Comparing 26 September 2026 with the previous day 19 September 2026.
CISA confirms active exploitation: the SharePoint RCE CVE-2026-65660 is being attacked in the wild, and the RouterOS flaw CVE-2026-67279 is chained with CVE-2026-86060 into the 'MikroTrick' exploit chain that yields full unauthenticated access.
The case shows that the Cyclops Blink infrastructure disrupted by the FBI in 2022 is not dead: a Russian military APT combines multiple Cisco flaws to plant an upgraded botnet variant on exposed edge devices.
The vulnerability requires local access; exploitation assumes an already compromised system or malicious local user.
The vulnerability requires local access and allows privilege escalation; exploitation requires already compromised access.
Unlike third-party vulnerable drivers, BTR.sys is a built-in Windows component and is therefore not covered by the Microsoft Vulnerable Driver Blocklist, making it a living-off-the-land driver for attackers with administrative rights.
The update does not list specific CVE IDs but summarizes multiple vulnerabilities in both browsers.
The report summarizes multiple unspecified Linux kernel vulnerabilities that can lead to DoS and memory leaks, without concrete CVE or patch details.
No changes in this category.
No changes in this category.
The item summarises three kernel flaws already listed by CISA as exploited and additionally points to publicly released exploits for four further local privilege-escalation bugs , the real value lies in prioritising kernel patches, not in new technical details.
The joint law enforcement advisory demonstrates an active, state-sponsored North Korean campaign with 30,000 compromised devices and financial motives , a strategic risk independent of patch status.
The report summarizes multiple Linux kernel vulnerabilities without specifying CVEs, making prioritization difficult.