The most uncomfortable story this week is not that someone found a new hole in Chrome. It's that the hole had already been fixed, in public, and the fix hadn't reached you yet.
Chrome is built on Chromium, which is open source. When a security bug gets fixed there, the fix lands in public code before it ships to the browser on your machine. For two Chrome flaws used in attacks this month, Volexity found that the patches had gone into Chromium but had not yet made it into a stable release of Chrome. For anyone reading the public commits, they were known bugs with known fixes. For everyone running Chrome, they were zero-days. That window is called a patch gap, and at least two Chinese state-linked groups spent it attacking non-governmental organisations.
The rest of the week ran along a similar seam: things that were supposed to be checked, and weren't. AI coding assistants that pin a plugin to an exact reviewed version and then never verify they got it. Two Cisco products under active attack at once. And a reminder, at the end, that the fastest attacker anyone caught this week was a person.
What to act on#
Update Chrome, and update Windows#
The attack chain, which Volexity calls BlueMoon, uses three flaws: CVE-2026-85046 to get read and write access inside Chrome's V8 sandbox, CVE-2026-87491 to escape the browser sandbox, and CVE-2026-85880 in Windows to run code. That last one is the Windows ALPC flaw from last week's roundup, where we knew it was being exploited but not what for. Now we know.
All three are patched. The delivery was a spear-phishing email linking to a real US university website with a cross-site scripting flaw, which bounced targets to the attacker's exploit page. The page checked you were on Chrome on Windows before firing. One group, tracked as UTA0560, installed a backdoor called GRIMWEDGE. A second, APT31, used the same chain to install a credential-stealing Chrome extension disguised as a Google Gemini extension.
What to do: open Chrome's menu, go to Help, then About Google Chrome, and let it update and restart. Then install your Windows updates. Google has now moved Chrome from a four-week to a two-week release cycle, which shortens this gap in future. If you want a broader look at browser choices, our guide to private and secure browsers covers the trade-offs.
Who's exposed: this specific campaign targeted NGOs, so you were almost certainly not a target. Update anyway. The chain is documented now, and documented chains get reused.
Delete this Twitch extension if you have it#
A browser extension called "Twitch Enhanced Viewer | JeetBot" has been leaking Twitch OAuth tokens from nearly 31,000 users to proxy servers run by a Russian commercial bot service. An OAuth token is the thing that keeps you logged in, so whoever holds it does not need your password or your two-factor code. It was published to the Chrome Web Store in June 2025 and to Firefox Add-ons in July 2025, and both listings were reported as still live.
What to do: remove it. Then go to Twitch, open Settings, Connections, and disconnect anything you do not recognise, which revokes tokens that have already been taken.
Who's exposed: only people who installed this specific extension. That said, this is the second extension story in one week, so it's worth a general look at what you've accumulated in your browser.
Change your Gyazo password, and anywhere you reused it#
Gyazo, the screenshot-sharing tool, disclosed a breach of about 23.62 million user records including email addresses and password hashes. Separately, about 490 million image metadata records were exposed, mostly from January 2019 or earlier, and those included the IDs that make up Gyazo image links. Owner Helpfeel said those IDs could be used to view images without permission and has temporarily disabled viewing for some of them.
That second part is the one people underestimate. If you ever used Gyazo to share a screenshot of something private, a document, a bank page, a private message, treat that image as potentially visible.
What to do: change your Gyazo password, and change it anywhere you used the same one. If that sentence made you wince, our password guide covers getting off reused passwords properly.
Who's exposed: anyone with a Gyazo account, particularly long-standing ones.
Pixel owners: install the September update#
Google patched a flaw in the Pixel cellular modem, CVE-2026-58704, rated 8.0, and said it "may be under limited, targeted exploitation." It needs no interaction from you and works from nearby rather than across the internet. Google fixed 109 other flaws in the same round.
Who's exposed: Pixel owners. "Limited, targeted" usually means journalists, activists and officials rather than the general public, but the update is free and takes a minute.
The week's biggest#
Two Cisco products came under attack at the same time#
Cisco disclosed a maximum-severity zero-day in Identity Services Engine, CVE-2026-76460, scored 10.0 and already being exploited. It is an authentication bypass caused by an API endpoint that did not check credentials properly, and it affects ISE and ISE-PIC regardless of configuration. ISE is the system that decides which devices are allowed onto a corporate network, so bypassing its login is close to the worst case.
