Chrome Zero-Day Exploited; Linux Kernel, SonicWall Flaws Targeted

A critical out-of-bounds write vulnerability in Google Chrome's V8 JavaScript engine, identified as CVE-2026-87491, is being actively exploited in the wild. This flaw allows remote attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a specially crafted HTML page. The vulnerability was addressed in Chrome version 153.0.8010.36, and its active exploitation highlights the ongoing threat posed by zero-day vulnerabilities in widely used software. The exploit chain has been observed being used by Chinese threat actors to deploy malware, including the GRIMWEDGE backdoor, and has been linked to attacks targeting Google Pixel phones. As reported by Volexity, attackers are cloning legitimate websites to deliver these exploits.

CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signaling active exploitation in the wild. CVE-2025-39682, a flaw in the kernel's TLS handling, could allow an attacker to cause a denial-of-service. The other two vulnerabilities, detailed in reports by SecurityWeek and The Hacker News, also pose significant risks, with exploitation attempts noted by multiple threat intelligence sources. The inclusion in the KEV catalog mandates federal agencies to apply patches, underscoring the urgency for all organizations to address these issues.

SonicWall's SMA1000 Appliance Management Console (AMC) is facing an actively exploited post-authentication command injection vulnerability, CVE-2026-83549. This flaw allows authenticated attackers to execute arbitrary operating system commands on the affected appliance. CyberScoop reports that attackers are chaining this vulnerability with others to achieve unauthenticated remote code execution. The vulnerability has been added to CISA's KEV catalog, and Metasploit has released a module to aid in its exploitation, as noted by Rapid7. Organizations using SonicWall SMA1000 devices are urged to apply the latest patches immediately.

A wave of critical vulnerabilities affecting various consumer and enterprise devices has been disclosed. Netcore NBR200V2 routers are impacted by multiple flaws, including CVE-2026-94097 and CVE-2026-94101, which could lead to buffer overflows and remote code execution. Similarly, Totolink routers, specifically the A3002MU model, suffer from buffer overflow vulnerabilities (CVE-2026-93740 and CVE-2026-93739) due to improper handling of web interface parameters. Additionally, IBM MQ Appliance has a heap buffer overflow vulnerability (CVE-2026-10747) that could allow for denial-of-service or code execution before authentication. These widespread issues across different vendors highlight the persistent challenges in securing network edge devices and enterprise infrastructure.

Microsoft's September Patch Tuesday addresses a significant number of vulnerabilities, including two zero-days actively exploited in the wild: CVE-2026-72983, a use-after-free flaw in Windows Internet Connection Sharing (ICS), and CVE-2026-72982, a stack-based buffer overflow in Windows Netlogon. Both vulnerabilities could allow unauthorized attackers to execute code over a network. Cisco Talos and Rapid7 have provided analysis of these patches. The active exploitation of these flaws underscores the importance of timely patching for Microsoft products.

Several WordPress plugins are affected by critical vulnerabilities. The Web to Print Online Designer plugin (prior to 2.15.0) has an arbitrary file upload vulnerability (CVE-2026-82187) due to insufficient validation, allowing unauthenticated attackers to upload malicious files. The Botiga Pro plugin (prior to 1.6.5) suffers from an authorization bypass in its REST API (CVE-2026-86591), enabling unauthenticated users to modify WordPress options. Furthermore, the Gravity Forms plugin (up to 3.1.0.4) has an arbitrary file upload vulnerability (CVE-2026-84434) in its file upload functionality. These flaws expose WordPress sites to significant risks, including site takeovers and data breaches.