Cyber Threat Brief — September 9 2026
1. Microsoft Sep 2026 Patch Tuesday ITW — CVE-2026-81963 / CVE-2026-85880
TL;DR: Record ~966–974 CVE Patch Tuesday includes two Exploitation Detected local LPEs to NT AUTHORITY\SYSTEM — CVE-2026-81963 (Windows Update Stack link-following) and CVE-2026-85880 (ALPC heap overflow / AppContainer→SYSTEM). Both on CISA KEV; federal due 2026-09-22. Prioritize these two over the volume flood.
What’s New:
- CVE-2026-81963: improper link resolution in Windows Update Stack → low-priv local → SYSTEM during privileged Update Stack file ops; no UI (Romain Deperne + MSTIC)
- CVE-2026-85880: heap buffer overflow in Windows ALPC; code exec inside AppContainer → sandbox escape / SYSTEM; no UI (Volexity + Proofpoint)
- CISA added both to KEV 2026-09-08 with due 2026-09-22 (same alert as StyleSmuggler + N-central)
- Second-tier wormable/unauth-RCE inventory: DNS CVE-2026-69730 (CVSS 9.8), MSMQ TCP 1801 (CVE-2026-69579), NFS 2049, SSTP 443 (CVE-2026-73009) — after the two ITW LPEs
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Host missing Sep 2026 LCU covering CVE-2026-81963 and CVE-2026-85880 (map KB via MSRC for OS build) | Vulnerable asset | N/A | WSUS/Intune/MECM / Get-HotFix / vuln scanner | Deploy Sep PT LCU; pilot → fleet before KEV due 2026-09-22 |
ParentImage ends with \chrome.exe / \msedge.exe / AppContainer IntegrityLevel → same host elevates to NT AUTHORITY\SYSTEM via ALPC (CVE-2026-85880) | AppContainer→SYSTEM LPE | T1068 / T1611 | Sysmon EventID 1 + 10 / EDR process+token | Hunt IntegrityLevel AppContainer→System within ≤15 min of sandboxed browser/COM activity; patch LCU for CVE-2026-85880 |
Unexpected junction/symlink under paths consumed by Update Stack (wuauclt.exe / MoUsoCoreWorker.exe) for CVE-2026-81963 | Link-following LPE | T1574 / T1068 | Sysmon EventID 12/13 / EDR FileCreate+reparse / Windows Update logs | Alert non-admin reparse points touching Update Stack work dirs; inventory Sep LCU for CVE-2026-81963 |
| Internet-facing DNS Server role missing fix for CVE-2026-69730 (UAF unauth RCE, CVSS 9.8) | Wormable/RCE exposure | T1190 | Asset inventory + vuln scan | Second-tier after ITW LPEs; patch reachable DNS first |
| MSMQ listening on TCP 1801 without Sep fix for CVE-2026-69579 | Wormable/RCE exposure | T1190 / T1210 | netstat/firewall inventory + vuln scan | Disable unused MSMQ or patch; alert unauth traffic to TCP 1801 |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search | 0 mapped CVE-2026-81963/85880 / ALPC / Update Stack ITW rules. Rejected Windows Symlink Evaluation Change via Fsutil (fsutil SymlinkEvaluation — not Update Stack link-following). Rejected BlueHammer/Windows MsMpEng Writing to System32 (Defender VSS/TOCTOU write — not ALPC/Update Stack) |
| Elastic | None — verified search | 0 ALPC / Update Stack / these CVE titles-tags |
| Sigma | None — verified search | 0 ET-2026 rules for CVE-2026-81963/85880 |
Hunt hint: Inventory Sep 2026 LCU/SSU coverage for CVE-2026-81963 and CVE-2026-85880 by OS build (MSRC KB map). On Sysmon/EDR: IntegrityLevel=AppContainer (or ParentImage \chrome.exe/\msedge.exe) → token/User becomes NT AUTHORITY\SYSTEM within ≤15 minutes — treat as CVE-2026-85880 candidate. Pair with Update Stack (wuauclt.exe/MoUsoCoreWorker.exe) + unexpected reparse points for CVE-2026-81963. KEV due 2026-09-22.
Sources: BleepingComputer Patch Tuesday, Tenable Sep 2026 PT, CrowdStrike Sep 2026 PT, CISA KEV alert 2026-09-08, MSRC CVE-2026-85880, MSRC CVE-2026-81963
2. Chrome V8 OOB Write ITW — CVE-2026-87491
TL;DR: Google patched CVE-2026-87491 (Medium; V8 out-of-bounds write → arbitrary code inside the sandbox via crafted HTML). Google states an exploit exists ITW. Fix in Chrome 153.0.8010.36/.37 (Win/Mac) and 153.0.8010.36 (Linux). Distinct from last week’s KEV CVE-2026-85046.