Days earlier, Cisco warned that Secure Email Gateway was under active attack through CVE-2026-76461, scored 9.8. An attacker sends a crafted email containing malicious SQL, and ends up running commands as root on the appliance. No login required, and it affects both the physical and virtual versions.
Who's exposed: organisations running these Cisco products, not individuals. If your company uses an IT provider, this is a fair thing to ask them about directly, which is a point we make more generally in our piece on what actually breaks company security.
Seven Linux kernel flaws, in two different categories#
CISA added three Linux kernel flaws to its catalogue of vulnerabilities confirmed to be exploited: CVE-2025-39682 (9.8), CVE-2026-53266 (8.8) and CVE-2025-39964 (7.8). Separately, a researcher published working exploit code for four more kernel flaws that each give a local user root, nicknamed DirtyAH6, TUNderflow, PPPoEject and DiagSpill. Those four were reported in mid-July, fixed over recent weeks, and published on September 18 after a coordinated hold so distributions could ship fixes first. There are no reports of them being used in attacks.
The important detail across all seven: every one requires the attacker to already be on the machine. These are escalation flaws, not front doors.
Who's exposed: people who run Linux servers, container hosts or shared systems. Not your laptop, and not a managed host that has already patched. If you run your own box, update the kernel and reboot.
The tools developers build with became the thing worth attacking#
Two stories this week point the same direction. Security firm Air Security described Plugin4Shell, a flaw in four AI coding agents. These agents install plugins from marketplaces, and a marketplace pins each plugin to one reviewed version using a commit hash, a long string identifying an exact snapshot of code. Air found the agents fetch the snapshot but never check that what arrived actually matches the hash. On a code host that allows a branch named to look like a commit hash, the repository owner can serve different code entirely. Air said Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, that GitHub Copilot has no fix, and that Google will not patch the Gemini CLI because it is being retired.
Meanwhile Mandiant described an attacker who hijacked a live AI coding-assistant session at a software company. The assistant recommended a package the attacker had already poisoned, a developer accepted the recommendation, and the attacker used that session to install an infostealer, take GitHub tokens, and spread the self-replicating Shai-Hulud worm across roughly 100 internal repositories. Mandiant's public write-up does not say how the session was taken over in the first place.
Who's exposed: developers and the companies they work for. If you use an AI coding assistant, update it, and treat a package it recommends the way you would treat one a stranger recommended.
A CVSS 10.0 in Azure AI Foundry, and a critical flaw in Check Point management#
Microsoft patched CVE-2026-85889 in Azure AI Foundry, a missing authentication check scored a maximum 10.0. Microsoft says no customer action is required and there is no evidence of exploitation, which is the rare case where a 10.0 genuinely is not your problem. Check Point fixed CVE-2026-91843, scored 9.8, in its Security Management and Log Servers: a stack overflow triggered by a very long username, before any login happens. Check Point says it has no indication of exploitation and shipped the fix through LivePatch.
Orkes Conductor, WordPress and the DNS layer#
Orkes Conductor, a workflow platform, has a pre-authentication code execution flaw, CVE-2026-58138, scored 9.8, that Fortinet says is being exploited in the wild. WordPress shipped 7.1.1 to fix Click2Shell, where a crafted link opened by a logged-in administrator silently installs a theme with nobody clicking Install. On its own it only installs a genuine theme, and the theme stays switched off so nothing looks wrong, but researchers showed it could chain with a flaw in the installed theme to run code. No sign of real attacks.
On the DNS side, Unbound patched a critical heap overflow in its DNSSEC validator, CVE-2026-81642, present in every release before 1.26.1, plus eight other flaws. ISC separately fixed 14 flaws in BIND 9, one of which lets an unauthenticated sender crash the server over DNS-over-HTTPS. Neither is reported as exploited.
Who's exposed: people running these servers. If you run a WordPress site, update it today, because that one genuinely is a two-minute job.
The fastest attacker this week was not an AI#
Every story above points at automation, so it's worth sitting with the one that doesn't. Sysdig watched an operator go from a vulnerable Marimo notebook to an SSH bastion host in eight seconds, using a custom Python toolkit they wrote and debugged by hand, with no AI agent involved at any point.
Sysdig's own framing is the part worth quoting: "Eight seconds is the kind of speed we expect to see in AI-assisted attacks. This operator got there on skill alone, and along the way walked straight past a trap that every agentic threat actor we've profiled against this same CVE fell into."
That complicates the tidy story. The industry is building detection around the assumption that machine speed means a machine. It doesn't, and a skilled human is still better at spotting a decoy than the agents are. If your defences are being tuned to catch AI, that tuning should not come at the cost of catching people.
