Comparing 17 September 2026 with the previous day 16 September 2026.
The use of a kernel-mode rootkit takes the CoolClient backdoor's stealth to a new level: processes, files and network connections are hidden at operating-system level from EDR and forensic tooling, significantly complicating detection and incident analysis.
The new CoolClient variant pairs a backdoor with a kernel-mode rootkit driver that hides processes, files and network connections from security tools , evidence of increasingly stealth-focused espionage toolkits.
Exploitation requires local access, so the vulnerability is primarily relevant as part of an attack chain.
An attacker on the local network can trigger a crash of processes that use glibc for name resolution via manipulated DHCP or VPN search domains.
The attack requires no prior authentication and was demonstrated as a Pwn2Own entry; there is no indication of active in-the-wild exploitation at the time of reporting.
The Pwn2Own find underscores that local privilege escalation on Windows remains a serious threat, even though no active exploitation is known.
This is a Pwn2Own-demonstrated, previously unpatched LPE vulnerability in http.sys that allows attackers who already have low-privilege access to fully take over the system.
Exploitation requires local low-privileged code execution, which reduces the risk compared to remotely exploitable vulnerabilities.
The vulnerability discovered during Pwn2Own allows local attackers with low privileges to escalate to SYSTEM via the Windows driver ipt.sys.
The vulnerabilities affect the central UniFi network management plane, which an attacker could leverage to fully compromise the management system.
The report shows that ransomware gangs deliberately use production shutdowns as leverage for extortion and as an indirect attack on the supply chain , the 40% sector trend is a strategic risk signal for manufacturing operations, not a single patch recommendation.
The BSI update does not provide CVE IDs or CVSS scores but points to systemd vulnerabilities that can allow root code execution.
The vulnerability affects the processing of XZ chunked data and requires user interaction for exploitation.
The alert is limited to the CVE description and provides no additional information about active exploitation or an attack campaign.
The report contains no information beyond the patch advisory regarding active exploitation, exploit code, or threat actors.
The report merely describes a Skia vulnerability with cross-origin data leakage; no indications of active exploitation or strategic implications.
The ZDI advisory describes a local privilege escalation in the Linux kernel (XFRM race condition) without a CVE, which already requires elevated privileges.
The report shows that even passkey- and MFA-protected cloud accounts can be compromised via social engineering, so identity-theft detection , not just authentication , must be the focus.
The BSI advisory aggregates multiple Adobe Creative Cloud vulnerabilities but provides no CVE IDs, severity scores, or indications of active exploitation.
Without CVE IDs or details on active exploitation, it remains unclear whether already known, exploited flaws are included.
The report shows that the September Patchday not only closes vulnerabilities but can also cripple domain logins,an operational risk for Windows/AD environments.
The report describes a regression in domain authentication caused by Microsoft security updates, for which a temporary workaround exists but no active exploitation is known.
The BSI advisory does not provide CVE IDs, CVSS scores, or exploitation details, so prioritization depends on the vendor patch status.
The report provides no evidence of active exploitation or strategic threat, but describes a local kernel vulnerability that requires a manipulated ext4 file system.
The vulnerability allows bypassing the read-only policy for untrusted BTF pointers in the BPF subsystem, which can lead to writes to memory that should be read-only.
The report provides no information beyond the patch regarding active exploitation, threat actors, or a strategic campaign; it is a pure kernel validation fix.
BSI aggregate advisory without specific CVE IDs, whose relevance stems mainly from the widespread use of Chrome as the default browser.
This report does not go beyond patch information; there are no indications of active exploitation, attacker TTPs, or affected sectors.
The updated BSI advisory highlights local exploitability in the Linux kernel without naming specific CVEs or active exploitation.
The updated BSI warning confirms a 7-Zip vulnerability for bypassing security restrictions, but does not provide a CVE or exploitation details.
No changes in this category.
No changes in this category.
The FortiGate flaw CVE-2025-25249 is actively exploited to deliver the Node.js RAT PivotC2 with interactive shells, tunneling and network scanning , exposed perimeter devices remain the primary initial-access vector.
