Top 5 Cybersecurity News Stories September 11, 2026
This week’s Cybersecurity News Stories September 11, 2026 expose five distinct layers of the assumed-safe environment, each under active pressure. Microsoft’s September Patch Tuesday arrived with 974 CVEs — the largest single monthly release on record — including two zero-days already exploited in the wild and 20 vulnerabilities that researchers assessed as potentially wormable. A CVSS 10.0 unauthenticated remote code execution in Magento and Adobe Commerce was actively exploited three days before a patch existed. Germany’s BSI documented TerminalFix as an evolved ClickFix social engineering technique linked to ransomware activity in the Rhysida ecosystem; separate reporting on the Berlin Senate breach links the same technique to that incident. CERT Polska disclosed MikroTrick, a chained exploitation of two vulnerabilities in MikroTik RouterOS that allows any unauthenticated attacker with internet-accessible SSH to obtain full administrative control of a router — with CERT Polska reporting evidence indicating exploitation from at least September 2, one day before the patched builds were released, and approximately 122,500 devices found exposed at the time of public disclosure. And Proofpoint disclosed BlueMoon, a previously undocumented exploit kit that chains two Chromium patch-gap vulnerabilities with a Windows local privilege-escalation zero-day, deployed by four espionage-motivated clusters — with three additional clusters adopting the kit within seven days of TA412’s first observed use; Proofpoint notes that most observed activity has a suspected China nexus but attribution remains incomplete. Each story reveals a different structural limit — of patch programmes, of social engineering defences, of e-commerce security, of network device management, and of the assumption that advanced nation-state offensive capabilities are rare and tightly held.
1) Microsoft September 2026 Patch Tuesday: 974 CVEs, Two Actively Exploited Zero-Days, and 20 Wormable Vulnerabilities
Microsoft’s September 9, 2026 Patch Tuesday addresses 974 CVEs — the largest monthly security release on record by volume. Two of those vulnerabilities are confirmed exploited in the wild as zero-days: CVE-2026-85880, a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) rated CVSS 7.8, which allows a local attacker to obtain SYSTEM-level privileges; and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack, likewise enabling local privilege escalation to SYSTEM. CISA added both to its Known Exploited Vulnerabilities catalogue with a deadline for federal civilian agencies of September 22, 2026. The release also carries 20 vulnerabilities that researchers assessed as potentially wormable, including CVE-2026-69730, a DNS Server Remote Code Execution flaw that researchers have compared structurally with the 2020 SigRed vulnerability — capable, in theory, of propagating across network segments without requiring any user interaction.
The 974-CVE headline is not simply a large number; it is an operational governance signal. At that volume, few patch programmes operating on traditional monthly cycles and standard staffing levels can remediate every vulnerability within a meaningful risk window. Both exploited zero-days are local privilege-escalation flaws, making them especially relevant after an attacker has already obtained an initial foothold through another vector. The wormable DNS RCE, if exploited, carries self-propagation risk across network segments without requiring any user interaction from a target.
The September 2026 volume accelerates a visible multi-year trend. Organisations still operating a “patch everything within the month” model are facing a structural mismatch between programme design and the current vulnerability environment. Risk-based prioritisation — focusing remediation effort on CVEs that are actively exploited, CISA KEV-listed, rated critical, and directly relevant to the organisation’s exposed services — is no longer an optional maturity upgrade. It is the most operationally viable approach at this scale and cadence.
Read more on: SecurityWeek and The Register
Microsoft’s September 9, 2026 Patch Tuesday addresses 974 CVEs — the largest monthly release on record — including CVE-2026-85880 (Windows ALPC heap overflow, LPE to SYSTEM) and CVE-2026-81963 (Windows Update Stack link-following, LPE to SYSTEM), both actively exploited as zero-days, plus 20 potentially wormable vulnerabilities; CISA deadline for federal civilian agencies is September 22, 2026.
