Cybersecurity Brief – 2026-09-04

Fri, 04 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Data on approximately 8.8 million individuals was leaked following a ransomware incident involving Manchester Airports Group. The threat actor claims to have exfiltrated 550GB of data after the company reportedly refused to pay the ransom, with access gained via exposed admin keys ^[33].
Thomson Reuters disclosed that its C-Track court case management platform was breached in March 2026, potentially exposing Social Security numbers and sealed court data ^[9].
Coder’s Cloudflare infrastructure was compromised, enabling attackers to add unauthorized registry servers that distributed malicious Terraform modules containing credential-stealing code ^[12].
A French hospital, Hôpital privé de la Loire, was fined €500,000 by CNIL after a breach exposed data belonging to 727,000 patients and their relatives ^[11].
Over 440,000 exploit attempts have targeted critical remote code execution vulnerabilities in the WordPress plugins Super Forms and Elementor Pro, with attackers exploiting these flaws to deploy webshells and execute arbitrary commands on affected sites ^[2]^[17].
Researchers identified that free streaming boxes, specifically SuperBox devices, may be used to route criminal proxy traffic through users’ home networks via pre-installed apps ^[36].
StreamRat Android malware has infected an estimated 570,000 users through social media adverts on Meta and TikTok, enabling attackers to take control of compromised devices ^[37].
BraZetsu, a Python-based Windows malware framework, is being used to create an underground marketplace by turning compromised hosts into inventory for criminal access sales ^[8].

Newly Discovered Vulnerabilities

Google released updates to patch 12 vulnerabilities in Chrome, including a high-severity V8 zero-day (CVE-2026-85046) that has been actively exploited in the wild ^[4]^[10]^[32].
Cisco patched a critical flaw in Nexus 9000 switches running Silicon One, which could allow unauthenticated remote code execution as root ^[7].
HPE issued fixes for a critical remote code execution vulnerability in the ArubaOS-CX network operating system ^[13].
VMware Workstation and Fusion updates addressed critical vulnerabilities that could allow attackers with admin access to a VM to execute code on the host ^[31].
Plex released urgent updates to patch multiple undisclosed security flaws in Plex Media Server ^[3].
A 12-year-old PostgreSQL vulnerability (CVE-2026-6471, “PostGREShell”) was disclosed, allowing attackers with low-level replication access to achieve code execution, superuser privileges, and establish persistent backdoors ^[29].

Notable Threat Actor Activity

The Toy Ghouls group was found using new backdoors, one leveraging HiveMQ MQTT broker and another using the Matrix protocol for command and control ^[1].
The “Phantom Deal” campaign targets large enterprises with fake merger and acquisition scams, involving detailed reconnaissance to trick midlevel employees into authorizing large financial transfers ^[20].
ShinyHunters’ recent activities and claims of breaches remain under review, with ongoing discussion about their impact and legitimacy ^[21].

Trends, Tools, or Tactics of Interest

Attackers are increasingly exploiting OAuth and social engineering traps, such as phishing kits impersonating CEOs and IT staff, to compromise business accounts and bypass MFA ^[6]^[18].
AI-driven attack automation is accelerating breach timelines, with recent research showing that machine-speed agents can compress a two-week attack into ten hours ^[22].
Malicious actors are leveraging residential proxy networks via compromised consumer devices, expanding the footprint and persistence of criminal infrastructure ^[36].
Social media advertising is being used to distribute Android banking trojans at scale, as seen with StreamRat campaigns on Meta and TikTok ^[37].

Regulatory or Policy Developments Affecting the Security Industry

The French data protection regulator CNIL imposed a €500,000 fine on a hospital for inadequate data protection measures following a breach ^[11].

Sources

Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal - securityweek.com
Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data - thehackernews.com
Coder's registry infrastructure compromised to push malicious modules - bleepingcomputer.com
French hospital fined €500,000 after breach exposes data of 727,000 - bleepingcomputer.com
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws - thehackernews.com
Critical Elementor Pro flaw exploited to take over WordPress sites - bleepingcomputer.com
Free streaming boxes may be routing criminal traffic through your home - malwarebytes.com
StreamRat Android malware spreads through Meta and TikTok ads - malwarebytes.com
BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory - thehackernews.com
Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day - thehackernews.com
Google warns of new Chrome zero-day flaw exploited in attacks - bleepingcomputer.com
Google Patches 6th Chrome Zero-Day of 2026 - securityweek.com
Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root - thehackernews.com
HPE patches critical ArubaOS-CX remote code execution flaw - bleepingcomputer.com
VMware Workstation and Fusion Updates Patch Critical Vulnerability - securityweek.com
Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws - thehackernews.com
12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover - securityweek.com
Angry Birds: Toy Ghouls’ new toys - securelist.com
Large Enterprises Targeted in Fake Merger & Acquisition Scams - darkreading.com
What We Missed: Did ShinyHunters 'Breach' ReliaQuest? - darkreading.com
ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories - thehackernews.com
Your Employee’s Password Appeared in an Infostealer Log. Now What? - bleepingcomputer.com
AI 'Machine Speed' Cuts 2-Week Attack Down to 10 Hours - darkreading.com

Thomson Reuters on DanSec Daily

Cybersecurity Brief – 2026-09-04

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources