Weekly Cybersecurity Bulletin: Zero-Days in Chrome, Magento, VMware; CrowdStrike Investigates Privilege Escalation

This edition of the weekly cybersecurity newsletter bulletin covers critical zero-day discoveries, nation-state router compromises, emerging autonomous AI attack vectors, and major cloud identity incidents. Below are detailed summaries of the top developments impacting enterprise defense and threat landscapes this week.

CrowdStrike Falcon Sensor Privilege Escalation Claim A security researcher operating under the alias Nightmare-Eclipse published a proof-of-concept exploit named FalconFlank targeting the CrowdStrike Falcon Sensor. The project alleges an unverified local privilege escalation vulnerability affecting Windows 11 and Windows Server 2025 systems running Phase 3 Optimal Protection. According to the researcher, the exploit abuses the sensor's remediation workflow when removing malicious Microsoft Office macros. CrowdStrike stated that it is actively investigating the claims and advised customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting while retaining Cloud Anti-malware protection. Because endpoint agents run with elevated system permissions to quarantine and modify files, manipulation of remediation routines could theoretically allow a local low-privileged user to achieve SYSTEM privileges. Defenders are advised to review the FalconFlank Tech Alert within the customer portal for ongoing updates.

**Google Chrome V8 Zero-Day Actively Exploited** Google rolled out an emergency desktop update to address a high-severity zero-day vulnerability in its V8 JavaScript engine that is actively exploited in the wild. The bug, tracked as CVE-2026-85046, is a type confusion flaw reported by security researcher Salvatore Gulizia. Type confusion errors occur when memory allocated for one object type is accessed as a different type, opening paths for memory corruption or arbitrary code execution within the browser process. The patch advances Google Chrome Stable to version 152.0.7977.82/.83 on Windows and macOS, as well as 152.0.7977.82 on Linux. Exploitation typically requires luring a victim to visit a maliciously crafted web page delivered through phishing, malvertising, or compromised sites. Enterprise administrators should expedite browser updates across managed endpoints, as active browser exploitation presents an immediate initial access vector.

Magento and Adobe Commerce StyleSmuggler Zero-Day E-commerce security firm Sansec uncovered an actively exploited, unauthenticated remote code execution zero-day vulnerability dubbed StyleSmuggler affecting Magento Open Source and Adobe Commerce. The vulnerability impacts all supported builds, including version 2.4.9, and has been observed compromising fully patched merchant storefronts. Attackers manipulate styles properties inside unauthenticated GraphQL queries to smuggle PHP code into internally written log and report files. The exploit chain automatically triggers code execution when Magento renders its standard payment failure notification email internally, requiring no recipient interaction. Once active, a dropper cycles through PHP execution functions to deploy a persistent Rust binary disguised as a legitimate kernel thread. Because an official vendor patch has not yet been released, administrators should consider temporarily disabling GraphQL where feasible and restricting process execution permissions.

VMware Workstation and Fusion Host Code Execution Broadcom issued advisory VMSA-2026-0007 detailing two security flaws in VMware Workstation and Fusion that permit attackers to escape virtual machine sandboxes. The most severe vulnerability, tracked as CVE-2026-59346, carries a CVSS score of 9.3 and stems from an integer overflow in the VMXNET3 virtual network adapter. An attacker with local administrative privileges inside a guest VM can exploit this condition to execute arbitrary code directly on the host operating system. The second flaw, CVE-2026-59347, is a stack-based buffer overflow in the Host-Guest File System shared folders component with a CVSS score of 8.1. Broadcom addressed both issues with the release of version 26H1u1, emphasizing that no functional workarounds exist. Security teams utilizing virtualized sandboxes for malware detonation or testing must patch immediately to prevent host compromises.

HardBreacher PoC Targets Kaspersky Endpoint Security A public repository titled HardBreacher was released by researcher MSNightmare, claiming an unconfirmed local privilege escalation vulnerability in Kaspersky Endpoint Security. The proof-of-concept specifically targets version 14.0.0.504 running on Windows 11. The author asserts that manipulating interactions with the product's user interface allows an unprivileged local user to create an arbitrary dynamic link library within the protected System32 directory. The exploit has not received an official CVE identifier or formal vendor verification. The published proof-of-concept is characterized by its creator as unstable, frequently requiring reboots and multiple attempts. Organizations running Kaspersky software should monitor vendor advisories and inspect system telemetry for anomalous file generation inside system directories until conclusive technical findings are released.

OpenAI GPT-6 Astra Discovers Zero-Days OpenAI introduced GPT-6 Astra, a frontier intelligence model demonstrated to identify software zero-day vulnerabilities and construct functional proof-of-concept exploits during authorized offensive security benchmarks. The model achieved a 100% score on ExploitBench, reflecting advanced autonomous computer-use and debugging capabilities. Astra demonstrates the ability to inspect complex codebases, interact with command-line environments, and iteratively revise exploit attempts when execution fails. While automated flaw discovery provides defensive benefits by accelerating patch development, the release highlights dual-use concerns regarding the democratization of sophisticated exploit engineering. OpenAI noted that...