# Threat Intel Brief — September 9, 2026

TL;DR

  • Adobe Commerce/Magento zero-day (CVE-2026-75650) actively exploited since September 4 to deploy Rust backdoors and PHP web shells; CVSS 10.0 critical flaw affects all versions—patch immediately.
  • Microsoft September Patch Tuesday addresses 966 vulnerabilities including two actively exploited zero-days (CVE-2026-81963, CVE-2026-85880); unprecedented volume strains enterprise patch management.
  • N-able N-central RCE (CVE-2026-86218) exploited in the wild; fourth critical hotfix in five weeks for RMM platform—unauthenticated attackers can compromise MSP infrastructure.
  • MikroTik RouterOS exploit chain (CVE-2026-67276, CVE-2026-86060) enables full device takeover via SSH; 122,500 exposed devices at immediate risk.
  • BigBear 2.0 PhaaS bypassed MFA at 258 organizations, stealing 5,000+ Microsoft 365 credentials through adversary-in-the-middle attacks using geo-matched residential proxies.

---

Critical Threats

Adobe Commerce/Magento StyleSmuggler Zero-Day (CVE-2026-75650)

What happened:
Adobe patched CVE-2026-75650, a maximum-severity unauthenticated remote code execution vulnerability in Adobe Commerce and Magento Open Source. The flaw, dubbed "StyleSmuggler," has been actively exploited since September 4, 2026, to deploy Rust-based Linux backdoors and PHP web shells. Attackers exploit PHP code injection in Magento's template system—specifically the "Payment Transaction Failed Reminder" email generation process—to execute arbitrary code without authentication. The vulnerability affects all versions from 2.4.4 through 2.4.9 (2026-aug patches and earlier), impacting approximately 160,000 websites globally.

Impact:
With a CVSS score of 10.0, this represents the highest severity rating possible. Successful exploitation grants attackers full server control, enabling persistent backdoor access, data exfiltration, payment card theft, and web skimming operations. The Rust backdoor establishes command-and-control connectivity disguised as NTP traffic to evade detection. Exploitation attempts originated from China and Romania, with at least one managed server compromised within 50 minutes of initial disclosure. E-commerce organizations face immediate risk of customer data breaches and business disruption.

Recommendations:

  • Apply Adobe VULN-39341 hotfix immediately from repo.magento.com and rotate all encryption keys per vendor guidance
  • Disable GraphQL on all Magento instances as temporary mitigation if patching is delayed
  • Hunt for suspicious processes named 'kworker/u:8:0' or 'fc-cache' in ~/.cache/fontconfig/ and review cron jobs for unauthorized entries
  • Monitor firewall logs for unusual UDP traffic to port 123 (NTP) from web servers
  • Search web server logs for suspicious POST requests to email template endpoints since September 4

---

Microsoft September 2026 Patch Tuesday: 966 Flaws, Two Exploited Zero-Days

What happened:
Microsoft released security updates addressing 966 vulnerabilities in September 2026 Patch Tuesday, including two actively exploited zero-days: CVE-2026-81963 and CVE-2026-85880 (both privilege escalation flaws). Additional critical vulnerabilities include CVE-2026-69730 (DNS flaw affecting Windows Server 2012+ and Windows 10, flagged as likely to be exploited) and CVE-2026-69829 (Windows Shell RCE with CVSS 9.8, requiring no user interaction). This represents the largest single-month patch release in Microsoft's history.

Impact:
The two actively exploited zero-days enable privilege escalation, allowing attackers to elevate permissions on compromised systems. The DNS vulnerability (CVE-2026-69730) affects internet-facing Windows servers with low exploitation complexity. Organizations face unprecedented patch testing and deployment challenges—the sheer volume of fixes strains IT resources, particularly for enterprises requiring compatibility testing before production deployment. Security experts warn that attackers exploit vulnerabilities faster than defenders can patch at this scale.

