What has changed?

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

A Chinese state actor is actively exploiting a Chrome and Windows zero-day chain through fake websites , the BlueMoon exploit kit is already in use, which goes beyond mere patch information.

Patch Tuesday - September 2026

The report highlights two Windows zero-day EoP vulnerabilities and an actively exploited Chrome V8 zero-day, while Microsoft Edge lags behind Chrome without its own browser advisories.

Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape

Beyond the mere patch information, the report highlights a window between the upstream fix and LTS delivery in which a public container-escape exploit is available for unpatched Ubuntu systems.

Austria implements NIS2, receives Federal Office for Cybersecurity

The report shows the concrete DACH implementation of the NIS2 Directive in Austria with new registration obligations and a central cybersecurity authority.

CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys

The analysis describes the concrete attack vector: a specially crafted HTTP/1.x request over a TLS connection that triggers a memory access exception in kernel context, leading to system termination or, in the worst case, code execution with kernel privileges.

ZDI-26-678: Adobe Photoshop DCM File Parsing Integer Overflow Remote Code Execution Vulnerability

Exploitation requires user interaction (opening a crafted DCM file), which favours attacks via email attachments or web downloads; exploitation in the wild has not been observed so far.

ZDI-26-677: Adobe Photoshop DCM JPEG-LS Image Parsing Integer Overflow Remote Code Execution Vulnerability

The flaw sits in the parser for the DCM/JPEG-LS format that is common in medical and document imaging and that Photoshop opens, so the attack vector is a crafted image file rather than network access.

ZDI-26-679: Adobe Photoshop DCM JPEG Image Parsing Integer Overflow Remote Code Execution Vulnerability

The vulnerability requires user interaction and enables RCE in Adobe Photoshop when parsing DCM JPEG images.

ZDI-26-667: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

The flaw requires user interaction and has not been reported as actively exploited so far, so the risk is primarily managed via patch timing and email/web filtering.

ZDI-26-676: Adobe Acrobat Reader DC DigSig Use-After-Free Remote Code Execution Vulnerability

The flaw resides in the DigSig signature-verification component; since PDFs from email attachments or web downloads are the typical attack vector, merely opening a crafted file is enough to achieve code execution in the user context.

ZDI-26-675: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

The report describes a newly published ZDI vulnerability with no indication of active exploitation or KEV listing; the attack requires a user to open a crafted file or web page.

ZDI-26-673: Adobe Acrobat Pro DC Doc Object Use-After-Free Remote Code Execution Vulnerability

The vulnerability requires user interaction, making it attractive for phishing attacks.

ZDI-26-663: Adobe Acrobat Pro DC Annotation Use-After-Free Remote Code Execution Vulnerability

This is a targeted ZDI advisory with no indication of exploitation in the wild; exploitation strictly requires user interaction (opening a crafted file or visiting a malicious web page).

ZDI-26-661: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

ZDI-26-664: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

No evidence of active exploitation or KEV inclusion; exploitation requires user interaction.

ZDI-26-671: Adobe Acrobat Reader DC Dialog Object Type Confusion Remote Code Execution Vulnerability

The flaw requires user interaction and has no evidence of in-the-wild exploitation at publication time, so the risk stems primarily from the wide installation base of Adobe Reader on endpoints.

ZDI-26-658: Adobe Acrobat Pro DC JPEG Parsing Integer Overflow Remote Code Execution Vulnerability

The vulnerability allows code execution simply by opening a crafted JPEG file or visiting a manipulated web page , a classic entry point for phishing campaigns against office users.

ZDI-26-674: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability

The report describes a new out-of-bounds write vulnerability in Adobe Acrobat Reader DC's annotation processing, rated CVSS 7.8 for RCE, requiring user interaction.

ZDI-26-662: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

The flaw sits in the Reader's annotation handling and requires opening a crafted PDF or a malicious web page, which limits everyday exploitation risk but favours targeted spear-phishing.

ZDI-26-665: Adobe Acrobat Reader DC Annots Report Use-After-Free Remote Code Execution Vulnerability

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

Beyond the plain patch information, the report provides a concrete, reproducible exploitation path via a crafted BDC model XML file that grants an authenticated user execution rights on the SharePoint server.

ZDI-26-659: Adobe Acrobat Reader DC JPEG2000 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI-26-607: Microsoft Office HTML Injection Information Disclosure Vulnerability

The vulnerability has no CVE entry and requires user interaction, which limits exploitability but allows information disclosure.

ZDI-26-623: Linux Kernel IPv6 Multicast Routing Use-After-Free Local Privilege Escalation Vulnerability

The flaw requires pre-existing local code execution, so it acts primarily as a post-exploitation privilege-escalation tool rather than an initial attack vector.

Passkey-themed social engineering leads to identity and cloud compromise

The real lever is not the credential theft itself but the early-established MFA persistence via an actor-registered factor, which keeps the compromise alive even after credential resets.

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

The attack uses legitimate Teams external communication and remote monitoring and management tools instead of classic malware delivery, thereby bypassing email gateways and conventional attachment filtering.

EvilTokens dismantled: 12,000 Microsoft accounts hijacked via AI phishing service

The service harvested session tokens without stealing passwords or MFA codes, allowing even multi-factor-protected accounts to be taken over.

Microsoft SharePoint - Zero-day and critical vulnerabilities fixed

How device code phishing gives scammers access to your account

The report shows that device code phishing abuses a legitimate feature to bypass MFA and gain access to Microsoft 365 accounts without a password.

September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs

Two of the 972 patched vulnerabilities are already being exploited in the wild, so these zero-days must be prioritised immediately regardless of the overall patch volume.

Shattering the Dream , When a Job Offer Becomes a Zero-Day Attack

The malware is distributed via fake job offers and exploits a previously unknown in-memory LPE vulnerability in the Windows AFD.sys driver, pointing to a state-sponsored actor.

The Good, the Bad and the Ugly in Cybersecurity , Week 33 (2026)

The report highlights that the new Defender zero-day ShieldBreak bypasses an already patched Defender flaw, calling into question the effectiveness of the July patch.

Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

The attack abuses Microsoft Teams as a trusted communication channel, rendering classic email gateways and filters ineffective so that detection must take place at the identity and collaboration layer.

ASCII smuggling crosses over from AI prompt injection to phishing evasion

For the first time, an obfuscation technique known from AI prompt-injection research (invisible Unicode tag characters U+E0000,U+E007F) is being used in a real phishing campaign to bypass classic email filters.

GNU libc: Multiple Vulnerabilities

Exploitation requires local access, so the vulnerabilities are primarily relevant to attackers who have already gained a foothold as an escalation and persistence vector on Linux systems.

[UPDATE] Linux Kernel: Vulnerability Allows Privilege Escalation and Denial of Service

The report provides neither a CVE nor affected kernel versions, so no immediate patch mapping is possible.

Ubiquiti UnifiOS: Multiple Vulnerabilities

Adobe Creative Cloud applications: Multiple vulnerabilities

The advisory contains no CVE IDs or CVSS scores, which complicates patch prioritization.

[UPDATE] Linux Kernel: Multiple Vulnerabilities

The BSI advisory summarizes multiple local kernel vulnerabilities without CVE references, providing no concrete patch or exploit information.

Microsoft Edge: Multiple Vulnerabilities

The advisory contains no CVE IDs, no CVSS scores and no indication of active exploitation, and thus does not go beyond a generic patch reminder.