Comparing 23 September 2026 with the previous day 16 September 2026.
A Chinese state actor is actively exploiting a Chrome and Windows zero-day chain through fake websites , the BlueMoon exploit kit is already in use, which goes beyond mere patch information.
The report highlights two Windows zero-day EoP vulnerabilities and an actively exploited Chrome V8 zero-day, while Microsoft Edge lags behind Chrome without its own browser advisories.
Beyond the mere patch information, the report highlights a window between the upstream fix and LTS delivery in which a public container-escape exploit is available for unpatched Ubuntu systems.
The report shows the concrete DACH implementation of the NIS2 Directive in Austria with new registration obligations and a central cybersecurity authority.
The flaw requires pre-existing local code execution, so it acts primarily as a post-exploitation privilege-escalation tool rather than an initial attack vector.
The service harvested session tokens without stealing passwords or MFA codes, allowing even multi-factor-protected accounts to be taken over.
The report shows that device code phishing abuses a legitimate feature to bypass MFA and gain access to Microsoft 365 accounts without a password.
Two of the 972 patched vulnerabilities are already being exploited in the wild, so these zero-days must be prioritised immediately regardless of the overall patch volume.
Exploitation requires local access, so the vulnerabilities are primarily relevant to attackers who have already gained a foothold as an escalation and persistence vector on Linux systems.
The report provides neither a CVE nor affected kernel versions, so no immediate patch mapping is possible.
The advisory contains no CVE IDs or CVSS scores, which complicates patch prioritization.
The BSI advisory summarizes multiple local kernel vulnerabilities without CVE references, providing no concrete patch or exploit information.
No changes in this category.
The FortiGate flaw CVE-2025-25249 is actively exploited to deliver the Node.js RAT PivotC2 with interactive shells, tunneling and network scanning , exposed perimeter devices remain the primary initial-access vector.
The flaw is already being actively exploited in the wild and was added to CISA's KEV catalog on September 9, 2026, which goes beyond a mere patch reminder and signals a real threat via crafted web pages.
The vulnerability allows unauthenticated remote code execution with root privileges via a malicious IODD file and persists across reboots.
The BSI reports an active campaign against German institutions, indicating a targeted threat to the DACH region.
Russian state-sponsored hackers are using AI (Claude) to rebuild malware after detection and evade discovery, representing a new TTP for AI-assisted cyber espionage.
Four espionage groups sharing the same exploit kit within a week points to an industrialized, pooled attack infrastructure behind state-backed industrial espionage.
The EU Commission is calling for a joint defence against cyberattacks and sabotage, pointing to recent incidents in Denmark, Lithuania and Poland as well as a drone incident in Leipzig , a signal for a coordinated European response to hybrid threats.
Several Western government agencies for the first time publish a joint technical analysis of an Iranian surveillance malware and confirm the abuse of Telegram as a C&C channel , a signal of the reach of state-sponsored espionage toolkits.
The report shows that generative AI models such as Claude are increasingly used as attack tools for automated exploitation, data theft, and state operations,a strategic risk that goes beyond classic patch information.
The two newly documented implants, Ted and curlRAT, show that North Korean APTs use exposed network components such as HAProxy as an injection point and increasingly target the automotive and supplier industry , a pattern that also matters for European production environments.
Beyond patch information, the report shows that the official fix for CVE-2026-69414 is incomplete and that arbitrary file read with SYSTEM privileges remains possible under specific conditions.
The vulnerability is limited to information disclosure and requires user interaction; with a CVSS of 3.3, patch management priority is low.
The vulnerability is only of low severity (CVSS 3.3) and requires user interaction, which limits the risk for the end user.
The BSI advisory does not specify any CVE IDs, which complicates assessment of exploitability and prioritization.
ZDI-26-609 describes a use-after-free flaw in the Linux kernel network scheduler, for which no CVE and no indications of active exploitation are currently available.
Unlike patch advisories, this report describes an active vishing operation against Microsoft Teams that aims at session takeover, malware propagation, and infrastructure compromise.
The campaign marks the shift from ClickFix to TerminalFix: attackers route victims to Windows Terminal instead of the Run dialog so that multi-line scripts and reverse-tunnel payloads execute reliably.
The V8 type confusion flaw is already being actively exploited and is therefore not merely a theoretical patching matter.
The report describes a new attack path: voice phishing against personal BYOD devices as the entry point, followed by large-scale data exfiltration via the Microsoft Graph API that bypasses classic endpoint controls.
The report describes an active banking malware campaign that bypasses browser protection mechanisms via the KREMLIN toolkit to install malicious Chrome and Edge extensions and steal credentials and session tokens.
The BSI advisory describes a use-after-free vulnerability in Office/Excel without a CVE reference and without indication of active exploitation.
Of the 973 patched vulnerabilities, two are already actively exploited, including one in the Windows Update Stack and one in Windows ALPC.
Microsoft's largest Patch Tuesday to date includes two already actively exploited zero-days, both local privilege escalations , one via an AppContainer sandbox escape , allowing an attacker with existing access to gain SYSTEM privileges.
A publicly released zero-day patch bypass in the Malware Protection Engine shows that Defender protection cannot be guaranteed by patch cycles alone and may require compensating controls.
Four different espionage groups used the same Chrome/Windows exploit chain within days of each other, showing that once a flaw becomes public it is exploited almost simultaneously by multiple state-linked actors.
Chrome 153.0.8010.36/.37 fixes five critical flaws , mostly in WebGL , alongside one actively exploited vulnerability, so the update should be applied promptly.
The new Shieldcrash exploit shows that Microsoft's fix for the Shieldbreak flaw, billed as a 'high-quality update', apparently does not fully close the underlying attack vector in Defender.
The OAuth device code grant is a central building block of modern token attacks (device code phishing); an unauthenticated information disclosure in this flow is therefore more than a pure patching matter.
The report describes an active malware campaign targeting Chrome users that can be triggered by a single click.
The report highlights the record scope and ongoing attacks but provides no specific CVE or attack details, serving mainly as a patch reminder with an urgency appeal.
The BSI WID aggregates multiple vulnerabilities across three distinct Windows components without listing CVE IDs or exploitation status , concrete exposure must be verified per system against Microsoft patch details.
The BSI warning lists multiple Linux kernel vulnerabilities without specific CVE IDs or exploitation details, making prioritization difficult for administrators.
The advisory does not provide CVE IDs or exploitation details; it is a general patch notice for Google Chrome.
The item cites neither CVE IDs nor evidence of active exploitation, so it adds little beyond basic patch information.
The report summarizes several different vulnerability types in Lightroom Classic without providing CVE IDs or evidence of active exploitation.