This week’s roundup covers a massive Microsoft Patch Tuesday with two exploited zero-days, active FortiGate exploitation, a critical PAN-OS root-level RCE flaw, the Revolut KYC data breach, and more than 20 other stories spanning AI-driven cyberattacks, browser and firewall zero-days, and enterprise breach disclosures.

Massive Microsoft Patch Tuesday September 2026

Microsoft’s September 2026 Patch Tuesday addressed a staggering 973 vulnerabilities, spanning Windows, Office, SQL Server, Exchange, SharePoint, Azure, and developer tools. Elevation of privilege flaws dominated the release at 438 issues, followed by 258 remote code execution bugs, with Windows Biometric Service alone accounting for 64 separate vulnerabilities, suggesting a systemic weakness in the authentication subsystem.

Two zero-days were confirmed under active exploitation: CVE-2026-85880 in Windows ALPC and CVE-2026-81963 in the Windows Update Stack, both elevation-of-privilege bugs rated Important. Critical fixes also landed for Windows Secure Kernel Mode, VBS Enclave, and Excel/Word RCE flaws, making this one of the largest and most urgent patch cycles of the year for enterprise IT teams.

FortiGate Firewalls Exploited to Deploy Custom Malware

SOCRadar researchers uncovered an active campaign exploiting CVE-2025-25249, a critical 9.8-rated heap overflow in FortiOS and FortiSwitchManager’s CAPWAP service, to deploy a custom Node.js RAT called PivotC2. The malware opens outbound TLS connections to bypass firewall restrictions, harvests device configurations, and decrypts stored VPN and SSL-VPN credentials using AES routines.

Attackers scanned over 30,000 FortiGate IPs and compromised 178 devices, with confirmed intrusions against U.S. organizations involving Exchange mailbox exfiltration to Wasabi cloud storage. Researchers assess with high confidence that a Russian-speaking, financially motivated group is behind the campaign, which also targets FortiManager and ArubaOS flaws. Organizations should upgrade to FortiOS 7.6.4/7.4.9/7.2.12/7.0.18 or later immediately.

FortiOS and FortiProxy ZTNA Validation Vulnerability

Fortinet disclosed CVE-2026-84393, a high-severity certificate validation flaw (CVSS 7.3) in the Agentless ZTNA portal of FortiOS and FortiProxy that lets an unauthenticated attacker perform man-in-the-middle interception between the ZTNA portal and backend destinations. The flaw stems from improper certificate validation (CWE-295) and can expose session details or application content without credentials.

Affected releases include FortiOS 7.6.1–7.6.6 and FortiProxy 7.6.2–7.6.6, while other branches remain unaffected. There is no evidence of in-the-wild exploitation yet, but since ZTNA portals are typically internet-facing, Fortinet urges immediate upgrades to version 7.6.7 or later.

Palo Alto PAN-OS Vulnerability Enables Arbitrary Code Execution as Root User

Palo Alto Networks disclosed CVE-2026-0310, a buffer overflow (CWE-787) in PAN-OS XML processing that could let an unauthenticated attacker achieve root-level code execution on PA-Series hardware firewalls. The flaw carries a CVSS-B score of 9.2, though exploitation complexity is rated high; VM-Series firewalls face only a denial-of-service impact instead.

Affected versions span multiple branches below 12.2.3, 12.1.10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10. No workaround exists, so Palo Alto recommends restricting management interface access to trusted networks and upgrading immediately. The vendor found the bug internally and reports no known exploitation as of September 9, 2026.

LG Smart TVs Caught Scanning Networks

An investigation by Gamers Nexus, Level1Techs, and independent researchers found that LG OLED TVs, including the flagship G5, continue scanning home networks and capturing microphone audio even in standby mode, then upload cached data once reconnected. Packet captures showed the sets mapping neighboring Wi-Fi networks, discovering unrelated devices, and locally transcribing spoken audio into text logs despite LG’s public claims it does not record ambient conversations.

The behavior extends beyond homes: automatic content recognition (ACR) keeps operating even when TVs are used as passive HDMI monitors, raising concerns for hospitals, hotels, and corporate boardrooms. LG Ad Solutions has scaled this data pipeline to roughly 33 million opted-in U.S. displays. Researchers recommend disconnecting smart TVs from Wi-Fi and routing streaming through external devices instead.

