Cybersecurity News — 2026-09-11

Generated: 2026-09-11 | Sources: CISA, The Hacker News, SecurityWeek, Help Net Security, BleepingComputer, Dark Reading, Computer Weekly, CSO Online, Security Affairs, CERT Polska, MikroTik, Rapid7, SOCRadar, Qualys, Adobe, Huntress, IT Security Guru

1. The Software Your IT Provider Uses to Manage Your Computers Was Broken Into Before the Fix Existed

N-able N-central is remote-management software — the kind of tool an outsourced IT provider or managed service provider uses to see, patch and control every computer belonging to every client they look after. A flaw in it (CVE-2026-86218, rated the maximum 10.0 severity) lets anyone who can reach an exposed N-central server over the internet run their own commands on it, with no password and nothing for a user to click. N-able shipped a hotfix on 5–6 September; security firm Huntress reports at least one customer's server was already compromised on 4 September, before the fix was available, and America's Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of vulnerabilities known to be under attack on 8 September.

Why it matters for your business: you almost certainly don't run this software yourself — your IT provider might. That is exactly the point: a break-in at the provider reaches every client they manage, including you. Email whoever supports your IT and ask two plain questions: "do you use N-able N-central, and if so is it on the latest hotfix?" A provider worth keeping will answer the same day.

2. A Firewall Management Flaw Disclosed in March Is Now Being Used in Real Attacks

Cisco Secure Firewall Management Center is the console that controls a business's firewalls — the settings that decide what traffic is allowed in and out. A flaw in it (CVE-2026-20079, also rated 10.0) lets an unauthenticated attacker send specially crafted web requests and end up running commands with the highest level of access on the box. Cisco disclosed and patched the flaw back in March, when it said there was no sign of anyone exploiting it. That changed: Cisco confirmed active exploitation, its Talos research team says it has tracked several separate groups using it — including a ransomware affiliate — and CISA set a 12 September deadline for US federal agencies to patch. Cisco says there is no workaround: you have to upgrade.

Why it matters for your business: the lesson is about timing, not Cisco. A patch you skipped in March because "nothing was happening" is exactly the patch that bites in September, and by then attackers have working code and you are catching up. If you or your IT provider run Cisco Secure FMC, upgrade now; more generally, treat security updates for anything that faces the internet as a standing monthly job rather than a response to news.

3. A Second Old Flaw Was Quietly Added to the "Actively Exploited" List the Same Week

The same pattern showed up twice. CVE-2025-25249, a flaw in Fortinet's FortiOS and FortiSwitchManager software that lets a remote attacker with no login run commands on the device, was published back in January. On 9 September CISA added it to the same known-exploited list, with a 12 September federal deadline — meaning someone is now using it in real attacks. Reporting from security firm SOCRadar links the activity to a campaign delivering a remote-access tool it calls PivotC2, though that connection is the firm's own assessment rather than a vendor confirmation. Along with the Cisco flaw above, that is two separate vulnerabilities in this one week whose patches had been sitting available for six months or more.

Why it matters for your business: "old" does not mean "safe". Attackers routinely go back and weaponise flaws months after the fix shipped, precisely because they know how many businesses never installed it. Ask your IT provider for a one-page list of every internet-facing device you own — firewall, VPN box, router, mail server — with the firmware version and date of its last update next to each. If any line is blank or more than a few months old, that is your queue.

4. Routers Used by Small Offices Are Being Taken Over Through a Two-Step Trick

Researchers at Poland's national cyber centre, CERT Polska, named an attack chain "MikroTrick" affecting MikroTik RouterOS — the software running a popular and inexpensive line of routers found in small offices, workshops and serviced buildings. Two flaws are chained together: one (CVE-2026-67277) in a bandwidth-testing service leaks memory or crashes the router without any login, and the second (CVE-2026-86060) lets an attacker who sends a specially crafted username over SSH — the remote administration channel — gain full administrator rights. Together they hand over complete control of any affected router whose SSH port is reachable from the internet. CERT Polska says the chain has been used since at least 2 September, with attackers creating an account named "ops". MikroTik released fixes on 3 September in RouterOS 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. Scanning by the Shadowserver Foundation counts more than 122,500 MikroTik devices with SSH exposed online.

Why it matters for your business: your router sees every connection your business makes, so whoever controls it can redirect, intercept or quietly watch your traffic. Two actions: update the router's firmware to one of the versions above, and check that remote administration (SSH or the web login page) is not reachable from the public internet — it should be available only from inside your own network or over a VPN. If you don't know how to check, that question alone is worth asking your IT provider today.

