Microsoft patches record 974 flaws as two zero-days already exploited

Microsoft ships record 974 fixes, with two zero-days already exploited

Microsoft’s September Patch Tuesday release fixes 974 security flaws across its products, a new record, and two of them were already being exploited by attackers before the patches landed. Both zero-days let an attacker who already has a foothold on a Windows machine gain higher privileges: one sits in the Windows Update Stack (CVE-2026-81963) and the other in the Advanced Local Procedure Call component (CVE-2026-85880). There is no public detail yet on who is exploiting them or how widely. Dustin Childs of the Zero Day Initiative, who reviews every monthly release, called the total a new record and doubted attackers have hijacked the update mechanism itself; his more likely reading is that they pair the Update Stack bug with a code execution flaw, a combination that can spread malware or ransomware. His advice on both is to patch quickly.

Microsoft’s notes list 974 of its own CVEs and republish 25 more from other vendors, with Childs counting 972 new ones, or 997 when Chromium fixes are included. More than 110 are rated critical. The company fixed roughly 570 flaws in July’s record release and about 620 in August; by Ars Technica’s count it has now fixed 2,760 this year, more than double last year’s total. Childs singled out an Exchange Server flaw (CVE-2026-55007) where an attacker with no login could run code on a mail server by sending an email with a rigged Visio attachment, no opening required, plus a 9.8-rated Outlook desktop bug (CVE-2026-78509) triggerable through the Preview Pane. Twenty bugs were classed as wormable, sitting in core services including DHCP, DNS, Netlogon, Message Queuing and SMB.

Childs warned that AI-assisted vulnerability discovery shows no signs of slowing down, though he noted we have not yet seen a correlating spike in active exploits. The release lands just ahead of the EU’s Cyber Resilience Act, which from 11 September requires makers of software and connected products to report actively exploited vulnerabilities with an early warning within 24 hours of becoming aware, a fuller notice within 72 hours and a final report within 14 days of a fix. Actively exploited flaws like this month’s two zero-days are exactly the category the rule targets, and Microsoft’s next scheduled release on 13 October will be its first full cycle under it.

Microsoft patches a record 974 flaws, and two are already under attack →

CISA confirms ransomware gangs are exploiting WatchGuard Firebox flaw

CISA confirmed that ransomware gangs are exploiting a critical WatchGuard Firebox firewall vulnerability it flagged as actively exploited in December. The flaw, tracked as CVE-2025-14733, is an out-of-bounds write that allows unauthenticated attackers to execute malicious code remotely in low-complexity attacks. It affects firewalls running Fireware OS 11.x and later (including 11.12.4_Update1), 12.x or later (including 12.11.5), and 2025.1 through 2025.1.3. When WatchGuard released patches in December, it said unpatched Firebox firewalls are vulnerable only if configured to use IKEv2 VPN, but noted they might still be compromised even if the vulnerable configurations have been deleted if a branch office VPN to a static gateway peer is still configured.

WatchGuard confirmed attackers were exploiting the flaw in the wild and shared indicators of compromise to help customers check whether their Firebox devices had been hacked. Shadowserver found over 115,000 unpatched Firebox firewalls exposed online in December, and nearly 9,000 instances remain unsecured after nine months. In a Thursday update to its catalog of actively exploited vulnerabilities, CISA said CVE-2025-14733 is now known to be used by ransomware gangs but provided no further details about the attacks. CISA first added the flaw to its Known Exploited Vulnerabilities catalog in December, ordering U.S. federal agencies to secure their systems within a week under Binding Operational Directive 22-01.

The stakes are high given WatchGuard’s reach: the company provides services to more than 250,000 small and mid-sized companies through a network of more than 17,000 security resellers and service providers worldwide. The confirmation that ransomware crews are now using the flaw turns a months-old patch advisory into an active incident response problem for any organization still running vulnerable Firebox devices.

CISA: WatchGuard RCE flaw now exploited in ransomware attacks →

BlueMoon exploit kit chains Windows and Chrome zero-days in espionage campaigns

Multiple cyber-espionage groups deployed an exploit kit dubbed BlueMoon that leveraged zero-day vulnerabilities in Microsoft Windows and Google Chrome. BlueMoon combines two security issues in Chromium-based browsers that allow remote code execution and sandbox escape with a kernel local privilege escalation in Windows. The kit appears to be a shared modular tool that supports exploit additions and was used in distinct operations. Researchers at Proofpoint observed BlueMoon being used since August 28 in spearphishing operations attributed to the China-associated JungleBamboo threat actor, also known as APT31, Violet Typhoon or Tide Castle. Volexity also observed similar activity on September 1, in campaigns from another actor it tracks as UTA0560 that targeted customers at multiple non-governmental organizations.