Recommendations:

  • Deploy patches for CVE-2026-81963 and CVE-2026-85880 immediately on all Windows systems
  • Prioritize CVE-2026-69730 on Windows Server 2012+ and Windows 10 systems, especially internet-facing DNS servers
  • Test and deploy CVE-2026-69829 (Windows Shell RCE) on critical systems within 48 hours
  • Implement risk-based prioritization: focus on exploited and critical flaws affecting internet-facing assets before addressing the full vulnerability batch
  • Monitor askwoody.com and SANS ISC for reports of problematic patches before enterprise-wide deployment

---

N-able N-central RCE Exploited in the Wild (CVE-2026-86218)

What happened:
N-able released its fourth critical hotfix in five weeks for the N-central remote monitoring and management (RMM) platform, addressing CVE-2026-86218—an unauthenticated remote code execution vulnerability with CVSS 10.0. The flaw affects all on-premises builds below version 2026.3.1.14. Conflicting vendor statements indicate the vulnerability "has been observed being exploited in the wild" per independent researchers, though N-able's release notes state exploitation is "unconfirmed." Huntress reproduced a proof-of-concept exploit but could not confirm this specific CVE was used in a September 4 compromise due to log rotation.

Impact:
Unauthenticated attackers can achieve full server compromise without credentials. N-central is widely deployed by managed service providers (MSPs) with privileged access to customer endpoints—compromise enables lateral movement to all managed devices across multiple client environments. This is the fourth hotfix since August; previous flaws (CVE-2026-18577) were exploited to deploy Cloudflare tunnels for persistent access. Approximately 1,500 N-central instances are exposed online, primarily in the US and Europe. MSPs face supply chain attack risks affecting downstream customers.

Recommendations:

  • Upgrade all on-premises N-central servers to version 2026.3.1.14 (Hotfix 4) immediately
  • Restrict inbound access to N-central console using IP allowlisting or VPN; consider taking internet-facing servers offline until patched
  • Audit all N-central user accounts for unexpected or unauthorized accounts indicating prior compromise
  • Review N-central server logs and Take Control feature usage for anomalous activity between August 2 and patch deployment
  • Monitor managed endpoints for unauthorized Cloudflare tunnel services or similar persistence mechanisms

---

MikroTik RouterOS Exploit Chain Actively Hijacking Routers

What happened:
Attackers are actively exploiting a vulnerability chain in MikroTik RouterOS to hijack routers with SSH services exposed to the internet. Poland's CERT confirmed exploitation of CVE-2026-67276 (SSH authentication bypass) chained with CVE-2026-86060 (SSH privilege escalation), dubbed "MikroTrick," to achieve full administrative control. The vulnerabilities affect RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Approximately 122,500 MikroTik devices have exposed SSH interfaces as of September 5. A third vulnerability, CVE-2026-67277, allows unauthenticated kernel memory leaks or remote device crashes via the bandwidth-test service.

Impact:
Attackers gain complete device takeover, enabling configuration manipulation, credential theft, and network pivoting. MikroTik routers are widely deployed in critical infrastructure, SMBs, and ISPs globally. Compromised routers can serve as initial access points, command-and-control infrastructure, or botnet nodes. MikroTik has deployed compromise-detection mechanisms in patched versions, but absence of indicators does not guarantee device integrity. Confirmed attack infrastructure includes IP addresses 82.192.72.4 and 103.102.31.18.

Recommendations:

  • Immediately update MikroTik RouterOS to version 7.25beta3, 7.24.2, 7.23.4, or 6.49.21 released September 3
  • Restrict or disable SSH, WWW/WWW-SSL, and bandwidth-test services accessible from the internet until patching is complete
  • Search logs for IoCs: login failures for user '-2', user additions by 'ssh:-2@', and presence of unauthorized 'ops' accounts
  • Block inbound traffic from 82.192.72.4 and 103.102.31.18 at perimeter firewalls
  • If compromise is suspected, isolate the router, factory-reset, rebuild from trusted configuration, and rotate all passwords and SSH keys

---

Threat Actor Activity

BigBear 2.0 PhaaS Bypasses MFA at 258 Organizations

A phishing-as-a-service platform called BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations across 40+ countries, stealing 5,137 Microsoft 365 credentials including 474 complete MFA-bypassed authentications. The Evilginx2-based adversary-in-the-middle framework uses geo-matched residential proxies across 69 countries to evade Microsoft's location-based anomaly detection. BigBear employs custom JavaScript to disable FIDO2/WebAuthn browser functionality, forcing victims to weaker authentication methods. At least five affiliate operators have been identified. The administration panel remains online as of this report, though phishing infrastructure has been offline for three weeks.