5. Microsoft Issued Its Largest-Ever Batch of Security Fixes, Including Two Already Being Exploited

Microsoft's September update — its regular second-Tuesday "Patch Tuesday" release — addressed close to a thousand separate flaws, the biggest single month in the company's history. Two were already being used in attacks: CVE-2026-85880 and CVE-2026-81963, both of which let an attacker who already has a foothold on a Windows machine promote themselves to full system control. Security researchers flagged two other things worth knowing: a cluster of around 20 "wormable" flaws — meaning an infection could spread machine-to-machine across a network with no one clicking anything — in common network services, and a Windows DNS Server flaw (CVE-2026-69730) that Trend Micro's Zero Day Initiative compared to SigRed, a serious 2020 DNS bug.

Why it matters for your business: a batch this size will not install in a coffee break, so plan for it rather than deferring it. Make sure Windows Update is switched on and set to install automatically on every business machine, then check next week that they actually restarted — updates of this kind only take effect after a reboot, and a laptop that is never shut down can sit unprotected for months.

6. Google Patched a Second Chrome Flaw Under Attack Within Five Days of the First

Last week's digest covered an emergency Chrome fix for a flaw in V8, the engine that runs the JavaScript behind most websites. Google has now shipped another one for the same component: CVE-2026-87491, an out-of-bounds write that Google says was already being exploited and that allows an attacker to run code via a booby-trapped web page. What has changed is the tempo — this is the second actively exploited Chrome flaw in under five days and the seventh of 2026. The fix is in Chrome 153.0.8010.36/.37, released on 8 September, and CISA added the flaw to its known-exploited list the following day.

Why it matters for your business: the action is unchanged and it is still the one people skip — close the browser completely and reopen it, on every machine, rather than assuming the silent background update has already applied. Given the pace, it is worth making "fully restart your browser" a Friday habit for the next few weeks, and doing the same for Edge and any other Chromium-based browser you use.

7. Adobe Has Now Released an Official Fix for the Magento Flaw That Had None

Last week's digest reported that every current version of Magento and Adobe Commerce was exposed to an attack, nicknamed StyleSmuggler, that let attackers plant a hidden backdoor on live shops with no login required — and that Adobe had not yet issued an official patch, leaving only a third-party hotfix from the firm that found it. That gap has closed. Adobe published a security update for the flaw, now tracked as CVE-2026-75650 and rated 10.0, on 7 September, covering Adobe Commerce and Magento Open Source 2.4.4 through 2.4.9 and Adobe Commerce B2B. Adobe's guidance is that the fix must be applied in addition to the routine September security updates, not instead of them.

Why it matters for your business: if your shop runs Magento or Adobe Commerce, ask whoever maintains it to confirm both the September update and this specific fix are applied. And because exploitation began before any patch existed, patching alone does not tell you whether someone already got in — have them also check for unfamiliar administrator accounts and recently changed files, which is the part most people skip once the update installs cleanly.

8. The UK's Cyber Centre Warned About Staff Quietly Using AI Tools Nobody Approved

The National Cyber Security Centre (NCSC) published a warning about "shadow AI" — employees using AI chatbots and assistants that their employer has not approved or even knows about. The NCSC's concern is practical rather than philosophical: pasting a customer list, a contract, or a support ticket into an unapproved service moves that data somewhere the business cannot see, control or delete, and creates new openings for attackers. Research cited alongside the warning put the share of employees using unapproved AI tools at around 71%. Notably, the NCSC's advice is not to ban them — it says blanket prohibitions don't work in practice — but to get visibility of what is being used, set clear rules, and govern it deliberately.

Why it matters for your business: under UK GDPR you remain responsible for personal data your staff hand to a third party, whether or not you approved the tool. Write a short, plain-English rule — one page is plenty: which AI tools are fine, and what must never be pasted into any of them (customer records, staff data, anything under contract confidentiality). Saying "use this one, not that one" gets followed; saying "don't use AI" just moves it onto personal phones where you cannot see it at all.

9. A Fake "Leaked" Copy of a Hit Game Was Carrying Data-Stealing and File-Destroying Malware

Security firm Huntress documented a campaign built around anticipation for Grand Theft Auto VI, in which fake "leaked" copies of the game circulating online actually deliver a bundle of malware: remote-access tools that hand an attacker control of the machine, an infostealer that harvests saved passwords and browser sessions, and destructive ransomware that wipes files. The bait is the point — the promise of something genuinely scarce and desirable is what gets a careful person to switch off their judgement and click "download anyway" past the browser warning.

Why it matters for your business: this looks like a consumer problem and lands as a business one, because the laptop your bookkeeper uses at home, or the phone a staff member checks work email on, is a doorway into your systems. Saved browser passwords are the prize — an infostealer gets your Microsoft 365 or banking login without ever phishing anyone. Ask staff not to install pirated or "leaked" software on any device that touches work accounts, and where you can, separate work from personal: business email and systems on managed machines, everything else elsewhere.

Sources

New editions publish Every Friday. Summaries are compiled from public threat-intelligence feeds and security news sources. This digest is for awareness purposes only and does not constitute professional security advice.

Cybersecurity News