Welcome to Threat Thursday, Galactic's weekly threat intelligence roundup.
Every Thursday, we cover the cybersecurity stories that matter most for protecting organizations from emerging threats, and we break each one down into what happened, what it could mean for your organization, and what to do about it.
September 8 was the largest patch day on record, with Microsoft alone shipping fixes for 966 vulnerabilities and Adobe, SAP, and Google publishing their own the same afternoon. The more useful detail is what happened to organizations that were already current. A Magento store running every available update was still exploitable. An N-central server on the newest build was already compromised. And Microsoft's fix for last month's Defender zero-day left enough of the problem reachable that a researcher demonstrated it the same day the patch shipped. Being up to date bought less than usual this week.
This Week's Cycle
1. Adobe Commerce and Magento Were Being Backdoored for Three Days Before a Patch Existed: CVE-2026-75650 (StyleSmuggler)
Sansec, an e-commerce security firm, discovered that Magento and Adobe Commerce stores were under active attack starting September 4, three days before Adobe released a fix. The vulnerability, dubbed StyleSmuggler by Sansec and tracked as CVE-2026-75650 (CVSS 10.0), sits in Magento's email template engine. An attacker injects malicious PHP code through the styles properties of the template system; Magento writes the code to a file, and a payment-failure notification email triggers its execution. No account is required and no user interaction is needed. Every version from 2.4.4 through 2.4.9 is affected, including stores that had applied every available security update before September 4. Two separate attack campaigns have been confirmed: one deploying a Rust-based Linux backdoor that disguises its command-and-control traffic as routine time-synchronization requests, another dropping a PHP web shell for remote command execution. Adobe released emergency hotfix VULN-39341 on September 7, rated Priority 1. CISA added CVE-2026-75650 to its Known Exploited Vulnerabilities catalog on September 8 with a September 11 federal deadline.
Potential impact: Exploitation ran for 72 hours before a fix existed, meaning stores running fully current builds were still vulnerable during that window. The hotfix closes the injection point but doesn't remove backdoors already installed on a compromised server. Both malware strains observed so far are designed for persistence, not just initial access.
What to do: Apply Adobe's VULN-39341 hotfix immediately. It ships as a composer patch from repo.magento.com, not as a full software release. After applying it, rotate your encryption keys following Adobe's checklist. Then treat the period between September 4 and your patch date as a potential exposure window: look for unexpected "Payment Transaction Failed Reminder" email activity, unfamiliar processes, and web shells in pub/media or related directories. Patching doesn't clean a server that was already hit.
Source: BleepingComputer
2. A Fully Patched N-central Server Was Compromised, Prompting N-able's Fourth Emergency Patch in Five Weeks: CVE-2026-86218
On September 4, Huntress began investigating a production N-central server that had been compromised despite running the most current available build at the time. That investigation uncovered two previously unknown vulnerabilities, CVE-2026-86206 and CVE-2026-86207, that could be chained to bypass authentication on the platform. N-able shipped Hotfix 3 on September 5. Within 12 hours, an independent researcher disclosed a third new flaw: CVE-2026-86218, which allows unauthenticated code execution on the server, rated CVSS 10.0. Hotfix 4, build 2026.3.1.14, shipped September 6 and supersedes all prior patches. CISA added CVE-2026-86218 to its Known Exploited Vulnerabilities catalog on September 8 with a September 11 federal deadline. N-able reports active scanning from the IP range 23.234.64.0/18 and recommends reviewing logs for that activity. This is N-central's fourth emergency patch since August 1.
Potential impact: N-central is a remote monitoring and management platform that manages software and configuration across every endpoint it oversees. An attacker who reaches it can reach everything it manages. The Huntress finding carries a specific implication: the compromised server was on the current patched build, which means this wasn't a case of a missed update. These vulnerabilities existed alongside prior fixes rather than because of a skipped one.
What to do: Apply Hotfix 4, build 2026.3.1.14, immediately. This build supersedes all previous hotfixes, including those for the N-central vulnerabilities covered in earlier Threat Thursday issues. If your N-central instance was internet-accessible between September 4 and September 6, treat the server as potentially compromised and investigate before relying on it to manage endpoints. Review logs for scanning activity from 23.234.64.0/18.
Source: SecurityWeek
3. September Patch Tuesday Sets a Record and Includes Two Exploited Windows Zero-Days: CVE-2026-85880 and CVE-2026-81963
Microsoft's September 2026 Patch Tuesday released fixes for 966 vulnerabilities, the largest single Patch Tuesday in the company's history. Two of them were confirmed exploited in the wild at the time of release, and CISA added both to its Known Exploited Vulnerabilities catalog the same day. CVE-2026-85880 is a memory vulnerability in Windows Advanced Local Procedure Call (ALPC), the internal system Windows uses to let programs communicate with each other. Exploiting it from a low-privilege position produces SYSTEM-level access. It's the second exploited zero-day in that component in nearly four years. CVE-2026-81963 is a flaw in the Windows Update Stack itself, the component Windows uses to deliver and install security patches. It's the first of the seven Windows Update Stack vulnerabilities patched over the past five years to be confirmed exploited in the wild. Both carry a CVSS score of 7.8. Microsoft hasn't disclosed how either was used in attacks. The broader September release includes 81 critical-rated remote code execution vulnerabilities and 20 that Microsoft considers capable of spreading machine to machine without any user involvement.
