Comparing 17 September 2026 with the previous day 10 September 2026.
The use of a kernel-mode rootkit takes the CoolClient backdoor's stealth to a new level: processes, files and network connections are hidden at operating-system level from EDR and forensic tooling, significantly complicating detection and incident analysis.
The new CoolClient variant pairs a backdoor with a kernel-mode rootkit driver that hides processes, files and network connections from security tools , evidence of increasingly stealth-focused espionage toolkits.
Exploitation requires local access, so the vulnerability is primarily relevant as part of an attack chain.
An attacker on the local network can trigger a crash of processes that use glibc for name resolution via manipulated DHCP or VPN search domains.
The attack requires no prior authentication and was demonstrated as a Pwn2Own entry; there is no indication of active in-the-wild exploitation at the time of reporting.
The Pwn2Own find underscores that local privilege escalation on Windows remains a serious threat, even though no active exploitation is known.
This is a Pwn2Own-demonstrated, previously unpatched LPE vulnerability in http.sys that allows attackers who already have low-privilege access to fully take over the system.
Exploitation requires local low-privileged code execution, which reduces the risk compared to remotely exploitable vulnerabilities.
The vulnerability discovered during Pwn2Own allows local attackers with low privileges to escalate to SYSTEM via the Windows driver ipt.sys.
The vulnerabilities affect the central UniFi network management plane, which an attacker could leverage to fully compromise the management system.
The report shows that ransomware gangs deliberately use production shutdowns as leverage for extortion and as an indirect attack on the supply chain , the 40% sector trend is a strategic risk signal for manufacturing operations, not a single patch recommendation.
The BSI update does not provide CVE IDs or CVSS scores but points to systemd vulnerabilities that can allow root code execution.
The vulnerability affects the processing of XZ chunked data and requires user interaction for exploitation.
The alert is limited to the CVE description and provides no additional information about active exploitation or an attack campaign.
The report contains no information beyond the patch advisory regarding active exploitation, exploit code, or threat actors.
The report merely describes a Skia vulnerability with cross-origin data leakage; no indications of active exploitation or strategic implications.
The ZDI advisory describes a local privilege escalation in the Linux kernel (XFRM race condition) without a CVE, which already requires elevated privileges.
The report shows that even passkey- and MFA-protected cloud accounts can be compromised via social engineering, so identity-theft detection , not just authentication , must be the focus.
The BSI advisory aggregates multiple Adobe Creative Cloud vulnerabilities but provides no CVE IDs, severity scores, or indications of active exploitation.
Without CVE IDs or details on active exploitation, it remains unclear whether already known, exploited flaws are included.
The report shows that the September Patchday not only closes vulnerabilities but can also cripple domain logins,an operational risk for Windows/AD environments.
The report describes a regression in domain authentication caused by Microsoft security updates, for which a temporary workaround exists but no active exploitation is known.
The BSI advisory does not provide CVE IDs, CVSS scores, or exploitation details, so prioritization depends on the vendor patch status.
The report provides no evidence of active exploitation or strategic threat, but describes a local kernel vulnerability that requires a manipulated ext4 file system.
The vulnerability allows bypassing the read-only policy for untrusted BTF pointers in the BPF subsystem, which can lead to writes to memory that should be read-only.
The report provides no information beyond the patch regarding active exploitation, threat actors, or a strategic campaign; it is a pure kernel validation fix.
BSI aggregate advisory without specific CVE IDs, whose relevance stems mainly from the widespread use of Chrome as the default browser.
This report does not go beyond patch information; there are no indications of active exploitation, attacker TTPs, or affected sectors.
The updated BSI advisory highlights local exploitability in the Linux kernel without naming specific CVEs or active exploitation.
The updated BSI warning confirms a 7-Zip vulnerability for bypassing security restrictions, but does not provide a CVE or exploitation details.
No changes in this category.
No changes in this category.
The vulnerability is being actively exploited by a Node.js-based RAT (PivotC2) and has been added to the CISA KEV catalog, indicating rapid proliferation and heightened risk.
Threat actors are deliberately targeting inadequately monitored perimeter edge devices to gain initial access via these vulnerabilities and deploy post-exploitation tools such as PivotC2.
An integer-overflow vulnerability in Adobe Photoshop's JPEG processing enables remote code execution upon user interaction and is listed in the CISA KEV catalogue.
Integer-overflow vulnerability in DCM file parsing enables remote code execution with user interaction, rated CVSS 7.8 critical severity.
RCE vulnerability in Adobe Photoshop during JPEG-LS image processing requires user interaction (visiting a malicious page or opening a malicious file).
A use-after-free vulnerability in Adobe Acrobat Reader DC enables remote code execution upon user interaction with malicious PDF files or web pages.
Use of Adobe Acrobat Reader DC requires prompt patch prioritization, as RCE exploitability is present via file-opening vectors.
Adobe Acrobat Reader DC is vulnerable to Use-After-Free RCE in annotation processing; attack requires user interaction (file opening or web visit).
A use-after-free vulnerability in Adobe Acrobat Pro DC enables remote code execution via malicious files or web pages with CVSS 7.8, requiring user interaction.
Use-After-Free vulnerability in PDF annotation functionality enables remote code execution upon opening a malicious PDF or visiting a malicious website; CVSS 7.8 indicates high exploitability.
Use-After-Free vulnerability in annotation functionality enables remote code execution when visiting malicious pages or opening crafted files,relevant for organizations using Acrobat Pro DC in design and document workflows.
