🚨 A critical Cisco Nexus 9000 flaw lets unauthenticated remote attackers run code as root.

CVE-2026-20212 leaves TCP ports 43210 and 43211 reachable in the default Layer 3 VRF on 10 switch models.

Affected models, fixes, and mitigations: https://thehackernews.com/2026/09/critical-cisco-nexus-9000-flaw-lets.html

🚨 This week’s ThreatsDay...

🧰 Real tools, wrong hands
🎣 Phishing for sale
🔗 Old access stays open
🤖 AI points to bad packages
⌨️ Typos open doors
🪪 ID data stolen
💥 Access becomes ransomware
⚙️ Weak settings remain

Full threat list: https://thehackernews.com/2026/09/threatsday-ceo-phishing-kits-5k-dropbox.html

⚡ GPT-6 Astra scored 100% on ExploitBench.

OpenAI says separate exploit-development tests included two zero-day vulnerabilities. The released version is limited to secure code review and patching and refuses requests to create PoC exploits.

Read: https://thehackernews.com/2026/09/gpt-6-astra-scores-100-on-exploitbench.html

‼️ WARNING - Attackers are exploiting a Chrome V8 zero-day.

CVE-2026-85046 allows arbitrary code execution inside the browser sandbox via a crafted HTML page. Google fixed it in Chrome 152.0.7977.82/.83.

How the V8 type confusion works: https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html

⚠️ Plex is urging users to update after patching multiple undisclosed security flaws.

Fixes are available in Media Server 1.43.3 and Desktop 1.115.0. Plex has requested CVE IDs but disclosed no technical details.

What users need to update: https://thehackernews.com/2026/09/plex-urges-immediate-updates-after.html

🛑 Attackers are exploiting Super Forms and Elementor Pro RCE flaws.

Wordfence has blocked over 440,000 attempts. Both bugs allow unauthenticated PHP uploads; Elementor attacks require a published page with a Form widget and File Upload field.

Inside the bypass: https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html

🚨 Unauthenticated attackers could turn Grafana MCP servers into proxies for internal networks and cloud metadata endpoints.

Pillar Security research team found affected releases accepted self-generated session IDs in place of authentication, exposing the server's Grafana service account to anyone who could reach it.

A chained SSRF (CVE-2026-19516, CVSS 9.1) then let callers pick the destination, method, headers, and body of outbound requests. The server has passed 1.9 million Docker Hub downloads; Grafana shipped fixes in mcp-grafana v1.1.0.

Full details here: https://thn.news/grafana-mcp-flaws

🚨 Attackers compiled the newly documented Ted backdoor into HAProxy builds at two South Korean organizations.

It keeps C2 out of backend logs and HAProxy statistics while serving altered pages only to selected visitors.

How the filtering and log evasion work → https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html

‼️ PostgreSQL closed a 12-year-old flaw that could turn REPLICATION access into code execution.

With logical decoding enabled, an account could load any reachable library and run it as the postgres OS user.

How the flaw worked: https://thehackernews.com/2026/09/postgresql-fixes-12-year-old-logical.html

🚨 An invisible-Unicode phishing campaign peaked at an estimated 2.37 million emails in one day.

Attackers split financial terms like “funding” with hidden tag characters, breaking literal keyword matches while the text looked normal to recipients.

Read: https://thehackernews.com/2026/09/phishing-campaign-sends-millions-of.html

⚠️ Attackers are exploiting a PaperCut authentication bypass and RCE chain against schools and universities in the U.S. and Europe.

The attacks enable credential theft, privileged account creation, registry hive collection, and Meterpreter deployment.

Read: https://thehackernews.com/2026/09/attackers-exploit-papercut-flaws-to.html

‼️ ALERT - Thousands of AI agents identifying as OpenAI systems quietly coordinated on a dormant German wiki.

They left 18,000 posts, relayed answers, predicted questions, and shared a proxy bypass using a fabricated Azure hostname.

Read full details here: https://thehackernews.com/2026/09/thousands-of-openai-agents-quietly.html

‼️ ShipMonk said it deleted Trezor customer data. A breach exposed it anyway.

Trezor says 67,000 more U.S. customers had names, contact details, shipping addresses, and order numbers exposed. The breach involved a Metabase zero-day.

The full scope: https://thehackernews.com/2026/09/trezor-says-shipmonk-breach-exposed.html

🛑 A critical VMware flaw can turn local VM admin access into host code execution.

Broadcom fixed CVE-2026-59346 and an HGFS flaw in Workstation and Fusion 26H1u1. Both affect 25H2 and 26H1, with no workarounds or known exploitation.

How the code execution paths work: https://thehackernews.com/2026/09/critical-vmware-workstation-and-fusion.html

🛑 Attackers breached JetBrains Cadence via an unpatched TeamCity server, extracting AWS IAM credentials from a 2024 backup and accessing user data and S3 files.

JetBrains is urging users to rotate secrets and treat all Cadence executions as untrusted.

Read: https://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.html

‼️ BREAKING - Attackers are exploiting an unpatched Magento and Adobe Commerce ZERO-DAY to backdoor online stores.

No login required. No published CVE. No Adobe patch yet.

Here's what to do and how the attack works: https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html

⚠️ Researchers uncover four previously unreported, persistent programs linked to REVSTEALER.

Wallet theft, clipboard hijacking, proxying and mining. The miner can disable Windows Update and add Defender exclusions after elevation.

What each program does > https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html

🚨 Attackers hijack MikroTik routers through internet-exposed SSH. No authentication required.

Update RouterOS immediately, then check for unknown users and scripts, CERT Polska advises.

See affected versions and recovery steps → https://thehackernews.com/2026/09/attackers-hijack-mikrotik-routers.html

🚨 JSCeal V8 malware can bypass Google authentication using stolen browser cookies.

It can also modify Binance, Bybit, and Ledger traffic through a local proxy.

How analysts decoded its hidden capabilities: https://thehackernews.com/2026/09/jsceal-malware-can-bypass-google.html

‼️N-central’s 4th hotfix in five weeks fixes CVE-2026-86218, a CVSS 10.0 unauthenticated RCE flaw.

Hotfix 3 servers need updating. N-able’s incident notice reports exploitation; its release notes say it’s unconfirmed.

What’s known about exploitation: https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html