Defensive actions: Deploy phishing-resistant FIDO2/WebAuthn hardware tokens and disable legacy MFA methods (SMS, voice, app-based OTP) via Entra ID authentication methods policy. Implement Conditional Access policies requiring managed/compliant devices. Audit Microsoft 365 sign-in logs for suspicious authentication patterns, particularly sessions from residential IP ranges or geo-mismatched locations.

Slim Spider Targets Brazilian Financial Infrastructure

CrowdStrike attributed attacks against Brazilian financial institutions to Slim Spider, a previously undocumented financially motivated threat actor active since at least March 2026. The adversary demonstrates deep operational knowledge of Brazil's instant payment system (Pix) and cryptocurrency custody infrastructure. Slim Spider deploys cloud-native attack techniques including custom Bash scripts to steal temporary credentials from cloud instance metadata, enumeration of secrets from credential managers, and deployment of backdoors mimicking legitimate infrastructure binaries. The group has stolen crypto custody secrets and executed unauthorized Pix transfers. Evidence from exposed C2 panels shows multiple compromised hosts across Brazil-based banks and fintech organizations.

Defensive actions: Monitor cloud instance metadata service access (169.254.169.254) for unusual queries. Enable comprehensive logging for cloud credential manager access and alert on bulk secret enumeration. Audit Azure DevOps pipeline execution for unauthorized modifications. Implement behavioral analytics for Pix transaction patterns to detect bulk unauthorized transfers.

Vishing Campaign Targets Microsoft 365 Executives

Threat hunters disclosed a widespread data theft and extortion campaign targeting Microsoft 365, SharePoint, OneDrive, Exchange, and Box SaaS platforms through IT help desk vishing, adversary-in-the-middle token theft, and residential proxy sign-ins. The campaign (tracked as PREY-0058 by Arctic Wolf, overlapping with Mandiant's UNC6671 and Cinder/Pink groups) primarily targets executive-level staff including directors and VPs in U.S. organizations across construction, engineering, healthcare, pharmaceuticals, real estate, finance, and professional services. Attackers gain full access to victim M365 environments through stolen session tokens, bypassing MFA, then exfiltrate data en masse and send extortion demands. No endpoint malware or lateral movement is required—attacks operate entirely in the cloud identity layer.

Defensive actions: Implement Conditional Access policies to restrict sign-ins from residential proxy services (NodeMaven) and anomalous geographic locations. Deploy phishing-resistant MFA (FIDO2/WebAuthn). Monitor Microsoft 365 Unified Audit Logs for SearchQueryPerformed events with bulk SharePoint/OneDrive access patterns. Train help desk staff and executives on vishing tactics; establish out-of-band verification procedures for IT support requests.

---

Geopolitical Context

Brazil's Emerging Cyber Threat Landscape

The emergence of Slim Spider and Breeze Comet targeting Brazil's Pix instant payment system represents an evolution in Latin American cybercrime from opportunistic retail fraud toward sophisticated infrastructure-level attacks. The targeting of cryptocurrency custody infrastructure and payment rails demonstrates maturation of regional threat actors with deep operational knowledge of local financial architecture. This shift may signal broader trends affecting emerging market payment systems across Latin America and Africa. Brazilian financial regulators may impose stricter cloud security requirements and custody controls, increasing compliance costs across the sector.

European Cybersecurity Coordination

Multiple advisories from Belgium's CERT.BE (SonicWall NSM, Adobe Commerce/Magento, MikroTik RouterOS) reflect routine national cybersecurity infrastructure activity within NATO and EU frameworks. Belgium's role hosting EU institutions and NATO headquarters elevates the strategic significance of these warnings. The advisories align with broader EU cybersecurity resilience efforts under the NIS2 Directive, which mandates enhanced security measures for critical and important entities. Coordinated response by EU member state CERTs may mitigate widespread exploitation, though legacy or poorly maintained installations will likely remain vulnerable.

