Chrome zero-day forces emergency update for 3.6B users

Google issues emergency Chrome update for exploited zero-day CVE-2026-85046

Google has released an emergency security update for its Chrome browser after a zero-day vulnerability, tracked as CVE-2026-85046, was found to be actively exploited by hackers. The bug was reported by researcher Salvatore Gulizia, and the update for Windows, macOS, and Linux includes 12 security fixes. Google has withheld specific technical details to give users time to patch, stating only that an exploit exists in the wild.

The vulnerability can be triggered by tricking a user into visiting an HTML page containing malicious code, potentially allowing attackers to crash the system, execute malicious code, or steal sensitive data. With Chrome having approximately 3.6 billion users worldwide, the risk is significant. Google has advised all users to update their browser immediately via Settings > About Chrome, though no details have been shared about who is exploiting the flaw or how many victims have been affected.

Google issues emergency update for Chrome after unknown bug detected →

BigBear phishing service bypasses MFA at 258 organizations, steals 5,000 Microsoft 365 credentials

A phishing-as-a-service platform called BigBear 2.0 has successfully bypassed multi-factor authentication at 258 organizations and stolen more than 5,000 Microsoft 365 credentials, according to researchers at CloudSEK. The researchers gained administrator access to the service’s control panel and found it managed 42 VPS nodes, all configured to target Microsoft 365. The campaign uses an Evilginx2-based adversary-in-the-middle framework that intercepts passwords and authenticated session cookies, allowing attackers to hijack accounts even after victims complete MFA.

The panel exfiltrated 5,137 credential records, including 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies, affecting 3,331 unique victim IPs across more than 40 countries. The service was leased to at least five affiliate operators who received stolen credentials in real time via Telegram bots. BigBear uses custom JavaScript to interfere with FIDO2/WebAuthn authentication and geo-matched residential proxies for 69 countries to evade Microsoft’s detection systems. CloudSEK has notified law enforcement and affected organizations, and advises resetting exposed passwords, revoking active sessions, and enforcing phishing-resistant authentication methods.

BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations →

Magento StyleSmuggler zero-day exploited in the wild to deploy Linux backdoor

A zero-day vulnerability named StyleSmuggler affecting all versions of Magento and Adobe Commerce is being actively exploited to deploy a backdoor on Linux servers. The first exploitation incident was recorded on September 4 on a target running the latest security updates, according to e-commerce security firm Sansec. Adobe Enterprise Support has confirmed it is working on a fix but has not provided a timeline for its release. Magento is installed on more than 160,000 websites, including 14,000 of the top 1 million sites.

The exploit abuses Magento’s template system through PHP code injection to generate a fake failed-payment email that triggers code execution. Successful exploitation installs a small Rust-based backdoor disguised as a background process, with newer versions masquerading as fc-cache. The malware communicates with remote infrastructure using TLS/WebSockets or disguises its traffic as Network Time Protocol to evade firewalls. Sansec recommends monitoring for suspicious processes and cron entries, rotating Magento credentials if compromise is suspected, and disabling GraphQL as a temporary mitigation until Adobe’s scheduled September 8 security release.

Magento StyleSmuggler zero-day exploited to deploy Linux backdoor →

ConnectWise warns of unpatched ScreenConnect file transfer vulnerability

ConnectWise has issued a security advisory warning of a new ScreenConnect Remote Access vulnerability affecting file transfer behavior in Support and Access sessions. The flaw impacts both cloud and on-premises deployments and has not yet received a CVE ID. ConnectWise plans to release a permanent patch later this week, but has provided temporary mitigation steps for administrators to block potential attacks.

The recommended mitigation involves logging into the ScreenConnect Administration page and removing the TransferFiles permission from all user roles and session groups. Internet security watchdog Shadowserver currently tracks nearly 6,000 ScreenConnect instances exposed online. ScreenConnect vulnerabilities are frequently targeted by both financially-motivated and state-backed hacking groups, making prompt action essential for administrators using the platform.

ConnectWise warns of new ScreenConnect flaw without patch →

Cyber criminals use ASCII smuggling to evade filters in mass phishing campaigns

Microsoft has warned that cyber criminals are now using ASCII smuggling, a technique that leverages invisible Unicode characters, to supercharge phishing campaigns and evade email security filters. The technique embeds hidden tag characters from the Unicode Tags block (U+E0000 to U+E007F) inside common financial keywords, splitting them apart so that literal signature or keyword matches fail. For example, the word ‘funding’ becomes ‘fun⟨U+E0020⟩ding’ to the recipient, but still reads normally to humans and most parsing pipelines.

According to Microsoft, hits on a hunting signature designed to detect ASCII smuggling increased sharply on February 9 and stayed high on weekdays for the next three months. The campaign ran on hundreds of disposable, finance-themed sender domains with lures resembling business loan and advance-funding phishing patterns, accounting for roughly 96% of flagged volume. Emails were relayed through infrastructure associated with the legitimate email-marketing platform ActiveCampaign, which said it tested the technique and treats heavy use of invisible characters as a suspicious signal. Microsoft recommends stripping or normalizing Unicode tag characters from email content before applying spam filters, and applying the same normalization upstream of AI ingestion to reduce exposure to prompt injection attacks.

Cyber criminals are adapting ASCII smuggling for mass phishing campaigns →