2) TerminalFix and the Berlin Senate Breach: BSI Documents Evolved ClickFix Campaign in the Rhysida Ecosystem
Germany’s Federal Office for Information Security (BSI) documented TerminalFix in a BITS warning issued on September 4, 2026, with a severity rating of Kritikalität 2. TerminalFix is an evolution of the ClickFix social engineering technique: where ClickFix presented fake browser error dialogs prompting users to paste one-line commands into the Windows Run dialog, TerminalFix routes the same fake Cloudflare CAPTCHA overlay to Windows Terminal or PowerShell, enabling the delivery of longer, more capable scripts including a reverse tunnel that converts a single compromised endpoint into a route to deeper network access. The BSI associated the campaign with financially motivated actors in the Rhysida ransomware ecosystem. Separate reporting on the Berlin Senate incident — including coverage by Heise Online — links TerminalFix to the compromise of two Senate departments: the Senate for Urban Development, Building and Housing, and the Senate for Mobility, Transport, Environment and Climate Protection, between August 7 and 12, 2026. According to that reporting, Rhysida claimed to have exfiltrated 5.79 TB of material — approximately 46,500 contracts, administrative records, and email data — from the two departments. Vice Spider, the financially motivated group operating the Rhysida ransomware-as-a-service platform, demanded 30 Bitcoin (approximately €2 million). Berlin publicly declined to pay.
If reporting on the Berlin incident is accurate, TerminalFix represents the first publicly documented initial access vector for a ransomware attack on a German state government institution. The technique’s effectiveness in the incident highlights a gap that arises when social engineering awareness programmes are updated for a specific TTP variant — ClickFix — but not for its functional successor. Users trained to recognise one presentation of the fake CAPTCHA lure may not recognise a derivative that routes the same lure through a different execution channel. The Berlin case also carries a specific governance dimension: the attack occurred approximately six weeks before the Berlin Abgeordnetenhaus election on September 20, 2026. Officials publicly stated that election-relevant systems and data were unaffected, but the confirmation required public communication from the mayor and interior senator — a level of political exposure not typically associated with a standard ransomware incident.
ClickFix appeared in DIESEC’s January 2026 coverage as a novel social engineering lure; TerminalFix, its successor, carried the same conceptual structure into active government-targeting campaigns before a comparable awareness cycle had completed. The pattern — TTP documented, awareness updated, successor variant deployed — reflects an attacker iteration speed that standard annual-cycle security awareness programmes are not designed to match. Organisations that addressed ClickFix through user training earlier in 2026 should verify whether those training materials and endpoint controls now account for the PowerShell delivery path and reverse tunnel capability that TerminalFix introduces.
Read more on: Heise Online and BSI BITS Warning
The BSI documented TerminalFix — an evolved successor to the ClickFix social engineering technique — in a Kritikalität 2 BITS warning on September 4, 2026, associating the campaign with Rhysida-linked financially motivated actors; reporting on the Berlin Senate incident links TerminalFix to the compromise of two Senate departments (August 7–12, 2026); TerminalFix routes a fake Cloudflare CAPTCHA lure to Windows Terminal or PowerShell, enabling longer scripts and reverse-tunnel network pivots.
3) StyleSmuggler CVE-2026-75650: CVSS 10.0 Magento Zero-Day Exploited Three Days Before Adobe Shipped a Patch
CVE-2026-75650, named StyleSmuggler by the researchers at Sansec who discovered it, is a CVSS 10.0 unauthenticated remote code execution vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source across all versions from 2.4.4 through 2.4.9. The mechanism involves malicious PHP code injected into Magento’s template rendering system, triggered when the platform processes the “Payment Transaction Failed Reminder” email template. The exploit chain is unauthenticated and is triggered through a crafted HTTP request; no victim interaction is required. Active exploitation was first confirmed on September 4, 2026. Sansec published its initial analysis on September 5, and Adobe released hotfix VULN-39341 on September 7. Sansec observed Rust-based backdoors and persistence mechanisms on compromised stores. Adobe’s remediation guidance goes beyond applying the hotfix: it explicitly advises rotating the store encryption key plus every credential protected by that key — admin passwords, REST and GraphQL integration tokens, OAuth client secrets, payment gateway API credentials, database credentials, and SSH and deploy keys.
