What has changed?

Patch Tuesday - September 2026

Microsoft confirms exploitation of a Windows ALPC vulnerability as a zero-day in the wild, while the rest of Patch Tuesday comprises a record 999 CVEs.

China-linked malicious actors called out by UK and international partners for targeting sensitive data globally

The joint advisory provides an official international attribution of state-directed Chinese cyber activity and frames it as a long-term, cross-sector espionage campaign , relevant for strategic risk assessment, with no concrete patch reference.

Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firms

The report shows Russian-aligned APT groups are continuously evolving malware against Ukrainian manufacturing, energy, and transport companies, signaling a persistent threat to Europe's industrial base.

Chinese Inverters: Just One Hack Away from Blackout

The report shows that Chinese inverters in German solar systems pose a strategic risk to power grid security that goes beyond classic IT vulnerabilities.

FBI disrupts Chinese hacking tools used to breach critical infrastructure

The FBI seizure of Flax Typhoon domains shows that Chinese APTs constantly rebuild their infrastructure for attacks on critical infrastructure, which is also a strategic risk for European industrial partners.

Edge Infrastructure Under Siege: What Two Independent Datasets Reveal About Who's Exploiting Your Perimeter

The analysis shows that edge vulnerabilities are exploited by both state-sponsored and criminal actors, and high-priority CVEs remain unpatched even longer (median 146 days).

ZDI-26-605: Microsoft Windows Localized Filenames Improper Input Validation NTLM Response Information Disclosure Vulnerability

ZDI reports a vulnerability in Windows that can disclose NTLM responses through localized filenames, but only with user interaction and a low CVSS.

FortiBleed Attackers Locking Victims Out of Fortinet Devices

The campaign remains active and now escalates by deleting accounts and passwords to lock out victims , this calls for continuous account and credential monitoring on the Fortinet devices beyond patching.

Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia

The Wazza phishkit uses integrated filtering and session management features to specifically target manufacturing companies in the EU, making it an active, sector-specific threat.

VMware Products: Multiple Vulnerabilities

The vulnerabilities in VMware ESXi and vCenter Server allow code execution and bypass of security measures, making the virtualization infrastructure vulnerable.

ZDI-26-607: Microsoft Office HTML Injection Information Disclosure Vulnerability

The report points to an HTML injection flaw in Microsoft Office for which no CVE has been assigned yet and no active exploitation is known.

ZDI-26-609: Linux Kernel Net Scheduler Packet Classifier Use-After-Free Local Privilege Escalation Vulnerability

The vulnerability requires local code execution and enables privilege escalation on Linux systems after an initial compromise.

Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

Attackers use Teams calls and chats instead of classic phishing emails to obtain credentials and MFA codes through trust-building.

[UPDATE] OpenSSH: Multiple Vulnerabilities

The report summarizes multiple OpenSSH vulnerabilities without specific CVE IDs, complicating prioritization.

Linux Kernel: Multiple Vulnerabilities

[UPDATE] cURL: Multiple Vulnerabilities

The BSI advisory contains no CVE IDs and no exploitation details, which complicates prioritization of the vulnerabilities.

[UPDATE] Linux Kernel: Multiple vulnerabilities allow denial of service and unspecified attack

Google Chrome: Multiple Vulnerabilities

The report does not specify concrete CVE IDs or exploitation details; it serves as a general indication of Chrome security updates.

Adobe Acrobat and Acrobat Reader: Multiple Vulnerabilities

CVE-2026-88647

Beyond the patch information, the report provides no additional insights into active attacks or affected sectors.

Veeam patches code execution vulnerability in Backup & Replication

Veeam Backup & Replication is a central system for data backup and recovery; code execution on this server directly endangers the integrity of the backups.