TL;DR
MikroTik routers with internet-exposed SSH are being hijacked without authentication [1]. REVSTEALER malware disables Windows Defender and Update to run crypto miners [2]. Magento and Adobe Commerce face unpatched zero-day exploitation [3].
Executive Summary
- MikroTik routers with remote-access SSH exposed to the internet are being compromised without authentication, granting full administrative control.
- REVSTEALER, an emerging Windows information stealer, deploys four post-infection modules that disable Microsoft Defender and Windows Update before running cryptocurrency miners.
- A new unpatched vulnerability in Magento Open Source and Adobe Commerce allows unauthenticated remote code execution to backdoor online stores.
- JetBrains disclosed that threat actors exploited a TeamCity vulnerability to breach its Cadence environment and extract AWS credentials.
- Google Chromium V8 type confusion vulnerability (CVE-2026-85046) is now in CISA’s Known Exploited Vulnerabilities catalog, affecting Chrome, Edge, and other Chromium-based browsers.
Top Threats Today
1. MikroTik Router Hijacking via Unauthenticated SSH
Severity: HIGH Affected: Telecom, Technology
Attackers are exploiting MikroTik routers with Internet-exposed SSH access to gain full administrative control without requiring authentication [1]. According to CERT Polska’s attack warning issued September 5, successful compromises have been documented since at least that date ⚠[1]. Attackers gain unrestricted access to router configuration and network traffic when SSH is reachable from the public internet without proper credential enforcement.
Sources:[1] The Hacker News
Recommended Action
- Audit all MikroTik router deployments for internet-facing SSH services; disable public SSH access or restrict to allowlisted IP ranges immediately.
- Rotate all administrative credentials and review access logs for unauthorized logins.
- Apply the latest MikroTik firmware patches and enable strong authentication (SSH key-only or multi-factor).
- Monitor for unusual configuration changes or traffic anomalies.
2. REVSTEALER Information Stealer Disables Endpoint Security
Severity: HIGH Affected: Technology
Elastic Security Labs has documented four previously unreported modules associated with REVSTEALER, an emerging Windows information stealer, that persist on compromised machines after the stealer itself self-deletes [1]. One module disables Windows Update and Microsoft Defender before launching a cryptocurrency miner ⚠[1]. This post-infection persistence mechanism reduces detection visibility and enables sustained malicious activity on infected hosts.
Sources:[1] The Hacker News
Recommended Action
- Enable tamper protection and real-time monitoring on Windows Defender; configure Group Policy to prevent unauthorized disabling.
- Deploy endpoint detection and response (EDR) solutions to detect post-exploitation modules independently.
- Monitor for disabled Windows Update and Defender services; alert on any unauthorized service stops.
- Review telemetry for cryptocurrency mining processes or unusual CPU consumption patterns.
3. Unpatched Magento and Adobe Commerce Zero-Day Exploitation
Severity: CRITICAL Affected: Retail, Technology
Attackers are actively exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that permits unauthenticated remote code execution on e-commerce servers [1]. Sansec, a Dutch e-commerce security company, published an advisory on September 5 detailing active exploitation in the wild [1]. The vulnerability allows attackers to inject malicious code without requiring any form of authentication or valid login credentials, creating a direct backdoor into affected online stores.
Sources:[1] The Hacker News
Recommended Action
- Immediately isolate or take offline any Magento or Adobe Commerce instances that cannot be patched pending vendor release.
- Monitor web server logs and application activity for anomalous code execution requests or shell uploads to webroot directories.
- Implement Web Application Firewall (WAF) rules to block known exploitation patterns pending official patches.
- Review order history and customer data for signs of tampering; reset all admin and API credentials.
- Contact Sansec or Magento/Adobe security for detailed exploitation indicators and forensic guidance.
4. JetBrains Cadence Breach via TeamCity Vulnerability
Severity: HIGH Affected: Technology
JetBrains disclosed a security incident in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach JetBrains’ own Cadence environment and extract AWS credentials [1]. JetBrains is urging all Cadence users to immediately revoke and rotate all stored credentials [1]. This represents a supply-chain risk whereby a development tool provider’s own infrastructure was compromised, potentially exposing customer credentials or intellectual property.
Sources:[1] The Hacker News
Recommended Action
- Revoke and rotate all AWS credentials and API keys that may have been stored in JetBrains Cadence environments.
- Review CloudTrail and AWS API logs for unauthorized API calls using stolen credentials; check for resource creation, data access, or IAM modifications.
- Ensure TeamCity instances are patched to the latest security release; disable or restrict public access pending vulnerability remediation.
- Audit all developers’ Cadence accounts and CI/CD integrations for suspicious activity or permission changes.
5. Google Chromium V8 Type Confusion Now Actively Exploited
Severity: HIGH Affected: Technology
CVE-2026-85046, a type confusion vulnerability in Google Chromium V8, has been added to the CISA Known Exploited Vulnerabilities catalog as of September 4, 2026, with a federal remediation deadline of September 18, 2026 [1]. The vulnerability allows remote attackers to execute arbitrary code inside the Chromium sandbox via a crafted HTML page [1]. It affects multiple web browsers including Google Chrome, Microsoft Edge, and Opera [1].
Sources:[1] CISA KEV
Recommended Action
- Prioritize immediate updates to Chrome, Edge, and all Chromium-based browsers to the latest security patch.
- Deploy browser updates via mobile device management (MDM) or group policy for enterprise endpoints.
- Block access to known malicious HTML payloads via endpoint security and network monitoring.
- Educate users to avoid clicking suspicious links or visiting untrusted websites pending full patching.
Today’s Action Checklist
- ☐ URGENT: Audit and isolate internet-exposed MikroTik SSH services; rotate administrative credentials.
- ☐ URGENT: Identify and isolate any Magento or Adobe Commerce systems; review logs for exploitation indicators.
- ☐ URGENT: Revoke and rotate AWS and Cadence credentials across development teams.
- ☐ HIGH: Prioritize Chromium-based browser updates (Chrome, Edge) to latest security release across all endpoints.
- ☐ HIGH: Enable Windows Defender tamper protection and audit for REVSTEALER post-exploitation modules on infected systems.
- ☐ Monitor CISA KEV and vendor advisories daily for patches to Magento/Adobe Commerce and TeamCity vulnerabilities.