Cyber Threat Brief — September 5 2026
1. Chrome V8 Type Confusion Zero-Day — CVE-2026-85046 (CISA KEV)
TL;DR: Google confirmed ITW exploitation of a V8 type confusion bug; CISA added CVE-2026-85046 to KEV on September 4 (federal due September 18). Force Chrome/Edge/Chromium fleets to ≥152.0.7977.82 and hunt post-sandbox process anomalies.
What’s New:
- CISA KEV addition September 4 for Google Chromium V8 type confusion (CWE-843); due date September 18 under BOD 26-04
- Google Stable Channel update September 3: High CVE-2026-85046; advisory states exploit exists in the wild
- Patched builds: Chrome 152.0.7977.82/.83 (Windows/macOS), 152.0.7977.82 (Linux); Chromium-derived browsers inherit the same V8 fix lag
- Sixth actively exploited Chrome zero-day patched in 2026 per Google advisory tracking
- No public PoC / IOCs released (embargo standard for ITW browser bugs)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Chrome/Edge/Chromium version < 152.0.7977.82 | Vulnerable asset | N/A | Endpoint inventory, MDM | Enforce minimum version; block outdated browsers at network edge where feasible |
Renderer crash clusters followed by unusual child processes (cmd.exe, powershell.exe, rundll32.exe) | Post-sandbox indicator | T1203 / T1059 | EDR, Sysmon 1 | Correlate crash → child process within short window for high-risk users |
| Drive-by / watering-hole domains preceding renderer instability | Delivery | T1189 | Proxy/DNS, web proxy | Hunt rare domains visited minutes before Chrome crash storms |
Unexpected remote thread into chrome.exe / msedge.exe | Code injection | T1055 | Sysmon 8 | Alert uncommon sources injecting into browser processes |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search | Title/tag hits are config/injection-into-browser; none correlate Chromium renderer instability → cmd/powershell/rundll32 child (read logic) |
| Elastic | None — verified search | Closest Suspicious Browser Child Process is macOS-only and targets downloaders, not Win Chrome post-sandbox |
| Sigma | None — verified search | No emerging-threats 2026 rule for CVE-2026-85046; browser rules do not encode this V8 ITW chain |
Hunt hint: Correlate Chromium renderer crash/unusual exit with near-term spawn of cmd/powershell/wscript/mshta/rundll32 from chrome.exe/msedge.exe, plus preceding proxy/DNS to new or known-bad hosts.
Sources: The Hacker News on X, CISA KEV alert 2026-09-04, CISA KEV entry CVE-2026-85046, Chrome Stable Update 2026-09-03, NVD CVE-2026-85046
2. CrowdStrike FalconFlank LPE via Office Macro Remediation — No CVE
TL;DR: Public PoC (Nightmare Eclipse / MSNightmare) claims SYSTEM via Falcon’s Office malicious-macro remediation on fully patched Win11 25H2 / Server 2025. CrowdStrike investigating; disable File Suspicious Macro Removal per vendor guidance and hunt bcrypt.dll under WindowsPowerShell\v1.0.
What’s New:
- PoC published ~September 3–4 as FalconFlank; abuses Falcon “Microsoft Office file malicious macro removal” / File Suspicious Macro Removal
- Claimed conditions: Falcon Phase 3 Optimal Protection + macro-removal feature enabled; works on updated Win11 25H2 / Server 2025
- CrowdStrike to BleepingComputer / The Register: investigating; advise disabling Microsoft Office File Suspicious Macro Removal Windows policy; Cloud Anti-malware for Office Files remains; private FalconFlank Tech Alert on support portal
- Kevin Beaumont publicly confirmed related Nightmare Eclipse LPE drops this week are real/working
- Researcher notes Falcon may already block the shipped PoC sample — treat as mechanism risk, not “detected = fixed”
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
File create: *\WindowsPowerShell\v1.0\bcrypt.dll | Exploit artifact | T1574.001 / T1068 | Sysmon 11, FDR | Critical alert — bcrypt.dll does not belong in PowerShell v1.0 app dir |
OLE/OOXML written as .dll/.exe, especially under *\WindowsPowerShell\v1.0\ | Staging | T1027 | FDR OleFileWritten, Sysmon 11 | Alert OLE content written with executable extensions |
Any .dll written into *\WindowsPowerShell\v1.0\ outside Modules\ / *.resources.dll | Search-order plant | T1574.001 | Sysmon 11, FDR | Hunt DLL plants; do not filter on writing process (may be Falcon itself) |
Temp mirror of *\WindowsPowerShell\v1.0\ under user %TEMP% | Pre-plant staging | T1574 | Sysmon 11 | Hunt System32/PowerShell path mirrored under Temp |
| Falcon policy: File Suspicious Macro Removal enabled | Exposure | N/A | Falcon console | Disable per CrowdStrike interim guidance until patched |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search | Phantom-DLL analytic is name-allowlisted (phoneinfo.dll etc.); does not match bcrypt.dll plant under WindowsPowerShell\v1.0 |
| Elastic | Partial — Potential Masquerading as System32 DLL | Lists bcrypt.dll + recent write/load, but excludes ?:\Windows\System32\* — FalconFlank path under System32\WindowsPowerShell\v1.0 is filtered out |
| Sigma | None — verified search (near-miss) | Potential System DLL Sideloading From Non System Locations lists \bcrypt.dll but System32 path filter excludes ...\System32\WindowsPowerShell\v1.0\ — would miss FalconFlank load |
Hunt hint: Sysmon/EDR FileCreate for \WindowsPowerShell\v1.0\bcrypt.dll (or unexpected .dll under that path excluding \Modules\ / *.resources.dll); OLE/OOXML written as .dll/.exe under that path. Do not rely on generic “non-System32 bcrypt ImageLoad” Sigma as-is.
