Several high-profile security threats emerged this week, from zero-day attacks in Chrome to router hijacks and supply chain intrusions. Below are the key incidents that every security team needs to know, along with trends pointing to where cyber risk is increasing fastest.
🛡 Major Vulnerabilities & Active Exploits
Google has patched 12 flaws in Chrome, including a zero-day (CVE-2026-85046) targeting its V8 engine. This type confusion bug allows remote attackers—via a crafted HTML page—to execute arbitrary code inside the browser sandbox. Evidence shows exploit activity in the wild prior to the patch. This marks Chrome’s sixth zero-day exploited in active attacks so far this year.
MikroTik’s RouterOS is also under serious threat. Two zero-days (CVE-2026-67276, CVE-2026-86060), part of a larger chain dubbed “MikroTrick,” enable full device takeover without authentication if remote SSH is enabled. CERT Polska confirmed attacks starting September 2, involving an unauthorized account named “ops,” with fixes already released in several stable and long-term versions.
🔥 Exploit Campaigns and Malware Operations
An unpatched zero-day in Magento and Adobe Commerce—referred to as “StyleSmuggler”—is being used to backdoor online stores. Attackers inject malicious PHP into template systems via payment failure reports and trigger execution through failed payment emails. The backdoor is a Rust binary connecting to a command-and-control (C2) server, with two variants detected and additional clusters dropping web shells.
The RevStealer (aka REF2859) strain is spreading through fake game cheats and counterfeit desktop apps, targeting platforms such as an illicit version of Anthropic’s Claude Opus 5. It employs advanced techniques—blockchain dead drops, sandbox-scoring, credential abuse (SSH keys, tokens), and payload delivery via C2 tasks. It also installs proxy tools and cryptomining components.
📡 Infrastructure & Protocol Risks
A serious supply chain incident struck Coder. Attackers breached its Cloudflare setup and inserted unauthorized registry servers hosting malicious Terraform modules. The modules were designed to steal credentials and secrets (API keys, CI/CD tokens, etc.) before relaying them to a deceptive look-alike domain. Users are urged to upgrade to fixed versions: 2.37.0, 2.36.4, 2.35.7, or 2.34.9.
SNMPv3—typically considered a secure protocol for network device management—was revealed to leak vendor info, valid usernames, and encryption settings via pre-authentication signals. Because those leaks occur before login, attackers can shrink the search space for weak credentials significantly. Nearly half a million devices exposed this way have been identified.
🔍 Emerging Trends & Other Alerts
Phishing techniques with QR codes saw innovation: attackers now build QR visuals right in the email markup, avoiding attachments or images. This bypasses image‐blocking defenses while still delivering scannable codes to recipients.
On the legal front, a lawsuit in the UK values lost revenue at roughly $2.7 billion, accusing Apple of bias in its App Tracking Transparency (ATT) rules—claiming third-party developers are held to stricter standards than its own services. ATT has already been under scrutiny by EU regulators.
Attack patterns show edge devices are increasingly preferred targets for both state and criminal actors. A joint study found that, while Fortinet is often singled out, vendors like F5, Citrix, and Check Point have similar or worse exposure—particularly F5, where over half of all customer installations harbor actively exploited vulnerabilities.
Indirect prompt injection in LLM-powered summarizers was also spotlighted. Hidden HTML content in emails, styled to avoid detection (e.g. white on white text), can manipulate AI summarizer outputs without being noticed by recipients.
🔐 Closing Thoughts
Patching remains essential, but maintaining comprehensive logs and monitoring is equally critical. A system may be fully patched, yet still compromised through novel attack chains or undetected credentials misuse. The incidents this week underscore how attacker innovation—protocol quirks, supply chain weaknesses, and social engineering—continues to shrink the window between vulnerability discovery and exploitation.
What to watch: how vendors respond to these active exploit chains, improvements in detecting supply chain risks, and whether existing norms for email filtering, AI summarizers, and protocol design can catch up to attacker methods.
