Six hours to thousands of credentials
An autonomous agent framework harvested credentials in under six hours, a research team went from WeChat bug to working worm in about two days, and Microsoft shipped a record 974 fixes.
Act now 3 Read this 3 Also this week 13
Editor's note
Six hours for an agent framework to finish a credential campaign. Two days from a WeChat bug to a worm that does not need anybody to answer the phone. One week for four espionage groups to converge on the same exploit kit.
James Webb
Share: To LinkedIn read by your browser's voice · skips the labels
Overview
The three numbers worth keeping this week are all clocks. Six hours for an autonomous agent framework to work through a credential harvesting campaign. About two days from finding a WeChat bug to a working zero-click worm. One week for four separate espionage groups to pick up the same Chrome and Windows exploit kit.
- The agent is running the intrusion now, not assisting it. Google Threat Intelligence describes adversaries moving from prompting to agentic workflows in the second quarter. Sysdig reports an LLM agent taking post-compromise decisions in real time rather than running a prepared playbook.
- The defender's side of the same week got slower. Microsoft fixed a record 974 flaws, over 110 of them critical, two of them already exploited. SAP shipped a 10.0 in its kernel. Adobe patched a Magento flaw four days after the attacks started.
- The catalog is doing the triage that volume makes impossible. Five flaws entered CISA's exploited list between September 4 and September 8, and three of them are separate stories in this issue.
Act now3 items
Adobe Commerce and N-able joined the exploited catalog §
CISA added a Chromium V8 type confusion flaw on September 4, then four more on September 8: Adobe Commerce and Magento, two Windows flaws, and N-able N-central. All five carry evidence of active exploitation.
What it changes. Three of the five appear in this issue as their own stories, so the federal deadline and this week's reporting describe the same events. Check the catalog against your asset list rather than against the headlines.
Sources: CISA Alerts, CISA Cybersecurity Advisories, The Hacker News (thehackernews.com)
Cisco confirmed a maximum-severity firewall manager bypass §
Cisco confirmed that CVE-2026-20079, an authentication bypass in Secure Firewall Management Center rated maximum severity, is under active exploitation. Talos says it is tracking exploitation of two flaws in the product.
What it changes. The management center holds the policy for every firewall it controls, so a bypass there is a change-control problem rather than a single-host one. Confirm who can reach the management interface at all.
Sources: Cisco Talos, BleepingComputer
A Magento zero-day is dropping a Rust backdoor §
Sansec found unauthenticated remote code execution in Magento Open Source and Adobe Commerce, named it StyleSmuggler, and dated the attacks from September 4. Adobe patched it on Monday as CVE-2026-75650, rated 10.0. Payloads include a Rust backdoor and a PHP web shell.
What it changes. Exploitation ran for four days with no patch available. A store that was reachable in that window needs an integrity check, not only the update.
Sources: The Hacker News (thehackernews.com), Aikido Security
Read this3 items
Google watched agents harvest credentials in under six hours §
Google Threat Intelligence reported a financially motivated group running an autonomous multi-agent attack framework that completed a large-scale credential harvesting campaign in under six hours. GTIG says adversaries moved from prompting to agentic workflows in the second quarter.
What it changes. GTIG's framing is that human-in-the-loop latency is dramatically reduced, which compresses the window a defender has to respond. Six hours is shorter than most out-of-hours escalation paths.
Sources: The Hacker News (thehackernews.com), Google Threat Intelligence
SAP shipped a 10.0 kernel fix and a NetWeaver preauth fix §
SAP's September Security Patch Day addressed CVE-2026-44756, a memory corruption flaw in Extended Passport processing rated 10.0 and named OVERPASS by Onapsis, and CVE-2026-58240, a pre-authentication flaw in the NetWeaver Message Server.
What it changes. Onapsis found both and says both are likely to be exploited. CERT-EU has advised on them. Neither is reported as exploited yet, which is the entire value of the window you have now.
Found first by Catalin Cimpanu, 16 hours before the trade press · Sources: Catalin Cimpanu, The Hacker News (thehackernews.com), CERT-EU
Patch Tuesday set a record at 974 fixes, two already exploited §
Microsoft fixed 974 vulnerabilities, including 723 in Windows, 111 in Office, and 62 in SQL. Two Windows flaws are under active exploitation and both entered the CISA catalog. Microsoft rates another 58 as more likely to be exploited.
