Today's cybersecurity news highlights a record-breaking Patch Tuesday from Microsoft, addressing nearly 1,000 vulnerabilities, alongside critical zero-day exploits in Adobe Commerce and N-able N-central. We also see continued concerns about AI's role in sophisticated attacks and significant data breaches.
Microsoft Patches Record Number of Vulnerabilities, Including Two Zero-DaysVulnerability
Microsoft has released a massive security update for September 2026, fixing an unprecedented 974 vulnerabilities across its products. Among these are two actively exploited zero-day flaws. This marks Microsoft's largest-ever monthly patch release.
Why it matters: Regularly applying Microsoft's security updates is crucial for protecting your systems against known and actively exploited vulnerabilities, even if the volume of patches is daunting.
Read more at Krebs on Security ↗
Adobe Fixes Critical Magento Zero-Day Under Active ExploitationVulnerability
Adobe has issued an urgent patch for a critical zero-day vulnerability, CVE-2026-75650 (named 'StyleSmuggler'), affecting Adobe Commerce and Magento Open Source. This flaw, with a CVSS score of 10.0, has been actively exploited to deploy backdoors and web shells on compromised servers.
Why it matters: If you use Adobe Commerce or Magento for your online store, immediately apply this patch to prevent unauthenticated attackers from gaining full control of your server and stealing sensitive data.
Read more at The Hacker News ↗
N-able N-central Remote Code Execution Flaw Exploited in the WildVulnerability
A critical pre-authentication remote code execution flaw (CVE-2026-86218, CVSS 10.0) in N-able N-central is being actively exploited. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch by September 11, 2026.
Why it matters: If your business uses N-able N-central, immediately apply the necessary patches to prevent attackers from executing arbitrary code on your systems without prior authentication.
Read more at The Hacker News ↗
ChatGPT Flaw Could Exfiltrate Gmail Data via Planted PromptsVulnerability
Researchers discovered a flaw in ChatGPT where a hidden instruction within a conversation could covertly read a user's connected Gmail data and transmit it to an attacker's account. This demonstrates how seemingly benign AI interactions can be weaponized for data theft.
Why it matters: Exercise caution when interacting with AI tools, especially those connected to sensitive accounts, and be wary of unusual or overly complex responses that might hide malicious instructions.
Read more at The Hacker News ↗
Autonomous AI Agents Used for Large-Scale Credential TheftThreat
Threat actors are increasingly leveraging autonomous, multi-agent AI frameworks to automate and accelerate credential harvesting campaigns. One such financially motivated group managed to compromise thousands of credentials in under six hours, showcasing the growing sophistication of AI-powered cyberattacks.
Why it matters: The rise of AI-driven attacks means businesses need stronger, multi-factor authentication and continuous monitoring to detect and respond to rapid, automated compromise attempts.
Read more at The Hacker News ↗
Hackers Return Majority of Bitcoin Stolen from Liquid NetworkBreach
Following a significant breach of the Liquid Network that saw nearly 4,000 Bitcoin stolen, the attackers have returned 3,400 Bitcoin. While approximately $47 million in Bitcoin remains unrecovered, the partial return is a notable development in the cryptocurrency world.
Why it matters: While this incident involves a specific cryptocurrency platform, it underscores the importance of robust security measures for any platform handling significant financial assets and the potential for losses even when some funds are returned.
Read more at The Hacker News ↗
Slim Spider Group Targets Brazilian Financial Institutions with Crypto Custody TheftThreat
A new financially motivated threat actor, dubbed 'Slim Spider,' has been active since at least March 2026, focusing on Brazilian financial institutions. This group demonstrates deep knowledge of the local financial infrastructure, specifically targeting crypto custody secrets.
Why it matters: Businesses, especially those in the financial sector or handling cryptocurrencies, must remain vigilant against sophisticated, region-specific threat actors and implement strong defensive measures against tailored attacks.
Read more at The Hacker News ↗
WeChat Zero-Click Worm Vulnerability Allowed Account TakeoverVulnerability
Security researchers created a zero-click worm that could take over WeChat accounts on both iPhone and Android devices through an incoming call. The vulnerability required the caller to be an existing contact, but no user interaction was needed for the compromise. Tencent has since patched the flaw.
Why it matters: This highlights that even popular communication apps can have severe vulnerabilities. Keep all software, especially messaging apps, updated to ensure you have the latest security fixes.
Read more at The Hacker News ↗
DoppelCart Fraud Network Uses 119,000 Fake Shops for Credit Card TheftThreat
A large-scale fraud operation, named 'DoppelCart,' is operating over 119,000 fake e-commerce websites designed to steal payment card details from unsuspecting customers. This extensive network creates numerous deceptive online shops to facilitate credit card theft.
Why it matters: Before making online purchases, always verify the legitimacy of websites, check for secure connections (HTTPS), and be cautious of deals that seem too good to be true, to avoid falling victim to such elaborate phishing schemes.
Read more at BleepingComputer ↗
Grindr Settles UK Lawsuit Over Sharing HIV Status DataPolicy
The LGBTQ+ dating app Grindr has agreed to pay £26 million ($35.1 million) to resolve a lawsuit in the U.K. The legal action alleged that Grindr violated privacy laws by sharing sensitive user data, including HIV status, with third parties for advertising and other commercial purposes.
Why it matters: This settlement is a reminder to businesses to prioritize user privacy, especially with sensitive data. For small business owners handling personal information, understand and comply with data protection regulations to avoid costly legal consequences.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.