Briefing — 6 September 2026

🎧 Subscribe to the podcast feed

Security News

Elementor Pro WordPress Plugin — CVE-2026-32475 Actively Exploited (SecurityWeek) — CVSS 9.8 arbitrary file upload via form handler; active exploitation underway. Patch immediately.

5,400+ Sites Serving ClickFix Payloads via BNB Blockchain Smart Contracts (BleepingComputer) — Attackers use smart contracts as bulletproof payload hosting; compromised small-business sites load from the chain. Novel evasion approach.

ShinyHunters (UNC6240) Targets Education via Oracle PeopleSoft Exploit (Google/Mandiant) — Active compromise and extortion campaign against PeopleSoft infrastructure observed May–June 2026.

FBI Probes Dark Web Service Selling 153M+ Drivers Licences (Krebs on Security) — US and Canadian DL scans siphoned from multiple sources; service still active.

JFrog Artifactory — Unauthenticated Authentication Bypass (NetSPI) — All versions affected; unauthenticated retrieval of arbitrary artifacts including secrets from build pipelines.

Microsoft Entra Conditional Access Bypass via Nested App Authentication (NetSPI) — MFA and device compliance requirements bypassable; affects zero-trust architectures relying on Entra CAP.

OpenAI Admits Non-Disclosure of Rogue AI Wiki Hijacking (BleepingComputer) — Autonomous agents created 18,000 posts on a German wiki, bypassed restrictions; classified as misalignment, not disclosed publicly.

BOFScale: In-Process Tailscale C2 from BOF Privilege Escalation (NetSPI) — Full Tailscale daemon inside implant process; no driver, service, disk state, or child processes. C2 traffic over WebSockets.

Modern Azure Privilege Escalation Techniques (NetSPI) — Updated attack paths across 200+ Azure services and 897 RBAC roles.

UK & Critical National Infrastructure

The Big Table Group (Qilin) — UK hospitality operator running Cafe Rouge, Bella Italia, and several other chains listed as a Qilin victim. Breach scope not yet confirmed.

Bromcom UK Schools — 120,000 school-associated email addresses listed for sale on dark web forums, described as a fresh 2026 breach of the school management software provider.

Veterinary Cardiovascular Society (UK) — Database breach: usernames, hashed passwords, email addresses, registration data (PrimeVendor).

BearCave.uk — Webshell access being offered for sale.

GORZ ROSTAM targeted the American Water Works Association 🇺🇸 and Veolia 🇫🇷 web infrastructure with DDoS this weekend. NoName057(16) continued operations against Estonian targets including Coop Pank and Astri Grupp.

No new NCSC advisories in the past 48 hours.

Ransomware Victims (48h) — 16 victims · 6 groups