What it changes. Over 110 are rated critical, so a triage that reads every advisory does not finish this month. Take the two exploited flaws and the 58 first, and let the rest follow the normal cycle.
Found first by Catalin Cimpanu, 4 hours before the trade press · Sources: Catalin Cimpanu, Dark Reading, The Hacker News (thehackernews.com)
Also this week
Machines on the attack
- A zero-click WeChat worm spread between phones through calls. Calif built WeWorm, which takes over a WeChat account through an incoming call on iOS and Android, and demonstrated it spreading between three test phones. The victim never answers. The caller must already be a contact. Calif reported it to Tencent in July.
- An LLM agent drove the post-compromise steps in an intrusion. Sysdig's Threat Research Team reported an intrusion in which an LLM agent executed post-compromise actions in real time rather than running a prepared playbook. The chain began with a compromised marimo notebook and reached an internal database in four pivots.
Attacking the agents themselves
- Wiz took LiteLLM from an auth bypass to cloud compromise. Wiz published a chain in LiteLLM running from default keys and unauthenticated MCP sessions through custom code guardrails to root-level remote code execution and theft of IAM credentials.
- One of five filesystem MCP servers allowed a sandbox escape. A survey tested how five filesystem MCP servers enforce their "only these paths" boundary against a symlink escape in a recursive directory walker. One allowed a read-side escape. The other four held by design or made no confinement claim.
Industrial and critical infrastructure
- A hard-coded credential gives full control of CareCam cameras. CISA advised that CareCam Pro IP cameras running ANJIA AJL33PC0801 firmware from 2020 carry hard-coded credentials, tracked as CVE-2026-85083. Successful exploitation gives an attacker full control of the device.
Synthetic deception
- ASCII smuggling moved from prompt injection to mail filters. Microsoft reported a high-volume phishing campaign using invisible Unicode tag characters to split lure words such as "funding" so email filters cannot parse them. The same characters were popularized for hiding instructions from AI models.
Ordinary exploitation that still matters
- The PaperCut chain is being used against schools. Arctic Wolf observed attackers chaining CVE-2026-81578 and CVE-2026-82078, the PaperCut authentication bypass and remote code execution pair, for command execution, reconnaissance, and credential theft against education targets in the US and Europe.
- Four spy groups used the same Chrome and Windows exploit kit. Researchers documented BlueMoon, a previously undocumented exploit kit chaining Windows and Chrome flaws, used by four espionage clusters inside a week. The first in-the-wild use is attributed to the China-aligned group APT31.
- A public exploit chains a Telerik padding oracle to RCE. TantoSec published a working chain turning an AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution. It works only against a specific non-default configuration, and Progress patched the chain in July.
- N-able shipped a fourth N-central hotfix in five weeks. Every on-premises N-central build below 2026.3.1.14 needs Hotfix 4, including servers updated to Hotfix 3 the day before. N-able's incident notice says the flaw has been exploited in the wild. Its own release notes say that is unconfirmed.
Compute as terrain
- US agencies accused Chinese AI firms of industrial-scale distillation. CISA, the FBI, and partner agencies said six China-based AI companies have run industrial-scale knowledge distillation against US frontier models since at least late 2024, extracting billions of tokens from Claude, GPT, Gemini, and Grok.
Rules and enforcement
- Ukraine's top prosecutor resigned over a call center scandal. Risky Business News reports the resignation of Ukraine's top prosecutor amid a scam call center scandal. The same bulletin records a cyberattack on doctors' clinics in Luxembourg, 64 schools closed in Massachusetts, and a breach at the Florida DMV.
From the research frontier
- OpenAI published figures on its own coding agent usage. OpenAI described how its research teams use coding agents, with data on agent usage, experiment velocity, and task complexity. Both that piece and a companion essay by its chief scientist discuss recursive self-improvement.
Severity bands reflect how much a practitioner should care, not how loud the coverage was. Confidence follows standard intelligence language. How items are scored →