As your dedicated cybersecurity services provider, CyberOne equips you with timely and in-depth information about current cyber attacks. Discover a weekly cybersecurity report of the latest exploits and breaches shaping the ever-evolving cybersecurity landscape.
Weekly Cybersecurity Report | Week 36, 2026
Information security updates and events from the past week
1. Google Patches Sixth Actively Exploited Chrome Zero-Day of 2026 (CVE-2026-85046)
Summary: On September 4, 2026, Google pushed emergency desktop updates for Chrome (versions 152.0.7977.82/.83 for Windows/macOS and 152.0.7977.82 for Linux) addressing 12 security defects. The update is headlined by CVE-2026-85046, a high-severity type-confusion vulnerability in the V8 JavaScript and WebAssembly engine. Google confirmed that an exploit for this flaw already exists and is being actively leveraged in targeted in-the-wild attacks.
Impact / Significance: Browser zero-days allow threat actors to execute arbitrary code via malicious or compromised websites (drive-by downloads). When chained with operating system sandbox-escape vulnerabilities, this flaw enables attackers to compromise the underlying host without user interaction beyond visiting a web page.
Recommendations:
Immediately update Google Chrome across all endpoints via Settings > About Chrome and relaunch the browser to ensure the new binaries load into memory.
Enterprise administrators should force browser restarts across fleet management consoles to eliminate exposure windows.
Exercise heightened scrutiny when opening untrusted links received via email, messaging platforms, or external collaboration tools.
Source: AI Weekly / CVD Portal — Google Patches Sixth Chrome Zero-Day of 2026 Exploited in Wild
2. CrowdStrike Falcon Zero-Day Exploit “FalconFlank” Released Publicly
Summary: On September 4, 2026, an anonymous security researcher operating under the handle “Nightmare Eclipse” published a working zero-day exploit titled “FalconFlank” targeting the CrowdStrike Falcon endpoint sensor on Windows. The local privilege escalation (LPE) defect bypasses sensor self-protection hooks, allowing an unprivileged local user to elevate permissions directly to NT AUTHORITY\SYSTEM.
Impact / Significance: Weaponizing the security agent itself inverts an organization’s defensive perimeter. Attackers who establish an initial low-privilege foothold can exploit this flaw to gain complete host takeover, manipulate telemetry, blind security operations center (SOC) monitoring, and execute secondary payloads with full operating system authority.
Recommendations:
Monitor the CrowdStrike Falcon console for official channel updates, hotfixes, and rapid-response sensor releases.
Audit Windows endpoints for suspicious inter-process communication (IPC) and anomalous child processes interacting with CrowdStrike services.
Strictly enforce the principle of least privilege, ensuring standard users lack local administrative rights and restricting access to execution environments (e.g., PowerShell, script interpreters) where unapproved code can execute.
Source: BleepingComputer — New CrowdStrike ‘FalconFlank’ Zero-Day Grants SYSTEM Privileges
3. IDScan.net Sued Over Alleged Mega-Breach Leaking 153 Million Driver’s Licenses
Summary: On September 4, 2026, identity verification provider IDScan.net was hit with federal class-action lawsuits after threat actors placed a database containing records of 153 million North American driver’s licenses for sale on underground cybercrime forums. The exposed records originated from identity check-in hardware and software utilized by hospitality venues, vehicle dealerships, and retail stores across the United States and Canada. Compromised datasets include full legal names, dates of birth, residential addresses, driver’s license numbers, and barcode scan data.
Impact / Significance: Severe identity theft and fraud risk. Driver’s license numbers combined with exact home addresses and birth dates provide cybercriminals with the precise telemetry needed to defeat Know-Your-Customer (KYC) verifications, conduct synthetic identity fraud, initiate fraudulent credit lines, and orchestrate targeted SIM-swapping schemes.
Recommendations:
- For Consumers: Place immediate credit freezes and fraud alerts with the credit bureaus (Equifax, Experian, TransUnion) to prevent unauthorized accounts from opening.
- For Organizations: Audit third-party identity scanning partners and enforce strict data minimization policies. Avoid storing raw barcode scan data or plaintext copies of government-issued identification cards once transactional verification completes.
Source: BleepingComputer — IDScan Sued Over Alleged Data Breach Affecting 153 Million Drivers | PCMag — Hacker Allegedly Stole 153 Million Driver’s Licenses, Is Now Selling Them
4. Nearly 22,000 Microsoft Exchange Servers Vulnerable to Hijacking as CISA Issues KEV Mandate
Summary: Scanning telemetry published on September 1, 2026, revealed that nearly 22,000 internet-facing Microsoft Exchange servers worldwide remain vulnerable to unauthorized takeover. Attackers are chaining vulnerabilities (including CVE-2026-42271) and NTLM relay weaknesses to bypass Extended Protection and seize complete control of mailboxes and server roles. On September 2, 2026, CISA formally added CVE-2026-42271 alongside six other actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, ordering federal agencies to remediate them.
Impact / Significance: Corporate espionage, business email compromise (BEC), and lateral domain movement. Publicly exposed Exchange servers provide threat actors with direct access to internal corporate communications, proprietary intellectual property, and an ideal pivot point into corporate Active Directory environments.
Recommendations:
Enable Extended Protection for Authentication (EPA) across all on-premises Exchange servers immediately.
Apply the latest Cumulative Updates (CU) and security patches across all hybrid and on-premises Exchange infrastructure.
Remove Exchange management endpoints (including OWA and ECP) from direct, unfiltered internet exposure, placing them behind a VPN or Zero Trust Network Access (ZTNA) solution.
Source: BleepingComputer — Nearly 22,000 Microsoft Exchange Servers Vulnerable to Hijack Attacks | CISA Alerts — CISA Adds Seven Known Exploited Vulnerabilities to Catalog
5. Healthtech Provider Aesto Health Discloses Breach Compromising 9.5 Million Patients
Summary: On September 1, 2026, healthtech software vendor Aesto LLC (operating as Aesto Health) disclosed that a recently detected network intrusion resulted in the compromise of protected health information (PHI) belonging to more than 9.5 million individuals. The compromised data includes patient names, dates of birth, medical treatment records, insurance identifiers, and provider notes stored across Aesto’s clinical integration platform, which serves dozens of healthcare networks and hospital systems.
Impact / Significance: Major medical identity theft and targeted extortion risk. Compromise of protected health information creates long-term vulnerability for patients because medical history and insurance identifiers cannot be easily reset like passwords, leaving victims susceptible to medical billing fraud and targeted phishing.
Recommendations:
Healthcare organizations using third-party software integration platforms must review vendor access privileges and restrict service accounts using network-level access controls.
Affected patients should monitor their explanation of benefits (EOB) statements for unrecognized healthcare services and place fraud alerts on their credit profiles.
Organizations must deploy immutable access logs and continuous database activity monitoring to detect bulk data exfiltration attempts.
Source: BleepingComputer — Aesto Health Says Data Breach Affects Over 9.5 Million Patients
The cybersecurity attacks highlighted in this report aren’t just incidents, they’re blueprints of the adversary’s arsenal. To protect your business you need the right partner. CyberOne is here to help! Check out our services.
