What has changed?

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

The use of a kernel-mode rootkit takes the CoolClient backdoor's stealth to a new level: processes, files and network connections are hidden at operating-system level from EDR and forensic tooling, significantly complicating detection and incident analysis.

Armored Likho expands its cyber-espionage toolkit

The new CoolClient variant pairs a backdoor with a kernel-mode rootkit driver that hides processes, files and network connections from security tools , evidence of increasingly stealth-focused espionage toolkits.

ZDI-26-571: Linux Kernel Net Scheduler Packet Classifier API Use-After-Free Local Privilege Escalation Vulnerability

Exploitation requires local access, so the vulnerability is primarily relevant as part of an attack chain.

CVE-2026-8674

An attacker on the local network can trigger a crash of processes that use glibc for name resolution via manipulated DHCP or VPN search domains.

ZDI-26-534: (Pwn2Own) Microsoft Exchange Capture-Replay Authentication Bypass Vulnerability

The attack requires no prior authentication and was demonstrated as a Pwn2Own entry; there is no indication of active in-the-wild exploitation at the time of reporting.

ZDI-26-541: (Pwn2Own) Microsoft Windows win32kfull Use-After-Free Local Privilege Escalation Vulnerability

The Pwn2Own find underscores that local privilege escalation on Windows remains a serious threat, even though no active exploitation is known.

ZDI-26-543: Microsoft Windows ICC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI-26-536: (Pwn2Own) Microsoft Windows http.sys Integer Overflow Local Privilege Escalation Vulnerability

This is a Pwn2Own-demonstrated, previously unpatched LPE vulnerability in http.sys that allows attackers who already have low-privilege access to fully take over the system.

ZDI-26-542: Microsoft Windows UMPDDrvBitBlt Improper Object Management Local Privilege Escalation Vulnerability

Exploitation requires local low-privileged code execution, which reduces the risk compared to remotely exploitable vulnerabilities.

ZDI-26-539: (Pwn2Own) Microsoft Windows ipt.sys Incorrect Permission Assignment Local Privilege Escalation Vulnerability

The vulnerability discovered during Pwn2Own allows local attackers with low privileges to escalate to SYSTEM via the Windows driver ipt.sys.

Ubiquiti UniFi: Multiple Vulnerabilities

The vulnerabilities affect the central UniFi network management plane, which an attacker could leverage to fully compromise the management system.

Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows

The report shows that ransomware gangs deliberately use production shutdowns as leverage for extortion and as an indirect attack on the supply chain , the 40% sector trend is a strategic risk signal for manufacturing operations, not a single patch recommendation.

[UPDATE] systemd: Multiple Vulnerabilities

The BSI update does not provide CVE IDs or CVSS scores but points to systemd vulnerabilities that can allow root code execution.

CVE-2026-93375

CVE-2026-93373

The alert is limited to the CVE description and provides no additional information about active exploitation or an attack campaign.

CVE-2026-93382

The report contains no information beyond the patch advisory regarding active exploitation, exploit code, or threat actors.

CVE-2026-93387

The report merely describes a Skia vulnerability with cross-origin data leakage; no indications of active exploitation or strategic implications.

ZDI-26-572: Linux Kernel XFRM Race Condition Local Privilege Escalation Vulnerability

The ZDI advisory describes a local privilege escalation in the Linux kernel (XFRM race condition) without a CVE, which already requires elevated privileges.

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

The report shows that even passkey- and MFA-protected cloud accounts can be compromised via social engineering, so identity-theft detection , not just authentication , must be the focus.

Windows update locks out domain users

The report shows that the September Patchday not only closes vulnerabilities but can also cripple domain logins,an operational risk for Windows/AD environments.

Microsoft shares workaround for Windows domain login issues

The report describes a regression in domain authentication caused by Microsoft security updates, for which a temporary workaround exists but no active exploitation is known.

[UPDATE] Linux Kernel: Multiple Vulnerabilities

[UPDATE] OpenSSL: Multiple Vulnerabilities

The BSI advisory does not provide CVE IDs, CVSS scores, or exploitation details, so prioritization depends on the vendor patch status.

CVE-2026-92499

The report provides no evidence of active exploitation or strategic threat, but describes a local kernel vulnerability that requires a manipulated ext4 file system.

CVE-2026-93144

The vulnerability allows bypassing the read-only policy for untrusted BTF pointers in the BPF subsystem, which can lead to writes to memory that should be read-only.

CVE-2026-93146

The report provides no information beyond the patch regarding active exploitation, threat actors, or a strategic campaign; it is a pure kernel validation fix.

Google Chrome: Multiple Vulnerabilities

BSI aggregate advisory without specific CVE IDs, whose relevance stems mainly from the widespread use of Chrome as the default browser.

Microsoft Edge: Multiple Vulnerabilities

CVE-2026-93385

This report does not go beyond patch information; there are no indications of active exploitation, attacker TTPs, or affected sectors.

[UPDATE] Linux Kernel: Multiple Vulnerabilities

The updated BSI advisory highlights local exploitability in the Linux kernel without naming specific CVEs or active exploitation.

[UPDATE] 7-Zip: Vulnerability allows bypassing security restrictions

The updated BSI warning confirms a 7-Zip vulnerability for bypassing security restrictions, but does not provide a CVE or exploitation details.