Sources: IntCyberDigest on X, BleepingComputer, The Register, Abstract ASTRO detection guidance, Security Affairs
3. PostgreSQL PostGREShell — CVE-2026-6471
TL;DR: Missing authz on logical-decoding plugin load lets a REPLICATION-privileged user dlopen arbitrary libs → code exec as postgres, catalog superuser flip, persistent backdoors. Patch to 18.6 / 17.11 / 16.15 / 15.19 / 14.24; strip unused REPLICATION; block outbound SMB/NFS from DB hosts.
What’s New:
- Cyera Research (PostGREShell) + SecurityWeek / The Hacker News / CSO coverage wave through September 4; not previously in ajking.io Sep 1–4 briefs
CREATE_REPLICATION_SLOTplugin name skipscheck_restricted_library_name(); absolute paths,../, Windows UNC accepted- Windows: fully remote via UNC/SMB 445 hosting attacker DLL; Linux/macOS often needs NFS automount or prior file write
- Fix introduces
output_plugin_librarieswhitelist (defaultspgoutput, test_decoding); Cyera reports 114 malicious PG plugins observed on VT historically - Requires REPLICATION attribute +
wal_level=logical— audit backup/CDC accounts now
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
CREATE_REPLICATION_SLOT with plugin names containing /, \, .., or UNC | Exploit attempt | T1068 / T1210 | PostgreSQL logs, pgaudit | Alert immediately; kill slot; isolate host |
Roles with rolreplication that are not approved backup/CDC | Exposure | T1078 | pg_roles inventory | Strip REPLICATION from unused accounts |
| Outbound TCP 445/2049 from postgres hosts | Delivery path | T1105 | Firewall, flow | Block egress SMB/NFS from DB tier |
postgres → sh/bash/powershell process chain | Post-exploitation | T1059 | EDR, Sysmon/auditd | Hunt shell children of postgres |
Unexpected shared_preload_libraries / pg_hba.conf passwordless entries | Persistence | T1556 | Config FIM, PG logs | Diff configs after any replication anomaly |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Linux Suspicious Child Process of PostgreSQL | Linux post-exploit shell children of postgres only; misses replication-slot plugin path/UNC + Windows; not CVE-mapped |
| Elastic | None — verified search | Closest PostgreSQL COPY PROGRAM Command Execution is COPY PROGRAM, not PostGREShell plugin load |
| Sigma | None — verified search | No public CVE-2026-6471 / malicious logical-decoding plugin-path rule |
Hunt hint: Alert PG logs for CREATE_REPLICATION_SLOT where plugin name contains /, \, .., or UNC; on Windows watch outbound SMB/445 from DB hosts after replication use; keep ESCU postgres-child as secondary post-exploit signal on Linux only.
Sources: PostgreSQL CVE-2026-6471, Cyera PostGREShell, SecurityWeek, The Hacker News, CSO Online
Status Updates
- CVE-2026-83548/83549 (SonicWall SMA1000): Federal KEV deadline today September 5. Zero-day exploitation ongoing; no new public IOCs since September 3 brief. Original brief · CISA KEV
- CVE-2026-9586 (Sangoma Switchvox): Federal deadline today. Unauth SQLi→RCE; honeypot reverse shells reported. Original brief
- CVE-2026-82329 (JFrog Artifactory): Federal deadline today. Admin token minting exploitation ongoing. Original brief
- CVE-2026-49869 (Kestra OSS): Federal deadline today. Auth-bypass to root workflow RCE. Original brief
- CVE-2026-82078/81578 (PaperCut NG/MF): watchTowr still researching patch bypasses; situation evolving. Original brief