Switzerland Moves Away From Microsoft 365

Switzerland’s Federal Council is piloting a sovereign, open-source digital workplace to reduce long-term dependence on Microsoft 365 for critical government functions. Following a feasibility study (PoC BOSS) involving 172 participants, the Federal Chancellery will roll out a browser-based platform offering email, calendars, document editing, and conferencing to roughly 3,000 employees by the end of 2027, at an initial cost of about CHF 9 million.

The initiative is framed as digital sovereignty and resilience rather than an outright Microsoft 365 replacement, operating as a parallel option during outages or geopolitical disruptions. The study found large video conferencing to be a technical limitation, and a broader rollout decision will depend on results from the 2027 pilot.

12-Year-Old PostgreSQL Flaw

Cyera Research disclosed CVE-2026-6471, nicknamed “PostGREShell,” a 12-year-old flaw dating to PostgreSQL 9.4 in 2014 that allows low-privileged accounts with the REPLICATION attribute to abuse logical decoding and force PostgreSQL to load an attacker-controlled shared library, achieving code execution with server process permissions.

Because replication accounts are commonly used for backups and disaster recovery, this flaw turns a seemingly low-risk credential into a path for full database compromise. Patches are available in PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24. Administrators should audit REPLICATION-privileged accounts, tighten pg_hba.conf rules, and monitor for suspicious replication slot creation.

Revolut Data Breach Exposes Customers’ Passport Copies

Revolut disclosed that sensitive KYC documentation and financial records for a limited number of customers were exposed after the fintech received a fraudulent data request that impersonated a legitimate government agency using an unauthorized email account operating under an official domain. Exposed data included passport and driver’s license copies, identity-verification selfies, full transaction histories including Bitcoin activity, IBANs, and personal contact details.

Revolut maintains its core systems and customer accounts were not compromised, describing the incident as sophisticated social engineering rather than a technical breach. On-chain investigators like ZachXBT flagged concerns that high-net-worth users were specifically targeted, facing elevated risks of phishing, SIM-swapping, and crypto theft. The episode underscores that domain-authenticated email is not proof of a legitimate sender.

Windows Remote Desktop Client Vulnerability

Microsoft patched CVE-2026-69485, an Important-rated RCE flaw (CVSS 8.8) in the Windows Remote Desktop Client caused by use of an uninitialized resource. An authenticated attacker with low privileges can send a specially crafted network request to execute code without requiring user interaction.

The flaw affects Windows Server 2016 through 2025 and Windows 10/11 client editions across multiple builds. Microsoft rates exploitation as “less likely” and has not observed it in the wild, but recommends deploying the September KB updates immediately and restricting RDP exposure to trusted networks.

Hackers Use Claude AI Agents to Automate Cyberattacks

Anthropic’s Threat Intelligence team disclosed how state-sponsored groups and cybercriminals weaponized Claude AI to automate entire attack chains between December 2025 and August 2026. A Russian state-linked group tracked as GTG-20006 (aligned with Midnight Blizzard) used Claude to autonomously rewrite malware upon detection, hijack hotel Wi-Fi for DNS-based lures, and steal over 300,000 national ID records from a North African government.

A separate cluster affiliated with ShinyHunters used Claude to scale credential-harvesting across ten cloud workers, decompiling 1.8 million Android apps for hardcoded secrets, while a suspected Chinese “exploit foundry” (GTG-10007) surfaced over a dozen candidate zero-days in a single month using parallel AI agent swarms. Anthropic says lone actors can now sustain multi-victim campaigns that once required specialist teams, effectively democratizing sophisticated cyberattack capability.

FortiSandbox Vulnerability Allows Attackers to Access Sensitive Data

Fortinet disclosed CVE-2026-26084 (CVSS 8.9), an improper access control flaw (CWE-284) in the FortiSandbox web UI that lets unauthenticated attackers craft HTTP requests to bypass authentication and extract sensitive data including configuration details and logs. The bug affects FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS.

