Cyber Threat Brief — September 6 2026
⚠️ This report is AI-generated. Always validate findings.
1. StyleSmuggler — Magento / Adobe Commerce Unauth RCE (No CVE)
TL;DR: Sansec confirmed an unpatched Magento Open Source / Adobe Commerce zero-day (StyleSmuggler) under active exploitation since September 4 for unauthenticated RCE and a Rust implant. No Adobe CVE/patch as of September 6; disable GraphQL if unused and hunt [kworker/u:8:0] / .gvfsd persistence.
What’s New:
- Sansec published September 5 after ITW compromise starting September 4 22:20 UTC; reproduced full unauth chain on clean Magento OS 2.4.7 / 2.4.8 / 2.4.9
- First known victim was 2.4.6-p15 with July/August 2026 patches applied and
security:patch-statusclean - Two-stage chain: poison Magento templates via GraphQL
stylesproperties → execute during “Payment Transaction Failed Reminder” email render (no inbox open required) - Implant: ~1.9MB Rust backdoor masquerading as
[kworker/u:8:0]; cron every 5m under~/.local/share/.gvfsd/gvfsd-user; C2 includes99.84.67.186:443, NTP-shaped UDP hosts, download host247.cdnflare.xyz - Temporary mitigation: disable GraphQL until Adobe fix (next bulletin Sep 8 — coverage unconfirmed); Sansec Shield blocking since Sep 5 AM
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
POST /graphql?styles[ … ] | Exploit attempt | T1190 | Web/WAF, Magento access logs | Alert/block anomalous GraphQL styles params; rate-limit GraphQL |
Burst “Payment Transaction Failed Reminder” renders / X_TRACE_ under var/report/ | Stage-2 trigger | T1059.006 | Magento logs, FIM | Hunt unexpected failed-payment email volume + report dir implants |
Process name [kworker/u:8:0] with path under /tmp/.kw_* or ~/.local/share/.gvfsd/ | Implant | T1036.004 / T1053.003 | EDR, auditd, Sysmon Linux | Critical — terminate; collect hash; rotate Magento/admin secrets |
Crontab */5 * * * * …/.gvfsd/gvfsd-user | Persistence | T1053.003 | Cron inventory | Remove malicious cron; reimage if unsure |
C2: 99.84.67.186, 247.cdnflare.xyz, *.timesysnc.net / microsft.* NTP UDP/123 | C2 | T1071 | Firewall, DNS, Zeek | Block/hunt egress; note NTP-shaped C2 |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | PARTIAL — Linux Add Files In Known Crontab Directories | Catches StyleSmuggler’s user-crontab install under cron dirs; misses GraphQL styles, PayPal/eval stage, and [kworker/u:8:0] implant. Rejected ESCU Linux Kworker Process In Writable Process Path (needs iptables child — CyclopsBlink-shaped) |
| Elastic | PARTIAL — Cron Job Created or Modified | /var/spool/cron/crontabs/* create/rename catches .gvfsd/gvfsd-user persistence; misses GraphQL delivery + implant. Rejected Executable Masquerading as Kernel Process (kworker* does not match bracketed [kworker/…]) |
| Sigma | PARTIAL — New Cron File Created | Cron-dir file create only — same persistence aspect; no ET-2026 Magento GraphQL styles rule |
Hunt hint: Alert on GraphQL styles[ and PayPal transparent eval(base64; FIM/ps for [kworker/u:8:0] under /tmp/.kw_* or ~/.local/share/.gvfsd/; crontab for gvfsd-user; grep Magento var/report/ for X_TRACE_.
Sources: Sansec StyleSmuggler, Disrex mitigation, Graycore patch, ichbinlucasv on X, FrontieraTechIT on X
2. MikroTrick — MikroTik RouterOS SSH Unauth Admin Chain
TL;DR: CERT Polska confirms ITW exploitation of MikroTrick (CVE-2026-67276 SSH pubkey check bypass + CVE-2026-86060 crafted-username privilege manip) against internet-exposed RouterOS SSH, creating privileged ops users. Patch to 7.25beta3 / 7.24.2 / 7.23.4 / 6.49.21 and hunt Flagged devices + SSH -2 log markers.
What’s New:
- CERT Polska coordinated six RouterOS vulns; MikroTrick = unauth full admin when SSH is public; active exploitation confirmed (attacks since ≥ September 2)
- CVE-2026-67276 (CVSS 9.2): SSH accepts crafted RSA key matching type+modulus without full key compare
- CVE-2026-86060 (CVSS 9.2): crafted username beginning with disallowed char elevates to full admin session
- Vendor fixes: RouterOS 7.25beta3, 7.24.2, 7.23.4, 6.49.21; Flagged compromise scanner on boot
- Observed IOCs: attacker
82.192.72.4(successful, createsops); probe103.102.31.18; logslogin failure for user -2 from <ip> via sshanduser <name> added by ssh:-2@<ip>
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| RouterOS version < patched builds above | Vulnerable asset | N/A | Asset inventory, SNMP | Force upgrade; restrict SSH to management nets until patched |
Log: login failure for user -2 / user … added by ssh:-2@ | Exploit attempt | T1078 / T1136 | RouterOS logs, SIEM | Immediate isolate + forensic collect |
Privileged local user ops (or unknown admins) | Persistence | T1136.001 | /user print, config audit | Treat as compromise; factory reset per CERT guidance |
/system/device-mode/print Flagged | Compromise marker | N/A | Device console | Isolate; preserve logs/config before reset |
Src IP 82.192.72.4 / 103.102.31.18 | Attacker infra | T1190 | Firewall, VPN perimeter | Block; hunt historical SSH hits |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search | No MikroTik/RouterOS / CVE-2026-67276 / CVE-2026-86060 analytic in security_content (title/tag search) |
| Elastic | None — verified search | No RouterOS SSH MikroTrick rule after title/tag + logic review |
| Sigma | None — verified search | No SigmaHQ emerging-threats 2026 MikroTrick / RouterOS SSH -2 rule |
Hunt hint: Ingest RouterOS syslog; alert on user -2 SSH failures and ssh:-2@ user-add events; inventory internet-exposed TCP/22 to MikroTik; post-patch check Flagged + unknown users/scripts/schedulers/tunnels.
Sources: CERT Polska (EN), The Hacker News, MikroTik Sep 2026 bulletin, Now_on_VT on X
Status Updates
- CVE-2026-85046 (Chrome V8): Still on CISA KEV; federal due September 18. No material new artifacts vs Sep 5. Original brief.
- FalconFlank (CrowdStrike): Vendor interim guidance unchanged; continue hunt for
WindowsPowerShell\v1.0\bcrypt.dll. Original brief. - CVE-2026-6471 (PostGREShell): Patch/audit REPLICATION accounts still relevant; no new ITW wave vs Sep 5. Original brief.
- CVE-2026-19490 (Citrix NetScaler ADC/Gateway): Auth bypass (CVSS 9.3) seeing PoC-driven probes since Sep 3; patch 14.1-73.32 / 13.1-63.21; hunt
/var/vpn/theme/webshells. Not a full new section (slightly outside 24h; catch-up). Field Effect · Rapid7. - SonicWall / Switchvox / Artifactory / Kestra: Federal KEV deadlines were September 5 — verify remediation closure. Sep 3 · Sep 2.