting a web page); so far there is no evidence of exploitation in the wild or KEV listing.
The vulnerability requires user interaction, which complicates opportunistic attacks but enables targeted attacks on Adobe Reader users.
The use-after-free flaw in Adobe Acrobat Reader DC's annotation processing allows attackers to execute code by merely opening a malicious file.
This is a use-after-free flaw in Acrobat Reader DC's annotation handling, known only from a ZDI advisory, with no in-the-wild exploitation or public exploit reported so far.
The flaw resides in annotation handling and requires user interaction (malicious PDF or web page); no exploit or active exploitation is documented.
This is a pure ZDI advisory with no indication of active exploitation or KEV listing; patch status remains the decisive factor.
This is a coordinated ZDI disclosure with no indication of active exploitation; the key point is timely patch verification, since exploitation requires a user to interact with a crafted PDF file.
Beyond patch information, the report shows that the official fix for CVE-2026-69414 is incomplete and that arbitrary file read with SYSTEM privileges remains possible under specific conditions.
The technical analysis provides a detailed walkthrough of exploiting CVE-2026-63520, including an XML payload via SharePoint's Business Data Catalog feature, underscoring its practical exploitability.
The vulnerability is limited to information disclosure and requires user interaction; with a CVSS of 3.3, patch management priority is low.
The vulnerability is only of low severity (CVSS 3.3) and requires user interaction, which limits the risk for the end user.
The BSI advisory does not specify any CVE IDs, which complicates assessment of exploitability and prioritization.
The report describes an active, targeted campaign that spreads new MISTPEN malware via fake job offers and exploits a zero-day in Microsoft's AFD.sys driver for privilege escalation.
Although the vulnerability requires user interaction, the high CVSS score of 7.6 underlines the need for timely patching.
ZDI-26-609 describes a use-after-free flaw in the Linux kernel network scheduler, for which no CVE and no indications of active exploitation are currently available.
Unlike patch advisories, this report describes an active vishing operation against Microsoft Teams that aims at session takeover, malware propagation, and infrastructure compromise.
The attack does not start with an email but with an external Teams chat or call from a separate tenant posing as the helpdesk, negotiating interactive remote access.
The campaign marks the shift from ClickFix to TerminalFix: attackers route victims to Windows Terminal instead of the Run dialog so that multi-line scripts and reverse-tunnel payloads execute reliably.
The report shows attackers using Microsoft Teams as a direct social-engineering channel to talk employees into handing over credentials and MFA codes by phone , a path that bypasses classic email filtering.
The attack begins with passkey-themed social engineering and then establishes durable persistence in the cloud identity via attacker-registered MFA methods that survives password changes.
The BSI advisory does not provide CVE IDs or exploitation details, so the actual urgency can only be derived from Ubiquiti advisories.
The V8 type confusion flaw is already being actively exploited and is therefore not merely a theoretical patching matter.
The report describes a new attack path: voice phishing against personal BYOD devices as the entry point, followed by large-scale data exfiltration via the Microsoft Graph API that bypasses classic endpoint controls.
The report describes an active banking malware campaign that bypasses browser protection mechanisms via the KREMLIN toolkit to install malicious Chrome and Edge extensions and steal credentials and session tokens.
The BSI advisory describes a use-after-free vulnerability in Office/Excel without a CVE reference and without indication of active exploitation.
Of the 973 patched vulnerabilities, two are already actively exploited, including one in the Windows Update Stack and one in Windows ALPC.
Microsoft's largest Patch Tuesday to date includes two already actively exploited zero-days, both local privilege escalations , one via an AppContainer sandbox escape , allowing an attacker with existing access to gain SYSTEM privileges.
A publicly released zero-day patch bypass in the Malware Protection Engine shows that Defender protection cannot be guaranteed by patch cycles alone and may require compensating controls.
Four different espionage groups used the same Chrome/Windows exploit chain within days of each other, showing that once a flaw becomes public it is exploited almost simultaneously by multiple state-linked actors.
Chrome 153.0.8010.36/.37 fixes five critical flaws , mostly in WebGL , alongside one actively exploited vulnerability, so the update should be applied promptly.
The new Shieldcrash exploit shows that Microsoft's fix for the Shieldbreak flaw, billed as a 'high-quality update', apparently does not fully close the underlying attack vector in Defender.
A new zero-day named 'ShieldBreak' bypasses the RoguePlanet fix in Microsoft Defender's malware protection engine that was patched in July , a direct patch bypass showing that previously closed gaps in endpoint protection can be neutralized again.
The OAuth device code grant is a central building block of modern token attacks (device code phishing); an unauthenticated information disclosure in this flow is therefore more than a pure patching matter.
The report describes an active malware campaign targeting Chrome users that can be triggered by a single click.
The report highlights the record scope and ongoing attacks but provides no specific CVE or attack details, serving mainly as a patch reminder with an urgency appeal.
The BSI WID aggregates multiple vulnerabilities across three distinct Windows components without listing CVE IDs or exploitation status , concrete exposure must be verified per system against Microsoft patch details.
The report shows that an evasion technique from AI prompt-injection research is now appearing in classic phishing campaigns, thereby defeating pure signature and keyword filtering.
The BSI warning lists multiple Linux kernel vulnerabilities without specific CVE IDs or exploitation details, making prioritization difficult for administrators.
The advisory does not specify any CVEs, which complicates the assessment of criticality and patch prioritization.
The advisory does not provide CVE IDs or exploitation details; it is a general patch notice for Google Chrome.
The item cites neither CVE IDs nor evidence of active exploitation, so it adds little beyond basic patch information.
The report summarizes several different vulnerability types in Lightroom Classic without providing CVE IDs or evidence of active exploitation.
No changes in this category.
No changes in this category.
China's spy chief warns of US AI models as accelerators for cyberattacks and vulnerability discovery, raising the threat from state actors.
The report confirms that the critical VMware vCenter vulnerability is already actively exploited by ransomware gangs, which goes beyond a mere patch warning.
The report provides no insights beyond patch information, as neither active exploitation nor attacker TTPs are mentioned.
The report contains no indication of active exploitation, exploit code, or strategic context and therefore does not go beyond pure patch information.
This report contains no information beyond the patch details; there is no evidence of active exploitation or a public exploit.
The report contains no details beyond the patch information, in particular no indication of active exploitation or threat actors.
The report contains no information beyond the pure patch details indicating active exploitation or strategic context.
The alert contains no information on active exploitation, threat actors, or TTPs and therefore does not go beyond pure patch information.
This report shows that attackers are using MQTT as a C2 channel for cross-platform malware, which can evade conventional network monitoring.
Pure CVE description with no indication of active exploitation, proof-of-concept or attacker TTPs , it adds nothing beyond the patch information (update to 153.0.8010.47).
The report contains only the NVD description of the vulnerability, without indications of active exploitation, affected sectors, or strategic implications.
Beyond the pure patch information, the report provides no evidence of active exploitation or a public exploit; the 'High' rating rests solely on the Chromium severity assessment.
Beyond the patch information, the alert provides no indication of active exploitation, attacker TTPs, or affected sectors.