The three-day exploitation window before a vendor patch existed left affected Magento and Adobe Commerce operators without a routine patch-based mitigation. For many SME operators, Magento or Adobe Commerce is the only externally-facing application managing financial transaction data, customer PII, and payment gateway credentials simultaneously. An unauthenticated CVSS 10.0 RCE on this system can expose potentially sensitive store data and may enable attackers to alter application behaviour, steal credentials, or interfere with payment-related processes without modifying any customer-visible part of the storefront. The post-patch remediation requirement for full credential rotation distinguishes this incident from a standard patching exercise: patching alone is insufficient if compromise may already have occurred, and shops that applied the hotfix but did not follow the extended rotation guidance remain at risk.
E-commerce platforms are persistently high-value targets for financially motivated actors because they hold payment credentials, customer data, and direct revenue mechanisms in a single, often under-resourced operational environment. The StyleSmuggler disclosure reinforces that the time between a researcher’s discovery, attacker awareness, and the availability of a vendor patch is not always measured in weeks — the exploitation window was confirmed at three days before any patch existed. Organisations running self-hosted Magento or Adobe Commerce should treat the full Adobe remediation checklist — including credential rotation — as a mandatory response, not optional hardening.
Read more on: Sansec and Tenable
CVE-2026-75650 (StyleSmuggler) is a CVSS 10.0 unauthenticated RCE affecting all Adobe Commerce and Magento Open Source versions 2.4.4–2.4.9; active exploitation was first confirmed on September 4, Sansec published its initial analysis on September 5, and Adobe released hotfix VULN-39341 on September 7; Adobe’s remediation guidance requires rotating the encryption key and all credentials it protects, not only applying the hotfix.
4) MikroTrick: CERT Polska Discloses Chained RouterOS Flaws Giving Unauthenticated Attackers Full Administrative Control of 122,500 Exposed MikroTik Routers
On September 5, 2026, CERT Polska disclosed six vulnerabilities in MikroTik RouterOS, two of which form the attack chain named MikroTrick. CVE-2026-67276 is a flaw in how RouterOS validates RSA public keys during SSH authentication: RouterOS compares only part of an authorised public key, meaning an attacker who knows a valid username and the public modulus of its associated key can construct a different RSA key pair that RouterOS incorrectly accepts in place of the original. The attacker bypasses authentication without possessing the legitimate private key. CVE-2026-86060 is an argument-handling flaw in the SSH login path that can allow an unauthenticated session to alter RouterOS’s trusted policy mask and escalate privileges. Chained with CVE-2026-67276, it can give an attacker full administrative control of the device. MikroTrick therefore allows any attacker who can reach a RouterOS device’s SSH port from the internet to obtain full administrative control — modifying users, SSH keys, firewall rules, scripts, tunnels, and any other device configuration — without prior credentials or user interaction. MikroTik released patched builds (RouterOS 6.49.21, 7.23.4, and 7.24.2) on September 3, 2026, two days before CERT Polska’s public disclosure. Evidence indicates exploitation began at least from September 2 — the day before the patch was released. A scan conducted on September 5 found approximately 122,500 MikroTik devices with SSH directly exposed to the internet.
MikroTik RouterOS powers a substantial portion of internet-facing network infrastructure: ISP access routers, enterprise perimeter devices, SD-WAN concentrators, VPN gateways, and the backbone of many co-location and managed network service environments. A compromised router is not an end target — it is a pivot into every network segment behind it. Full administrative access via MikroTrick enables configuration of packet-forwarding rules, VPN credentials, firewall bypass, and persistent SSH backdoor accounts that survive device reboots. The indicator of compromise researchers have documented is the creation of an SSH user account with the name “-2” — a direct artefact of the username parsing flaw in CVE-2026-86060. The 122,500 figure from the September 5 scan represents devices with SSH internet-accessible at the time of disclosure; devices behind NAT or restricted to management VLANs are not in that count. CERT Polska published detection guidance and indicators; BleepingComputer and Help Net Security have confirmed active exploitation from multiple sources.
