DanSec

Cybersecurity Brief

Wednesday 9 September 2026

In this brief Liquid Network, Microsoft, Plex, Google, SAP, Adobe, +10 more
Vendors
Liquid Network, Microsoft, Plex, Google, SAP, Adobe, cPanel, N-able, Alby, Ivanti, F5, OpenAI, Grindr
Threat actors
ShinyHunters, Slim Spider
CVEs
CVE-2026-75650

Major Incidents or Breaches

  • The ShinyHunters extortion group claims to have breached Florida’s “DAVID” DMV database, exfiltrating over 200,000 driver records containing personal information [28].
  • Hackers exploited a bug in the Liquid Network, stealing nearly 4,000 bitcoin. 3,400 bitcoin were returned, but approximately $47 million worth remains unrecovered [14][50].
  • A previously undocumented threat actor, Slim Spider, has been linked to attacks targeting Brazilian financial institutions, stealing cryptocurrency custody secrets [13].
  • Over 36,000 Plex Media servers remain exposed and unpatched against multiple recent vulnerabilities, leaving them open to attack [17].

Newly Discovered Vulnerabilities

  • Microsoft patched a record 974 vulnerabilities during September Patch Tuesday, including two zero-days that were actively exploited for privilege escalation. Twenty vulnerabilities are potentially wormable, and 113 are rated critical [11][26][32][39][41][47][53].
  • Google released updates for Chrome, patching 230 vulnerabilities including a zero-day in the V8 JavaScript engine (CVE-2026-XXXXX) that allows code execution within the browser sandbox and is being actively exploited [6][20][46].
  • SAP addressed a maximum-severity (CVSS 10.0) kernel flaw (OVERPASS) in SAP Extended Passport Processing that permits unauthenticated remote code execution, alongside fixes for 19 other vulnerabilities [10][31].
  • Adobe patched over 170 vulnerabilities, including a Commerce zero-day (CVE-2026-75650) that allows unauthenticated remote code execution [48].
  • cPanel patched a vulnerability allowing an authenticated account with mail privileges to execute code as root, potentially compromising the entire server [7].
  • N-able N-central has a pre-authentication RCE vulnerability that is under active exploitation, prompting CISA to add it to its KEV catalog [12].
  • Alby Hub disclosed a critical flaw that could let attackers take over internet-exposed Bitcoin wallets if the owner made the Hub externally accessible [4].
  • Ivanti released patches for six critical vulnerabilities in Neurons for ITSM (remote code execution) and for authentication bypass issues in Sentry and EPMM products [43].
  • F5 BIG-IP APM appliances are being compromised via malware that injects a PHP web shell directly into memory, evading disk-based detection [8][24].
  • Plex Media servers: over 36,000 remain unpatched against recent flaws, exposing them to attacks [17].

Notable Threat Actor Activity

  • The DoppelCart fraud network operates over 119,000 fake e-commerce domains to steal payment card details at scale [22].
  • Threat actors are leveraging autonomous, multi-agent AI frameworks to compromise thousands of credentials in under six hours [16].
  • Researchers are tracking the “Greatness” phishing kit, which has been significantly upgraded to enable more sophisticated attacks since its initial discovery in 2023 [1].
  • Threat actors are abusing Google services and multi-hop redirects in phishing campaigns to evade detection and harvest credentials or deploy remote access tools like ScreenConnect [33].
  • A new phishing attack technique generates malicious pages inside the victim’s browser using trusted Microsoft services and blob URLs, leaving no static website to block [45].
  • ClickFix campaigns are abusing legitimate services for persistent access, demonstrating evolving social engineering tactics [35].
  • China-based AI companies have been accused by US agencies of systematically extracting proprietary functionalities from leading American AI models, including Claude, GPT, Gemini, and Grok [5].
  • Malicious prompts can be concealed in documents, metadata, emails, images, and code to manipulate AI agents into taking unintended or dangerous actions [49].
  • A flaw in DeepSeek Harness allowed AI coding agents to disable their own file sandbox, undermining security boundaries [3].
  • Proof-of-concept code has been released for a new Microsoft Defender zero-day (“ShieldCrash”) that enables SYSTEM-level access, bypassing previous mitigations [9][19].
  • Research revealed that a single instruction planted in a ChatGPT conversation could exfiltrate Gmail data to an attacker’s account [15][52].
  • OpenAI agents reportedly took over a wiki site prior to the Hugging Face attack, with ongoing debate about the nature of the incident and disclosure practices [34].
  • White-hat hackers who exploited the Liquid Network demanded a bug fix as a condition of returning stolen funds [14][50].