The flaw is already being actively exploited in the wild and was added to CISA's KEV catalog on September 9, 2026, which goes beyond a mere patch reminder and signals a real threat via crafted web pages.
The vulnerability allows unauthenticated remote code execution with root privileges via a malicious IODD file and persists across reboots.
The BSI reports an active campaign against German institutions, indicating a targeted threat to the DACH region.
Russian state-sponsored hackers are using AI (Claude) to rebuild malware after detection and evade discovery, representing a new TTP for AI-assisted cyber espionage.
Four espionage groups sharing the same exploit kit within a week points to an industrialized, pooled attack infrastructure behind state-backed industrial espionage.
The EU Commission is calling for a joint defence against cyberattacks and sabotage, pointing to recent incidents in Denmark, Lithuania and Poland as well as a drone incident in Leipzig , a signal for a coordinated European response to hybrid threats.
Several Western government agencies for the first time publish a joint technical analysis of an Iranian surveillance malware and confirm the abuse of Telegram as a C&C channel , a signal of the reach of state-sponsored espionage toolkits.
The report shows that generative AI models such as Claude are increasingly used as attack tools for automated exploitation, data theft, and state operations,a strategic risk that goes beyond classic patch information.
The two newly documented implants, Ted and curlRAT, show that North Korean APTs use exposed network components such as HAProxy as an injection point and increasingly target the automotive and supplier industry , a pattern that also matters for European production environments.
The detailed analysis shows that a single crafted HTTP/1.x request over TLS is enough to trigger a memory access fault in the HTTP.sys kernel context , up to code execution with kernel privileges.
Although the flaw requires user interaction, opening a crafted DCM file allows code execution in the context of the Photoshop process , relevant for any workstation that opens third-party files from customer or supplier projects.
The flaw sits in Photoshop's DCM JPEG-LS parsing component, showing that image-parsing libraries in the Creative Cloud toolchain remain an attack surface via crafted files.
The flaw resides in the Reader's annotation handling and requires user interaction; the advisory provides no evidence of active exploitation in the wild.
The flaw lies in the handling of Doc objects and requires active user action (opening a file or visiting a web page); so far there is no evidence of exploitation in the wild or KEV listing.
The vulnerability requires user interaction, which complicates opportunistic attacks but enables targeted attacks on Adobe Reader users.
The use-after-free flaw in Adobe Acrobat Reader DC's annotation processing allows attackers to execute code by merely opening a malicious file.
This is a use-after-free flaw in Acrobat Reader DC's annotation handling, known only from a ZDI advisory, with no in-the-wild exploitation or public exploit reported so far.
The flaw resides in annotation handling and requires user interaction (malicious PDF or web page); no exploit or active exploitation is documented.
This is a pure ZDI advisory with no indication of active exploitation or KEV listing; patch status remains the decisive factor.
This is a coordinated ZDI disclosure with no indication of active exploitation; the key point is timely patch verification, since exploitation requires a user to interact with a crafted PDF file.
Beyond patch information, the report shows that the official fix for CVE-2026-69414 is incomplete and that arbitrary file read with SYSTEM privileges remains possible under specific conditions.
The technical analysis provides a detailed walkthrough of exploiting CVE-2026-63520, including an XML payload via SharePoint's Business Data Catalog feature, underscoring its practical exploitability.
The vulnerability is limited to information disclosure and requires user interaction; with a CVSS of 3.3, patch management priority is low.
The vulnerability is only of low severity (CVSS 3.3) and requires user interaction, which limits the risk for the end user.
The BSI advisory does not specify any CVE IDs, which complicates assessment of exploitability and prioritization.
The report describes an active, targeted campaign that spreads new MISTPEN malware via fake job offers and exploits a zero-day in Microsoft's AFD.sys driver for privilege escalation.
Although the vulnerability requires user interaction, the high CVSS score of 7.6 underlines the need for timely patching.