Network device firmware patching remains one of the most systematically neglected disciplines in enterprise and SME environments. Unlike operating system and browser updates — which increasingly apply automatically — router and switch firmware requires manual intervention into management interfaces that are often poorly monitored between incidents. MikroTrick illustrates what that gap looks like operationally: evidence of exploitation the day before the public patch, and over 122,500 devices still exposed at the moment of disclosure. Organisations running MikroTik RouterOS should immediately apply the September 3 patches (RouterOS 6.49.21, 7.23.4, or 7.24.2 depending on track), restrict SSH to dedicated management VLANs or VPN-gated management planes rather than direct internet exposure, audit user accounts on all RouterOS devices for unexpected entries — particularly the “-2” account name — and review configuration changes made since September 2 for unauthorised modifications. Network device patch management should carry the same priority and monitoring cadence as endpoint and server patching.
Read more on: BleepingComputer and Help Net Security
MikroTrick chains CVE-2026-67276 (SSH public-key authentication bypass) and CVE-2026-86060 (privilege escalation via crafted username) in MikroTik RouterOS to give unauthenticated attackers full administrative control; CERT Polska disclosed the chain on September 5, 2026, MikroTik patched it on September 3, and CERT Polska reported evidence indicating exploitation from at least September 2; approximately 122,500 devices had SSH internet-exposed at the time of disclosure.
5) BlueMoon: Four Espionage-Motivated Clusters Rapidly Adopt a Shared Chrome-and-Windows Exploit Kit
On September 9, 2026, Proofpoint published research disclosing BlueMoon — a previously undocumented exploit kit that chains two Chromium patch-gap vulnerabilities with a Windows local privilege-escalation zero-day to achieve full system compromise through a phishing link, with no user interaction beyond clicking. The chain opens with CVE-2026-85046, a type-confusion flaw in Chromium’s V8 JavaScript engine that enables remote code execution in the browser renderer. A second Chrome flaw, CVE-2026-87491 — an out-of-bounds bug in V8 that escapes the browser sandbox — executes immediately after. The third link is CVE-2026-85880, a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) that elevates the compromised renderer process to SYSTEM-level privileges — the same vulnerability addressed in Microsoft’s September 2026 Patch Tuesday. The first confirmed deployment of BlueMoon was attributed to the China-aligned APT31 (also tracked as TA412, Violet Typhoon, and JungleBamboo) on August 28, 2026, targeting NGOs, mining companies, and commodity trading firms in the United States via spear-phishing links that installed the GemStone credential-theft browser extension. Within seven days, three additional clusters — UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket — deployed the same kit against US aerospace companies, a Vietnamese manufacturing entity, and government and financial sector organisations in Indonesia and Singapore, dropping payloads including the ShadowPad backdoor and persistent DLL sideloading chains. CISA added all three CVEs to its Known Exploited Vulnerabilities catalogue with federal civilian agency remediation deadlines of September 18, 22, and 23, 2026, respectively.
The two Chromium vulnerabilities (CVE-2026-85046 and CVE-2026-87491) were exploited during a patch-gap window — fixes present in the Chromium source repository but not yet propagated to the stable release that most users run. CVE-2026-85880 was a Windows local privilege-escalation zero-day addressed in Microsoft’s September update. The exploit developer appears to have monitored public Chromium source commits specifically to identify this window and develop the exploits before the fixes reached the stable channel. Proofpoint identified features consistent with possible AI-assisted development in the kit’s construction — extensive internal logging, verbose code comments, and repeated references to Google’s v8CTF capture-the-flag research programme — but the evidence does not conclusively establish how the kit was created. The rapid use of the same kit by multiple clusters suggests that exploit-development and operational barriers may be falling. The available reporting does not establish the exact distribution mechanism.