The three flaws chained by BlueMoon are CVE-2026-85046, a type-confusion flaw in Chrome’s V8 JavaScript engine that provides arbitrary memory access inside the V8 sandbox; CVE-2026-87491, a V8 sandbox escape that corrupts WebAssembly metadata to run embedded shellcode; and CVE-2026-85880, a heap-based buffer overflow in Windows ALPC that allows local privilege escalation. Proofpoint says attackers exploited CVE-2026-85880 as a classic zero-day, suspecting it has been leveraged since 2025 and repackaged in BlueMoon, noting the LPE DLL compilation timestamp is from 2025 and did not appear to be forged. BlueMoon runs the exploit inside a Web Worker, retrying up to five times, fingerprints the system, elevates the Chrome renderer and injects into Chrome’s parent process to run an operator-selected command, defaulting to a curl-based download of a malware loader.

The reports from Volexity and Proofpoint identify four distinct activity clusters associated with BlueMoon deployments, three described as Chinese or China-aligned, targeting NGOs, U.S. aerospace and defense-industrial-base companies, and Vietnamese manufacturing firms. The kit’s maintainers take advantage of the delay between public Chromium fixes and stable Chrome releases, reverse-engineering public code changes to build exploits for downstream browser users. Proofpoint expects BlueMoon adoption and deployment to increase, potentially reaching financially motivated attackers in the future, and both companies shared indicators of compromise for files and network infrastructure so defenders can block the activity early.

New ‘BlueMoon’ kit exploited Windows and Chrome zero-day flaws →

Calif builds AI-assisted WeChat worm that spreads through unanswered calls

Researchers at Calif, a Palo Alto security company, built a worm that spreads through WeChat calls using AI. The worm takes over an account while the phone is still ringing, then uses that account to call the victim’s contacts and repeat the process. Tencent, which owns WeChat, confirmed the flaw and said it fixed it, adding it has no reason to believe any users were affected. Dustin Volz of The New York Times reported the attack on 8 September, and Calif published its own write-up the same day, naming the worm WeWorm and calling it the first zero-click worm to spread through WeChat calls on both iOS and Android. There are no reports of anyone using it in a real attack, and Calif has withheld the technical details.

The attacker must be on the victim’s friend list and then simply calls; the victim does not need to answer, and if they pick up they hear nothing while the exploit still works. Declining the call stops that attempt, but the attacker can try again later. A successful call gives full control of the account: the attacker can read and send messages, make calls and act as the owner. Calif says the flaw is a memory corruption bug in WeChat’s internet calling stack and identifies WeChat’s extra privileges for contacts as the weakness, writing that once one contact is compromised, that trust works against you. WeChat and Weixin had 1.439 billion combined monthly users on 30 June, according to Tencent’s second-quarter results, and for most of them the account holds payments, official accounts and mini programs.

Calif says its team, working with AI, found the bug and wrote the first exploit in about two days, with the worm taking one more week, though its own timeline runs longer: the team learned of the bug on 23 July, finished the first Android exploit on 30 July and had the demo worm ready on 11 August. Calif reported the bug on 24 July and says it then lost access to its own WeChat accounts from 25 to 28 July. Tencent shipped Android version 8.0.77 and iOS version 8.0.76 on 21 August, and Calif confirmed a server-side block for all users on 28 August. The Hacker News found no CVE identifier and no advisory on Tencent’s security response site, and Calif declined to say whether Tencent fixed the underlying flaw or only blocked the exploit. Calif briefed White House officials before going public, and the disclosure lands just ahead of the EU’s Cyber Resilience Act reporting duties that begin on 11 September.

Researchers used AI to build a WeChat worm that spreads through phone calls →

LG smart TVs found scanning home networks and recording audio in standby

Gamers Nexus, working with independent security researchers and Level1Techs, found that LG smart TVs scan local Wi-Fi networks to log the devices present, including phones, computers and smart-home devices such as thermostats, and collect the names of nearby Wi-Fi networks. The TVs also use automated content recognition to determine what users are watching so the data can be sold to advertisers, with the collected data sent to LG Ad Solutions, LG’s advertising business. Tests showed the TVs’ built-in microphones captured clean audio of nearby conversations and generated transcripts even when the TVs were in standby mode with the display powered down.

Recording continued when the TVs were disconnected from the internet, storing audio files locally and uploading them once the internet connection was restored. The data collection occurred even when the TV was disconnected and appeared to be off in standby mode. The researchers also found a vulnerability that allegedly allows a hacker to remotely execute code, withholding details to responsibly disclose their findings. The findings were published in a two-hour video report and picked up by cybersecurity outlets including Malwarebytes.

LG owners reacted angrily, including a post on the r/LGOLED subreddit stating that LG hardware is just spyware and that your TV is wiretapping your whole house. The report adds to a growing pattern of scrutiny over how connected televisions handle viewing data and always-on microphones, and it raises questions about what consumer devices retain and transmit even when users believe they are switched off.

LG TVs Caught Secretly Recording Users and Scanning Their Homes For Other Devices, Even When Disconnected From the Internet →