ZDI-26-609 describes a use-after-free flaw in the Linux kernel network scheduler, for which no CVE and no indications of active exploitation are currently available.
Unlike patch advisories, this report describes an active vishing operation against Microsoft Teams that aims at session takeover, malware propagation, and infrastructure compromise.
The attack does not start with an email but with an external Teams chat or call from a separate tenant posing as the helpdesk, negotiating interactive remote access.
The campaign marks the shift from ClickFix to TerminalFix: attackers route victims to Windows Terminal instead of the Run dialog so that multi-line scripts and reverse-tunnel payloads execute reliably.
The report shows attackers using Microsoft Teams as a direct social-engineering channel to talk employees into handing over credentials and MFA codes by phone , a path that bypasses classic email filtering.
The attack begins with passkey-themed social engineering and then establishes durable persistence in the cloud identity via attacker-registered MFA methods that survives password changes.
The BSI advisory does not provide CVE IDs or exploitation details, so the actual urgency can only be derived from Ubiquiti advisories.
The V8 type confusion flaw is already being actively exploited and is therefore not merely a theoretical patching matter.
The report describes a new attack path: voice phishing against personal BYOD devices as the entry point, followed by large-scale data exfiltration via the Microsoft Graph API that bypasses classic endpoint controls.
The report describes an active banking malware campaign that bypasses browser protection mechanisms via the KREMLIN toolkit to install malicious Chrome and Edge extensions and steal credentials and session tokens.
The BSI advisory describes a use-after-free vulnerability in Office/Excel without a CVE reference and without indication of active exploitation.
Of the 973 patched vulnerabilities, two are already actively exploited, including one in the Windows Update Stack and one in Windows ALPC.
Microsoft's largest Patch Tuesday to date includes two already actively exploited zero-days, both local privilege escalations , one via an AppContainer sandbox escape , allowing an attacker with existing access to gain SYSTEM privileges.
A publicly released zero-day patch bypass in the Malware Protection Engine shows that Defender protection cannot be guaranteed by patch cycles alone and may require compensating controls.
Four different espionage groups used the same Chrome/Windows exploit chain within days of each other, showing that once a flaw becomes public it is exploited almost simultaneously by multiple state-linked actors.
Chrome 153.0.8010.36/.37 fixes five critical flaws , mostly in WebGL , alongside one actively exploited vulnerability, so the update should be applied promptly.
The new Shieldcrash exploit shows that Microsoft's fix for the Shieldbreak flaw, billed as a 'high-quality update', apparently does not fully close the underlying attack vector in Defender.
A new zero-day named 'ShieldBreak' bypasses the RoguePlanet fix in Microsoft Defender's malware protection engine that was patched in July , a direct patch bypass showing that previously closed gaps in endpoint protection can be neutralized again.
The OAuth device code grant is a central building block of modern token attacks (device code phishing); an unauthenticated information disclosure in this flow is therefore more than a pure patching matter.
The report describes an active malware campaign targeting Chrome users that can be triggered by a single click.
The report highlights the record scope and ongoing attacks but provides no specific CVE or attack details, serving mainly as a patch reminder with an urgency appeal.
The BSI WID aggregates multiple vulnerabilities across three distinct Windows components without listing CVE IDs or exploitation status , concrete exposure must be verified per system against Microsoft patch details.
The report shows that an evasion technique from AI prompt-injection research is now appearing in classic phishing campaigns, thereby defeating pure signature and keyword filtering.
The BSI warning lists multiple Linux kernel vulnerabilities without specific CVE IDs or exploitation details, making prioritization difficult for administrators.
The advisory does not specify any CVEs, which complicates the assessment of criticality and patch prioritization.
The advisory does not provide CVE IDs or exploitation details; it is a general patch notice for Google Chrome.
The item cites neither CVE IDs nor evidence of active exploitation, so it adds little beyond basic patch information.
The report summarizes several different vulnerability types in Lightroom Classic without providing CVE IDs or evidence of active exploitation.