A use-after-free vulnerability enables remote code execution in Adobe Acrobat Reader DC with user interaction, presenting direct risk to organizations using this PDF reader.
Type confusion vulnerability in Adobe Acrobat Reader DC enables remote code execution through opening malicious PDFs or visiting prepared web pages.
Integer overflow vulnerability in Adobe Acrobat Pro DC's JPEG parser enables remote code execution when users open a malicious file or visit a malicious page.
An out-of-bounds write vulnerability in Adobe Acrobat Reader DC enables remote code execution upon user interaction with a high CVSS score of 7.8.
A Use-After-Free vulnerability in Adobe Acrobat Reader DC enables remote code execution with CVSS 7.8, but requires user interaction.
A use-after-free vulnerability in Adobe Acrobat Reader DC enables remote code execution with CVSS 7.8, but requires user interaction (visiting a malicious page or opening a malicious file).
The vulnerability allows attackers to persistently manipulate network proxy settings via malicious add-ins and intercept authenticated Fusion user connections without user awareness.
Authenticated remote code execution in Fortinet FortiSandbox via command injection allows attackers to compromise systems where the product is deployed.
BSI warns of an active, targeted campaign against German institutions focusing on critical infrastructure and government agencies , a sign of elevated cyber risk in the DACH region for suppliers and partners in these sectors.
Low-severity vulnerability (CVSS 3.3) in Adobe Acrobat Reader DC with information disclosure potential through malicious PDF files, requires user interaction.
A use-after-free vulnerability in Adobe Acrobat Reader DC enables information disclosure through malicious PDF or font files.
EU cybersecurity legislation establishes mandatory reporting obligations for actively exploited vulnerabilities within 24 hours effective immediately, signaling significant regulatory tightening for European organizations with comprehensive enforcement by December 2027.
A suspected Russian-speaking state actor is leveraging hundreds of AI agents to systematically exploit PaperCut instances and gain enterprise access,exemplifying state-sponsored cyber operations using advanced automated techniques.
Russian-Ukrainian cyber operations escalate with sophisticated multi-payload delivery chains; security teams in DACH must prepare for similar techniques (WebDAV abuse, stealer distribution).
Anthropic report demonstrates that AI tools enable smaller actors to conduct state-level hacking campaigns; documented cases include Russian-aligned espionage against 20+ organizations and Chinese exploit development, with relevance to European supply chains and critical infrastructure.
The ShieldCrash exploit enables privilege escalation to System privileges on Windows systems with September 2026 patches and has publicly available PoC code.
Chrome 153.0.8010.36/.37 patches one actively exploited medium-severity vulnerability and five critical flaws, including four in WebGL, enabling remote code execution.
BlueMoon kit actively exploits previously unpatched zero-days in Windows and Chrome, requiring immediate defensive readiness.
BSI warning regarding critical remote code execution vulnerability in FortiOS with immediate implications for the company's perimeter security.
A code-execution vulnerability in 7-Zip can be exploited by remote unauthenticated attackers and requires immediate patching.
Critical vulnerability in PAN-OS XML processing enables unauthenticated access to management and dataplane interfaces, with root-level code execution on PA-Series; Panorama affected.
Multiple zero-day vulnerabilities in Chrome are currently being actively exploited, requiring immediate patching across all users.
Unauthenticated attackers can disclose sensitive information via OAuth Device Code Grant flows in Entra ID; threat to identity security and access control.
A high-volume phishing campaign is using invisible Unicode characters (ASCII Smuggling) to evade email filters and conceal financial lure keywords,a technique adapted from AI prompt injection research.
Two critical vulnerabilities in Check Point firewalls enable unauthenticated remote code execution through faulty VPN certificate handling, indicating systemic risks in TLS/PKI validation in enterprise security appliances.
The BSI advisory covers multiple OpenSSH vulnerabilities without specifying CVE numbers or affected versions; precise identification of affected versions and exploitability status is required.
BSI warns of multiple vulnerabilities in FortiSandbox enabling remote code execution or information disclosure; specific CVE IDs and affected versions are detailed in the BSI advisory.
The BSI warning documents multiple vulnerabilities in UnifiOS without specific CVE numbers; the scope and severity suggest a coordinated disclosure or ongoing patch cycle.
BSI warns of multiple vulnerabilities in Adobe Creative Cloud applications (Substance 3D, XD, Illustrator) with potential for code execution and information disclosure.
BSI alert on multiple Chrome vulnerabilities without specific CVE numbers or patch date,likely aggregate security notice for regular patch cycle.
Attackers use voice phishing on personal devices to gain Microsoft 365 access and then abuse the Graph API for large-scale data exfiltration, threatening conventional BYOD policies.
Threat actors are leveraging AI-powered techniques to craft highly convincing spoofed emails impersonating internal executives, enabling large-scale campaigns distributing over one million fraudulent messages.
Cyberattackers are weaponizing AI platform impersonation (ChatGPT, Copilot, Claude, DeepSeek) at scale (up to 100,000 emails per day) for phishing, credential harvesting, and malvertising, with increasing automation and Teams-based social engineering.
A disgruntled security researcher is actively publishing exploitable zero-day exploits against Windows Defender as patch bypasses, regularly circumventing the protective effect of security updates.
Four espionage groups actively exploit the same BlueMoon exploit chain targeting Chrome/Windows within days of each other; all three vulnerabilities are listed in CISA's KEV catalog and are being exploited in the wild.
Microsoft September 2026 patches cause Remote Desktop Services outages , a critical remote access component requiring immediate compatibility assessment.