Fortinet’s own Product Security team found the issue internally, with no evidence of in-the-wild exploitation. Affected versions include FortiSandbox 5.0.0–5.0.5 and 4.4.0–4.4.8, along with certain Cloud and PaaS builds; FortiSandbox 5.2 is unaffected. Organizations should upgrade to 5.0.6, 4.4.9, or later as appropriate.

ShinyHunters Gained Access to 6 Million Customers’

A single vishing phone call in February 2026 let ShinyHunters breach Dutch telecom Odido and subsidiary Ben, exposing personal records of roughly 6.39 million customers. A Dutch-speaking caller impersonated an IT colleague to a helpdesk employee, capturing a username, password, and MFA token, then pivoted into Odido’s Salesforce CRM to exfiltrate 90 GB of data across 15 million rows via legitimate APIs.

Stolen data included full names, addresses, IBANs, and identification document numbers. ShinyHunters demanded roughly €1 million; Odido refused, and the data was published in stages by March 1. Dutch police broadcast the suspected caller’s voice recording on national TV in September 2026 after he ignored appeals to come forward, and the case has been linked to identical vishing tactics used against 100+ organizations including SoundCloud and Betterment.

Hackers Actively Exploiting Magento and Adobe Commerce 0-Day RCE Vulnerability

Dutch security firm Sansec disclosed “StyleSmuggler,” an unauthenticated zero-day affecting every current version of Magento Open Source and Adobe Commerce, including 2.4.9, with no official patch available as of publication. Attackers plant malicious PHP inside files Magento writes during normal operation, then trigger execution via the platform’s own “Payment Transaction Failed Reminder” email template, requiring no victim interaction.

The dropper installs a Rust-based implant disguised as a Linux kernel thread that evades detection and, in one case, read live session data through 28 simultaneous Redis connections rather than making outbound network calls. Store owners are advised to disable GraphQL where not needed, apply unofficial hardening patches from researchers, and disable PHP’s proc_open function as stopgap defenses.

WeWorm — First 0-Click Worm

Security firm Calif demonstrated “WeWorm,” a proof-of-concept zero-click worm exploiting a memory-corruption bug in WeChat’s VoIP stack to compromise a target’s account within seconds of a call, without the victim ever answering. The demo used three phones to prove cross-platform propagation between iOS and Android, with each compromised device automatically calling and infecting the next.

WeChat serves over 1.4 billion monthly active users, making the wormable flaw especially significant. Exploitation grants full control of the victim’s WeChat account, including messaging and calling capability, and Calif says it could potentially chain to full device takeover. Tencent has since mitigated the exploit after being notified in July, though full technical details remain withheld pending a conference presentation.

Hackers Exploiting MikroTik RouterOS Vulnerability

MikroTik confirmed on September 3, 2026 a serious unauthenticated remote access flaw in RouterOS tied to SSH, granting attackers direct shell access to internet-exposed devices regardless of authentication method. Latvia’s national CERT corroborated a spike in exploitation activity, and one administrator reported an unauthorized “ops” account created on a compromised router within days of disclosure.

Fixes shipped across every release channel, including 7.25 beta 3, 7.24.2 stable, 7.23.4 long-term, and 6.49.21 long-term. RouterOS now includes a built-in “Flagged” detection status for tampered configurations after upgrade. Administrators are urged to patch immediately, audit all devices regardless of flagged status, and restrict SSH access to trusted networks.

Hackers Chain Chrome and Windows Zero-Days

Proofpoint identified “BlueMoon,” an exploit kit chaining a Chromium V8 type-confusion flaw (CVE-2026-85046), a V8 sandbox escape, and the Windows ALPC privilege escalation bug (CVE-2026-85880) to deploy backdoors against government and defense targets. At least four threat clusters, mostly China-linked including TA412/Violet Typhoon, adopted the kit within days of its first confirmed use on August 28, 2026.

Both Chrome vulnerabilities were “patch-gap” zero-days, exploiting the roughly four-week window between public Chromium fixes and stable browser rollout. TA412 used a fake “Google Gemini” browser extension for keylogging and cookie theft, while other clusters deployed ShadowPad and Rust-based loaders against aerospace and Southeast Asian government targets. Researchers flagged signs of AI-assisted exploit development throughout the kit’s code.

