TLDR INFORMATION SECURITY 2026-09-10

CLEARFAKE WEBDAV INFECTION CHAIN DELIVERS AMATERA STEALER, ZIGCRYPTOSTEALER, AND NETSUPPORT MANAGER

Cisco Talos identified two WebDAV-based infection chains delivering the Amatera Stealer to facilitate untargeted credential and cryptocurrency theft. The initial chain executed a DLL named "verification.google" at a Ukrainian government organization. A parallel "pf.ch" chain used ClearFake JavaScript stored on the BNB Smart Chain, alongside a fake Google CAPTCHA ClickFix prompt, to task secondary payloads, including ZigCryptoStealer and NetSupport Manager.

ADOBE COMMERCE MAX-SEVERITY BUG COMES UNDER ACTIVE ATTACK

Threat actors are actively exploiting CVE-2026-75650, a max-severity unauthenticated code execution vulnerability dubbed StyleSmuggler, to compromise online stores running Adobe Commerce and Magento Open Source. Exploitation began on September 4, with the deployment of a Rust backdoor and a separate PHP web shell. Adobe released emergency hotfix VULN-393411 to address the flaw, prompting Sansec to warn that patching alone is insufficient for stores that may already be compromised.

SAP WARNS OF MAXIMUM SEVERITY OVERPASS KERNEL VULNERABILITY

German software company SAP has released an update that patches 20 security vulnerabilities. Of particular note is a maximum-severity buffer overflow vulnerability in the External Passport Protocol (EPP) processing library, which could allow an unprivileged attacker to run arbitrary commands as an administrator. Another missing authentication vulnerability in the SAP NetWeaver Message Server could allow unauthenticated attackers to execute malicious payloads and arbitrary commands across the full SAP system cluster.

GTIG AI THREAT TRACKER: FROM PROMPTING TO AUTONOMY – THE EVOLUTION OF ADVERSARIAL AI

Google's GTIG reports that threat actors have graduated from basic prompting to agentic AI workflows that autonomously manage scanning pipelines, resolve errors, and execute multi-stage attacks with minimal human oversight, compressing response windows from days to hours. For instance, groups like UNC6780 exploit the AI supply chain by stealing GitHub Actions tokens to sign malicious packages by tricking LLMs, state-sponsored groups use AI across the full attack lifecycle from reconnaissance to post-exploitation, and financially motivated actors built credential-harvesting agents that stole thousands of secrets in under six hours using only AI coding tools and markdown playbooks.

CVE-2026-82533: DEEPSEEK HARNESS VULNERABILITY LETS AI AGENTS ESCAPE THEIR OWN SANDBOX

CVE-2026-82533 affects DeepSeek Harness 0.1.1-rc.2 and earlier. Its local API trusted the client-controlled Host header instead of the peer address. Sandboxed sessions retained loopback access and could call that API to enable danger-full-access with approvals disabled. A single shell command escaped the sandbox on default settings. If port 3080 was forwarded or tunneled, unauthenticated remote attackers could control sessions and export stored conversations. DeepSeek fixed the issue in 0.1.2-alpha.1.

UNTRACKED NIGHTMARES: THE THREATS HIDING BEHIND COMMODITY INFRASTRUCTURE

Unit 42 traced two routine-looking adware infections to CL-CRI-1171, a pay-per-install operation that has run for two years behind a shared loader called OfferLoader, delivering payloads through 11 gaming-optimization YouTube channels and an SEO-poisoning funnel into corporate and government endpoints. The loader gates delivery on a Base64 click_id fingerprint of OS, browser, referrer, search keyword, and IP, so scanners and analysts get a decoy download page while real victims get the payload, which explains the near-zero public footprint despite 10,000+ loader samples and 200+ rotating domains. Defenders should stop triaging commodity loader alerts as low priority and pivot on loader C2 infrastructure instead, since a single OfferLoader run here spawned three unrelated campaigns including a cross-platform Insomnia RAT, a steganography-delivered WebSocket tunneler, and a Chrome Secure Preferences bypass.

AI security today. Get the guide

KONTEXT

Kontext puts local policy between AI agents and the tools they call. It observes supported actions, evaluates policy before consequential actions run, and records the decision and outcome in an authorization ledger.

CYMPHONY (PRODUCT LAUNCH)

Cymphony maps employee and machine identities, their system access, and sensitive data exposure. It detects risky permissions, investigates incidents, prioritizes fixes, and automates access corrections.

PRIVILEGED IDENTITY AND ACCESS IN MICROSOFT ENTRA

A collection of docs, resources, and samples for implementing secure, privileged IAM in Microsoft Azure and Entra.

IONQ COMPILES SHOR'S ATTACK ON SECP256K1 DOWN TO 19,397 IONS AND 26 DAYS PER ATTEMPT

IonQ published a blueprint estimating that 19,397 physical qubits and 1,457 logical qubits are required to break 256-bit elliptic-curve signatures and compromise dependent systems. The proposed attack uses the Walking Cat architecture to solve the secp256k1 discrete logarithm problem with about 39 million Toffoli gates over an estimated 25.7 days per attempt. IonQ describes this as the first fully compiled, fault-tolerant resource estimate for this attack and notes that the required machine does not currently exist and that the estimated scale aligns with its 2028 technology roadmap.

PRE-TASK RCE IN GOOGLE GEMINI CLI (CVE-2026-12537)

Novee researchers disclosed a CVSS 10.0 pre-task RCE in Gemini CLI where GEMINI_SANDBOX_PROXY_COMMAND in .gemini/.env reached a host shell via spawn(..., { shell: true }) before the sandbox even started,

exposing all parent process secrets (GITHUB_TOKEN, GEMINI_API_KEY) and bypassing four defensive layers. The same pre-task execution pattern appeared in Claude Code (execution before the trust dialog) and Codex (MCP auto-launch before the model), revealing a shared architectural blind spot: workspace configuration influences process authority before model-time guardrails activate. The exploit required no prompt injection—three lines in a configuration file were sufficient forno link

host-level code execution.

LG ACCUSED OF 'EGREGIOUS INVASION OF PRIVACY' OVER TV DATA COLLECTION

Gamers Nexus found LG TVs allegedly recording audio after voice features were enabled, including during standby. Tests reportedly uncovered plaintext transcripts, IP addresses, location data, nearby Wi‑Fi details, and local-device inventories. The team also alleged offline audio capture and a possible remote-code-execution flaw. LG denied ambient recording and said ACR advertising use requires opt-in consent.

HACKERS RETURN $263 MILLION STOLEN FROM LIQUID NETWORK

White-hat hackers drained ~$320 million from Liquid Network's federation wallet over the weekend.

FIRST 'TAKE IT DOWN ACT' SENTENCING PUTS MAN BEHIND BARS FOR 15 YEARS

Ohio man James Strahler received the first Take It Down Act conviction, with a 15-year sentence for distributing 3,000+ real and AI-generated child sexual abuse images and cyberstalking victims.