Potential impact: Both exploited flaws require some existing access to the machine before they can be used, and they convert a limited foothold into full system control. The scale of the broader release, 966 fixes in a single update, means teams managing large Windows environments need a clear sequencing approach. Deploying everything at once without testing carries risk; deferring the full batch creates exposure.
What to do: Prioritize CVE-2026-85880 and CVE-2026-81963 first, across every Windows endpoint and server, ahead of the wider rollout. Both are confirmed exploited and appear in CISA's Known Exploited Vulnerabilities catalog. Use that list as your primary sequencing signal for the rest of the September release rather than Microsoft's own severity labels alone.
Source: BleepingComputer
4. Microsoft's Fix for the ShieldBreak Defender Zero-Day Was Incomplete: ShieldCrash
The researcher who published ShieldBreak (CVE-2026-69414), covered in Threat Thursday on August 27, published a new proof of concept on September 8 showing that Microsoft's fix left an attack path open. The new vulnerability, named ShieldCrash by the same researcher, demonstrates that under specific conditions the original issue remains reachable on Windows systems running September's full security update. The current proof of concept reads arbitrary files with SYSTEM-level privileges, meaning it can access files Windows normally restricts to system processes only. It doesn't execute arbitrary commands directly. Microsoft hasn't acknowledged ShieldCrash, hasn't assigned it a CVE number, and has no fix available. Systems running September 2026's Patch Tuesday update are still exposed.
Potential impact: The capability here is file access, not direct code execution, and the distinction matters. What ShieldCrash can access is files that carry stored credentials, encryption keys, and authentication tokens that ordinary accounts can't reach. Those materials can be used to move further through a network without needing a separate code-execution exploit. The more pointed concern is that a confirmed exploited zero-day received an incomplete fix, and a researcher identified the remaining exposure the same day the patch shipped.
What to do: No patch is available. Watch Microsoft's security advisories for a fix addressing this and deploy it as a priority when it arrives. Endpoint monitoring for unexpected privilege escalation attempts related to Defender's file-handling behavior is the practical step in the meantime. Don't run the published proof of concept on production systems.
Source: The Hacker News
5. Chrome Records Its Seventh Actively Exploited Zero-Day of 2026: CVE-2026-87491
Google patched 230 vulnerabilities in Chrome on September 8, one of which was being actively exploited at the time of release. CVE-2026-87491 is an out-of-bounds write in V8, the JavaScript engine Chrome uses to run code on web pages. Exploitation has been confirmed. Google hasn't disclosed what the attacks looked like or who was targeted, and no CVSS score has been assigned. This is Chrome's seventh confirmed exploited zero-day of 2026.
Potential impact: Seven actively exploited Chrome zero-days in nine months reflects sustained attacker investment in browser-based exploitation. Flaws in V8 are valuable to attackers because V8 processes every piece of JavaScript a page loads, and memory corruption at that layer can feed into broader attack chains even when it doesn't directly execute system commands.
What to do: Update Chrome to the latest version. Chrome updates automatically on most systems, but confirm the update has applied across all managed endpoints rather than assuming automatic delivery completed.
Source: The Hacker News
6. SAP Patches a CVSS 10.0 Unauthenticated Vulnerability on the Same Day as Everything Else: CVE-2026-44756
SAP released its September 2026 security patches on September 8 alongside Microsoft's Patch Tuesday. Among the fixes was CVE-2026-44756, rated CVSS 10.0, in SAP Extended Passport Processing, a kernel diagnostics component that's processed before authentication checks run, which is what makes it exploitable without credentials. Successful exploitation allows an attacker to execute arbitrary code on the server without logging in. SAP hasn't reported confirmed exploitation in the wild. The September 8 timing stacks this fix on top of an already unusually heavy patching week, which means it's at risk of being deprioritized.
Potential impact: SAP runs core business infrastructure for large enterprises: ERP, finance, HR, and supply chain systems. A CVSS 10.0 flaw requiring only network access to exploit is a high-value target. The absence of confirmed exploitation is worth noting but isn't a permanent condition; SAP vulnerabilities have historically attracted attacker attention quickly after public disclosure.
What to do: Apply SAP's September 2026 Security Patch Day updates and confirm CVE-2026-44756 is addressed. If any SAP components are internet-facing or reachable from untrusted network segments, treat patching as urgent despite the current absence of confirmed exploitation.
Source: The Hacker News
The Big Picture
Patch programs tend to measure one thing: how quickly a fix gets deployed after it's released. That metric was working fine for the organizations in this week's stories, and several of them were compromised anyway. A fix that arrives after exploitation has already started closes a window rather than emptying the room.
The useful adjustment is treating patch deployment and exposure assessment as two separate pieces of work. One has a completion date and a status color. The other requires knowing when the flaw was first exploited in the wild, comparing that against when your patch landed, and looking at what happened in between. Most environments have the logs to answer that question. Fewer have the habit of asking it.
Check back next week for another Threat Thursday. See you then!