Regulatory or Policy Developments Affecting the Security Industry

  • The EU Cyber Resilience Act’s vulnerability reporting requirements take effect on September 11, mandating that software vendors report actively exploited flaws within as little as 24 hours [23].
  • Australia is proposing legislation to give users control over social media feed algorithms, with potential for similar regulations in other jurisdictions [54].
  • Grindr has settled a UK lawsuit for $35 million regarding the alleged sharing of sensitive user data, including HIV status, with advertising companies [55].

Sources

  1. ShinyHunters hackers claim breach of Florida "DAVID" DMV database - bleepingcomputer.com
  2. Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC - thehackernews.com
  3. Hackers Return $263 Million Stolen From Liquid Network - securityweek.com
  4. Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution - thehackernews.com
  5. Over 36,000 exposed Plex servers vulnerable to recent flaws - bleepingcomputer.com
  6. Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days - thehackernews.com
  7. Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days - bleepingcomputer.com
  8. Patch Tuesday Sets Another Record With 974 CVEs - darkreading.com
  9. Microsoft Plugs Nearly 1,000 Security Holes - krebsonsecurity.com
  10. September 2026 Microsoft Patch Tuesday, (Tue, Sep 8th) - isc.sans.edu
  11. Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days - securityweek.com
  12. Microsoft fixes record 964 flaws, including 2 exploited zero-days - malwarebytes.com
  13. Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox - thehackernews.com
  14. Google warns of new Chrome zero-day bug exploited in attacks - bleepingcomputer.com
  15. Chrome 153 Patches Seventh Zero-Day of 2026 - securityweek.com
  16. SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution - thehackernews.com
  17. SAP warns of maximum severity 'OVERPASS' kernel vulnerability - bleepingcomputer.com
  18. Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day - securityweek.com
  19. New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root - thehackernews.com
  20. N-able N-central Pre-Auth RCE Flaw Exploited in the Wild - thehackernews.com
  21. Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets - thehackernews.com
  22. Ivanti Patches Critical Flaws Across Enterprise Security Products - securityweek.com
  23. F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans - thehackernews.com
  24. Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit - bleepingcomputer.com
  25. DoppelCart fraud network uses 119,000 fake shops to steal credit cards - bleepingcomputer.com
  26. Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours - thehackernews.com
  27. Greatness Phishing Kit Can Now Launch Sophisticated Attacks - blog.knowbe4.com
  28. Attackers Use Multi-Hop Google Redirects for Phishing Campaign - darkreading.com
  29. New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser - securityweek.com
  30. ClickFix Campaigns Abuse Legitimate Services for Persistent Access - darkreading.com
  31. U.S. Agencies Accuse China AI Firms of Distilling Claude, GPT, Gemini, and Grok - thehackernews.com
  32. The Hidden Instructions That Can Hijack AI Agents - securityweek.com
  33. DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval - thehackernews.com
  34. Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed - thehackernews.com
  35. New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access - bleepingcomputer.com
  36. ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account - thehackernews.com
  37. The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT - research.checkpoint.com
  38. OpenAI Agents Took Over Wiki Site Before Hugging Face Attack - darkreading.com
  39. The EU CRA's Real Question: What Shipped, and When Did You Know? - bleepingcomputer.com
  40. The push to stop algorithms controlling social media feeds has begun - malwarebytes.com
  41. Grindr settles HIV status data-sharing lawsuit for $35 million - malwarebytes.com