U.S. State Government Infrastructure Vulnerabilities

ShinyHunters' alleged breach of Florida's DMV database (200,000+ driver records) highlights ongoing challenges in securing decentralized state and local government IT systems, which often lack federal-level resources and expertise. The incident may prompt renewed attention to cybersecurity standards for state DMV systems nationwide and fuel policy debates about mandatory breach notification, cybersecurity insurance requirements, and federal assistance programs for state-level cyber defense.

---

Recommended Actions

Immediate (0-24 hours)

1. Patch Adobe Commerce/Magento CVE-2026-75650 — Apply VULN-39341 hotfix and rotate encryption keys; disable GraphQL if patching is delayed
2. Deploy Microsoft zero-day patches — Prioritize CVE-2026-81963 and CVE-2026-85880 on all Windows systems
3. Upgrade N-able N-central — Update to version 2026.3.1.14 (Hotfix 4); restrict internet access to console
4. Patch MikroTik RouterOS — Update to 7.25beta3, 7.24.2, 7.23.4, or 6.49.21; restrict SSH/WWW services
5. Audit Microsoft 365 sign-ins — Hunt for BigBear 2.0 indicators: residential proxy IPs, geo-mismatched sessions, bulk SharePoint access

Within 24-72 hours

6. Deploy Microsoft critical patches — Test and deploy CVE-2026-69730 (DNS) and CVE-2026-69829 (Windows Shell RCE)
7. Implement phishing-resistant MFA — Deploy FIDO2/WebAuthn tokens; disable SMS/app-based OTP for Microsoft 365
8. Hunt for FreeIPA compromise — Audit for unexpected Kerberos principals and administrator group memberships (CVE-2026-76578, CVE-2026-76560, CVE-2026-79678)
9. Review Trezor/ShipMonk breach impact — If affected, warn users to ignore unsolicited requests for wallet credentials or recovery seeds
10. Patch ConnectWise ScreenConnect — Apply file transfer vulnerability patch when released; disable TransferFiles permission until then

Within one week

11. Audit cloud credential management — Review AWS Secrets Manager, Azure Key Vault access logs for bulk enumeration (Slim Spider TTPs)
12. Update WeChat clients — Upgrade to version 8.0.77 (Android) or 8.0.76 (iOS) to address zero-click account takeover vulnerability
13. Review ChatGPT connected apps — Switch from 'Important actions' to 'Always ask' mode for third-party app permissions
14. Patch Telerik UI for ASP.NET AJAX — Upgrade to version 2026.2.708 to address padding oracle RCE chain (CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184)
15. Conduct third-party risk assessment — Review data retention policies and audit compliance with contractual deletion requirements for logistics and analytics vendors

---

Watch List

  • F5 BIG-IP APM Linux rootkit — Attackers deploying fileless web shells via PHP file loading interception; hunt for memory-resident backdoors
  • DoppelCart fraud network — 119,000+ fake e-commerce domains conducting payment card theft; educate consumers on domain verification
  • Mathspace data breach — 1 million+ students, staff, and parents affected via compromised Metabase internal reporting system
  • Liquid Network Bitcoin sidechain — Attackers exploited Elements bug to steal 3,998 BTC; returned 3,400 BTC but retained ~$47M; network remains paused
  • PEEP browser backdoor toolkit — Chrome/Edge malicious extension (ID: ejkndncpkdcjcikfhiamcdehdoegilbj) enables post-compromise command execution; hunt for nm_host.exe and connections to xfjcc[.]fun
  • Autonomous AI agent credential harvesting — Financially motivated actors using multi-agent frameworks to compromise thousands of credentials in six hours; monitor for rapid-sequence vulnerability scanning with IP rotation

---

Sources

  • Adobe Security Bulletin (APSB)
  • BleepingComputer
  • CERT.BE (Belgium)
  • CrowdStrike Intelligence
  • Google Threat Intelligence Group
  • Huntress Labs
  • Krebs on Security
  • Microsoft Security Response Center (MSRC)
  • Poland CERT
  • Sansec Threat Research
  • The Hacker News

---

*This report synthesizes open-source threat intelligence from September 4-9, 2026. Organizations should validate findings against their specific environments and threat models. For technical indicators of compromise and detection rules, consult vendor advisories and MITRE ATT&CK mappings.*