Critical Check Point VPN Vulnerabilities

Check Point patched two critical VPN flaws, CVE-2026-85102 and CVE-2026-85103, both scoring a maximum 9.8 CVSS and enabling unauthenticated RCE. The first stems from improper certificate trust validation during VPN negotiation affecting Remote Access and Site-to-Site VPN; the second is a heap-based buffer overflow triggered while parsing ASN.1 certificate structures on Quantum Security Gateway and Management systems.

Affected branches include R81.20, R82, and R82.10 below patched Jumbo Hotfix Takes, while R82.20 is unaffected. Check Point found no evidence of active exploitation or public PoC. Live Patch customers are protected automatically; others must manually apply Jumbo Hotfix Take 44+ (R82.10), Take 126+ (R82), or Take 166+ (R81.20) immediately.

Hackers Abuse Trusted Google Services to Hide Credential-Stealing Phishing

KnowBe4 Threat Lab identified a widespread phishing campaign routing victims through legitimate Google services, including Meet, Search, DoubleClick, Custom Search, Tag Manager, and Analytics, before landing on credential-harvesting pages or a fake verification flow that installs ScreenConnect remote-access software. The campaign targets manufacturing, government, finance, and non-profit staff using workplace-themed lures.

The kit hides victim emails after the # symbol in URLs to evade server logging, performs bot-detection checks, and personalizes phishing pages with the target’s company logo and background screenshot. After capturing a password, it deliberately shows a fake “invalid password” error to harvest a second credential set before redirecting victims to the real company site. Organizations should reset exposed credentials and hunt for unauthorized ScreenConnect installs.

Windows Defender ShieldCrash 0-Day

Researcher MSNightmare published a proof-of-concept called “ShieldCrash,” claiming Microsoft Defender remains vulnerable to arbitrary file reads with SYSTEM-level privileges even after Microsoft’s fix for the earlier “ShieldBreak” flaw (CVE-2026-69414). The bypass allegedly works on fully patched, supported Windows systems following the September 2026 updates.

Because SYSTEM has broad permissions, successful exploitation could expose credential material, private keys, or other users’ protected files, though it does not itself enable code execution. Microsoft has not confirmed the bypass, which remains a researcher claim pending independent reproduction. Defenders should monitor for suspicious local tools interacting with Defender scanning paths and unexpected DLL loads.

Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day

Google shipped Chrome 153 (153.0.8010.36/.37) to stable channels, fixing 230 security issues including CVE-2026-87491, a Medium-severity V8 out-of-bounds write zero-day already exploited in the wild. The release also closes five Critical-rated bugs in WebGL and Cast components and 43 High-severity flaws across ANGLE, PDFium, and Web Authentication modules.

Notably, external researchers including OpenAI’s Codex Security team used AI-assisted tools to flag several high-severity issues, reflecting growing automation in vulnerability discovery. Given the confirmed active exploitation, users and enterprises should update to build 153.0.8010.36 or later without delay.

Remote Desktop Services Failures on Windows Servers

Administrators worldwide reported Remote Desktop Services freezing on Windows Server 2019, 2022, and 2025 following the September 2026 cumulative updates (KB5122876, KB5122882, KB5122871). Session hosts run normally for hours before hanging when a user session disconnects, generating Event ID 20498 and causing Task Manager and Settings to become unresponsive.

Kernel-level debugging points to a deadlock in the RDP server base library’s WDLIB_Close routine during session teardown, requiring a hard reset to recover. Because the same update patches the actively exploited CVE-2026-81963 and CVE-2026-85880 zero-days plus a critical 9.8-rated RDS RCE flaw, organizations face a difficult tradeoff between stability and security, with unofficial registry-based workarounds circulating pending an official Microsoft fix.

This week’s stories reveal a clear pattern: perimeter security appliances (Fortinet, Palo Alto, Check Point, MikroTik) remain prime targets for both nation-state and financially motivated actors, while AI tooling is now accelerating exploit development and malware evasion across the board.

Combined with Microsoft’s record-breaking 973-CVE patch cycle and multiple actively exploited zero-days, security teams should prioritize patch validation, credential rotation after social-engineering incidents like Revolut and Odido, and hardened verification procedures for high-risk data requests.

The post Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories appeared first on Cyber Security News.