Multiple Critical Zero-Days Under Active Exploitation; Phishing Campaigns Bypass MFA

This update provides a deeper technical analysis of the 'FalconFlank' local privilege escalation vulnerability affecting CrowdStrike Falcon Sensor. It details the exploit's mechanism, mapping it to MITRE ATT&CK techniques such as T1068 (Privilege Escalation) and T1548.002 (Bypass UAC). New hunting hints are included, focusing on monitoring `CSFalconService.exe` for unexpected DLL loads from non-standard paths, file writes to `C:\Windows\Temp\`, and unusual child processes (Event ID 4688). The interim mitigation remains disabling the 'Office malicious macros remediation' policy.

Further analysis of the N-able N-central RCE (CVE-2026-86218) reveals that active exploitation was observed by Huntress labs targeting the platform's API as early as September 4, 2026. N-able has also identified scanning and exploitation activity originating from the IP range 23.234.64.0/18. This new information provides critical Indicators of Compromise (IOCs) for defenders to scan their logs and network traffic. Additionally, the report maps observed and inferred attacker techniques to MITRE ATT&CK, including T1190 (Exploit Public-Facing Application) for initial access and T1078.001 (Default Accounts) for persistence, offering a clearer picture of the attack methodology.

Adobe has released an emergency security update for the 'StyleSmuggler' RCE zero-day, now officially tracked as CVE-2026-75650 with a critical CVSS score of 10.0. The patch addresses the unauthenticated remote code execution vulnerability affecting Adobe Commerce and Magento Open Source. Exploitation, which began on September 4, 2026, has been observed originating from IP addresses in China and Romania. Administrators are strongly advised to apply the patch immediately to mitigate the risk of compromise and to investigate for signs of active exploitation.

This update provides a deeper technical analysis of the 'MikroTrick' exploit chain, detailing how the privilege escalation (CVE-2026-86060) manipulates the RouterOS policy mask for full admin rights. It also maps the attack to MITRE ATT&CK techniques, including Initial Access (T1190), Privilege Escalation (T1068), Persistence (T1136.001), and Defense Evasion (T1070.006). New 'Cyber Observables' offer specific hunting hints for compromise detection, such as auditing user accounts, log analysis for '/system script add', and suspicious DNS requests. Additionally, 'IP Allowlisting' for SSH access is recommended as an enhanced mitigation, and factory reset is emphasized for suspected compromises.