The immediate mitigation is to update Chrome and all Chromium-based browsers to the September 8 stable release, and to apply the September Patch Tuesday update for CVE-2026-85880 if not already deployed. However, patching closes only the entry vector — it does not remove artefacts already installed. Proofpoint published a detailed indicator list: process trees beginning chrome.exe → cmd.exe → curl.exe; files ChromeUpdate.exe or msgbox.exe in the Windows %TEMP% folder; the directory C:\Users\Public\stomp_ext; scheduled tasks named EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, Avpcheckup, or GeForceService; a registry key at HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32. Detection rules (Signature IDs 2071919–2071924) are published. The structural signal in BlueMoon is not specifically about these four groups or these three CVEs — it is that a fully weaponised Chrome-and-Windows exploit chain was built, shared across multiple nation-state actors, and operationally deployed within a week. The development-to-deployment cycle for this class of offensive capability has shortened, and the assumption that such capabilities are rare, expensive, and tightly held by a small number of actors does not reflect what Proofpoint documented in this case.
Read more on: Proofpoint and The Hacker News
BlueMoon is a Proofpoint disclosure from September 9, 2026 describing four espionage-motivated clusters using a Chrome-and-Windows exploit kit. The first observed user was China-aligned TA412 (APT31); attribution for the remaining activity remains incomplete. The chain combines CVE-2026-85046, a Chromium V8 type-confusion flaw; CVE-2026-87491, a V8 sandbox escape; and CVE-2026-85880, a Windows ALPC local privilege-escalation zero-day.
If This Week’s Cybersecurity News Stories September 11, 2026 Tell Us Anything, It’s This:
Five different exposure layers were under active pressure this week, and none of them is a new category. Patch management has always been a core discipline — but 974 CVEs in a single month breaks the operating assumptions of most patch programmes, and two already-exploited zero-days in that release demonstrate that attackers are not waiting for organisations to work through the queue. Social engineering has always been a risk — but when a TTP is documented, addressed, and iterated upon by attackers faster than awareness programmes update, the gap between what training covers and what attacks use widens by design. Zero-day exploitation of widely deployed e-commerce platforms is not new — but a three-day exploitation window before a vendor patch arrived illustrates that the assumption of “patch when available” does not hold when the exploitation starts before availability. Network device management has always been a known gap in patch programmes — but 122,500 routers with internet-facing SSH and evidence of exploitation the day before the public patch, with a two-CVE chain that converts an SSH connection into full administrative control of every network segment behind the device, makes the gap specific and measurable. And browser zero-day exploit kits have always been treated as high-value, difficult-to-acquire capabilities — but when a three-CVE Chrome and Windows exploit chain is built, shared across four espionage-motivated clusters, and operationally deployed against targets on three continents within a single week, the assumed cost and exclusivity barrier for that class of capability is no longer what defensive assumptions have historically treated it as.
The common thread this week is not attacker sophistication. It is the gap between where an organisation’s security controls are pointed and where the actual exposure is occurring. Patch programmes pointed at managing 300 CVEs per month are insufficient against 974. Awareness training anchored to ClickFix does not address TerminalFix. Standard e-commerce hardening does not survive a three-day zero-day window. Router firmware update schedules that treat network devices as set-and-forget infrastructure do not reflect an attacker timeline where exploitation preceded the public patch by at least a day. Browser security policies that assume the latest stable browser release is safe do not account for the window between a Chromium source-code fix and its propagation to the stable channel — the exact window that BlueMoon was engineered to exploit. None of these gaps is a failure of intent. All of them are failures of assumption. Closing them requires not just updating controls, but revisiting the assumptions those controls were built on — and doing so at the pace the threat environment is moving, not the pace that feels organisationally comfortable.
For more information, please contact us now!
