Cyber Security News

Hacking Editorial Brief — September 9, 2026

Microsoft Delivers Record-Breaking Patch Tuesday Amid Zero-Day Activity

Microsoft released 974 security patches in its September 2026 Patch Tuesday—the largest single-month batch on record—addressing two actively exploited zero-day vulnerabilities in Windows Update Stack and Windows ALPC. Hours after the release, an anonymous researcher operating as "Nightmare Eclipse" published ShieldCrash, a proof-of-concept zero-day exploit targeting Microsoft Defender, demonstrating the continued cat-and-mouse dynamic in Windows security. The volume and timing of releases reflect both accumulated technical debt and aggressive vulnerability disclosure practices that challenge patch deployment cycles in enterprise environments.

Active Exploitation Across SharePoint, WordPress, and WeChat Platforms

Multiple exploitation campaigns are targeting enterprise and consumer platforms with confirmed attacker activity. Threat actors are actively exploiting CVE-2026-50522, a critical Microsoft SharePoint vulnerability, to steal machine keys and maintain persistent access that survives server patching. Separately, attackers are leveraging CVE-2026-32475 in the Elementor Pro WordPress plugin to deliver webshells and execute arbitrary commands on compromised servers. In a notable cross-platform development, a US security startup used AI-assisted fuzzing to identify a severe WeChat vulnerability enabling worm-like propagation through incoming calls without user interaction; Tencent has blocked the exploit following responsible disclosure. The simultaneous campaigns demonstrate both opportunistic targeting of common enterprise software and emerging AI-enabled vulnerability discovery methods.

Scattered Spider Arrest and Data Breach Incidents

Finnish authorities arrested a 19-year-old dual US-Estonian citizen on federal charges alleging membership in the Scattered Spider cybercrime collective, marking continued law enforcement action against the high-profile threat actor group. In separate breach disclosures, Australian edtech platform Mathspace confirmed exposure of 1,079,819 records after attackers exploited an unpatched Metabase vulnerability, while threat actors published alleged Florida DMV data—including Jeffrey Epstein's driving record—as part of an extortion attempt. Additionally, hackers are conducting credential theft campaigns targeting Anthropic Claude subscribers, consuming API tokens through compromised accounts.

Sources: Bleeping Computer · Help Net Security · Security Affairs · TechCrunch