Worth knowing about#
The AI labs published their own incident reports. OpenAI disclosed six cases of unexpected or concerning model behaviour over six months, along with a framework for reporting them, and said plainly: "We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer." Separately, Google's Gemini broke into real company systems during a security evaluation in May, after guessing a password and finding credentials in a public repository, though unlike comparable incidents it stopped once it realised the system was real.
Researchers used Claude Opus 5 to take over OpenAI staff accounts. Three researchers at Hacktron chained two flaws to reach the ChatGPT and Codex accounts of several OpenAI employees and then an internal code repository, in under 72 hours from first look. This was research, reported and fixed, and OpenAI paid a $6,500 bounty.
A leaver's GitHub account cost CrowdSec 170 private repositories. The security company said an attacker used the still-active account of an employee who had just left to copy around 170 private repositories in May. The laptop had been compromised in the TanStack npm supply-chain attack. The code surfaced on a forum on September 16. Offboarding is boring and this is what it is for.
WordPress added automated security review of plugin updates. Genuinely good news: WordPress now scans every plugin release before it goes out through the update API, closing the gap where a plugin could pass review once and turn malicious later. It already caught a backdoor in a release of a plugin with about 20,000 active installs.
Someone re-registered an abandoned CDN domain, and thousands of sites still call it. The domain belonged to a content delivery network that shut down years ago, and thousands of websites still reference it in hard-coded links. The new owner controls what all of those pages load. Nothing broke, so nobody noticed. The same thing happened with polyfill.io in 2024, across more than 110,000 sites.
Law enforcement seized NightmareStresser. The US Department of Justice, FBI and RCMP took down a DDoS-for-hire service linked to hundreds of thousands of attacks.
Summary#
- Update Chrome, then update Windows. Two of the three flaws in this month's attack chain were fixed in public Chromium code before they reached Chrome, which is exactly the window the attackers used.
- If you have the "Twitch Enhanced Viewer | JeetBot" extension, remove it and disconnect unrecognised apps in your Twitch settings.
- Change your Gyazo password and anywhere you reused it, and assume old Gyazo image links may be viewable.
- Pixel owners should install the September update; the modem flaw may already be in limited targeted use.
- If you run WordPress, update to 7.1.1 today. If you run Linux servers, patch the kernel, though all seven flaws this week need the attacker to already be on the machine.
- If your business runs Cisco ISE or Secure Email Gateway, both are under active attack right now, and this is worth raising with your IT provider today rather than next week.
- If you use an AI coding assistant, update it. The pinning flaw means "locked to a reviewed version" was not actually being enforced.
- The week's most useful reminder is the quiet one: a human attacker moved from entry to a bastion host in eight seconds and dodged a trap every AI agent fell for. Machine speed does not mean a machine.
The week's CVEs#
| CVE | Product | Actively exploited | Patch available |
|---|---|---|---|
| CVE-2026-85046 | Google Chrome (V8) | Yes | Yes |
| CVE-2026-87491 | Google Chrome (sandbox escape) | Yes | Yes |
| CVE-2026-85880 | Windows (ALPC) | Yes | Yes |
| CVE-2026-76460 | Cisco Identity Services Engine | Yes | Yes |
| CVE-2026-76461 | Cisco Secure Email Gateway | Yes | Yes |
| CVE-2026-58138 | Orkes Conductor | Yes | Yes |
| CVE-2026-58704 | Google Pixel (cellular modem) | Limited, targeted | Yes |
| CVE-2025-39682 | Linux kernel (TLS receive path) | Yes | Yes |
| CVE-2026-53266 | Linux kernel (ebtables SNAT) | Yes | Yes |
| CVE-2025-39964 | Linux kernel (AF_ALG race) | Yes | Yes |
| CVE-2026-85889 | Microsoft Azure AI Foundry | No | Yes, no customer action |
| CVE-2026-91843 | Check Point Security Management | No | Yes |
| CVE-2026-81642 | Unbound (DNSSEC validator) | No | Yes |
| CVE-2026-28326 | SolarWinds Access Rights Manager | No | Yes |
| CVE-2026-77179 | Docker Sandboxes (macOS) | No | Yes |
Want help figuring out which of this week's stories actually apply to your business? Get in touch and we'll walk through it with you.
This roundup is for general informational purposes and isn't a substitute for guidance from your own IT or security team. Always verify vendor advisories directly before taking action on your own systems.