What’s New:
- Seventh actively exploited Chrome ZD Google patched in 2026; reported 2026-08-06 by Jihyeon Jeong (SNU Compsec Lab); $2,500 bounty
- Stable channel Chrome 153 with 230 security fixes in the same push
- No public exploit detail / actor attribution while rollout continues
- Chromium consumers (Edge/Opera/etc.) — verify vendor advisories catch up separately from Chrome 153
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
chrome.exe / Chromium ProductVersion < 153.0.8010.36 (Linux) or < 153.0.8010.36/.37 (Win/Mac) — CVE-2026-87491 | Vulnerable browser | T1189 / T1203 | Intune/GPO browser inventory, vuln scan | Force update to ≥153.0.8010.36/.37 + restart; block outdated builds at edge if policy allows |
| Crafted HTML → V8 OOB write → code exec inside Chrome sandbox (CVE-2026-87491) | Exploit delivery | T1203 | Browser crash telemetry, EDR renderer anomalies | Hunt unusual chrome.exe renderer crashes; treat as foothold only — sandbox still holds until LPE |
Same host: ParentImage \chrome.exe (AppContainer) → NT AUTHORITY\SYSTEM within ≤15 min (CVE-2026-85880 chain after CVE-2026-87491) | Sandbox→SYSTEM chain | T1203 / T1611 | Sysmon 1/10 / EDR | Join browser crash/foothold hosts to AppContainer→SYSTEM hunt for CVE-2026-85880; patch both Chrome 153 and Sep LCU |
| Fleet still only on builds patched for CVE-2026-85046 (not CVE-2026-87491) | Incomplete patch | N/A | Patch inventory | Treat CVE-2026-87491 as separate required bump — 85046 patch ≠ 87491 |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search | 0 CVE-2026-87491 / V8 OOB rules. Rejected Windows Chromium Browser No Security Sandbox Process (--no-sandbox / --allow-no-sandbox-job — not in-sandbox V8 OOB) |
| Elastic | None — verified search | 0 mapped V8 / CVE-2026-87491 detections |
| Sigma | None — verified search | 0 ET-2026 Chrome CVE-2026-87491 rules |
Hunt hint: Intune/GPO: chrome.exe/msedge.exe/brave.exe ProductVersion < 153.0.8010.36. Alert enterprise hosts that never relaunched after update. On those hosts, hunt Sysmon/EDR for AppContainer/\chrome.exe → NT AUTHORITY\SYSTEM within ≤15 min as CVE-2026-85880 follow-on to CVE-2026-87491.
Sources: Help Net Security, Chrome Releases stable desktop 2026-09-08
3. PoisonedRefresh — F5 BIG-IP APM Fileless PHP Web Shell Rootkit
TL;DR: SophosLabs (Linux/Agnt-IC) + ESET (PoisonedRefresh) detail a memory-only PHP webshell rootkit on F5 BIG-IP APM after CVE-2025-53521 unauth RCE. Disk FIM misses it — webshell prepended at mmap() for legitimate webtop .php3 files. Hunt /run/bigtlog.pipe, token Kzwd6jM5, HTTP 201 + text/css, follow F5 K000160486.
What’s New:
- Initial access: CVE-2025-53521 (APM access policy on VS; Shadowserver ~795 exposed at disclosure); F5 cluster c05d5254
- Stage-1: modified
umount→ infects/usr/sbin/httpd, SELinux changes, survives upgrade images; stage-2 ELF hooks__libc_start_main/apr_dso_load/ libphpmmap - Webshell hosts: legitimate
apm_css.php3,full_wt.php3,webtop_popup_css.php3— on-disk unchanged; prefixBSOHAzPB, stream keywSLjN1beuR; response HTTP 201Content-Type: text/css - Local AF_UNIX backdoor:
/run/bigtlog.pipeauth tokenKzwd6jM5→/bin/bash(no TCP listener) - Sample SHA-256:
26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9; RC4 string keyTrswBWIl90Z5e38n - Published analysis window Sep 8–9 (Sophos + SecurityAffairs); patch alone ≠ clean — run F5 compromise assessment
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| BIG-IP APM ever on CVE-2025-53521-affected builds (even if patched now); cluster c05d5254 | Compromised candidate | T1190 | CMDB / F5 inventory | Run F5 System Scanner + K000160486 IOC review; prefer clean rebuild if IoCs hit |
UNIX socket /run/bigtlog.pipe | C2 / interactive shell | T1559 / T1059.004 | Host audit, ss -xl, EDR | ss -xl | grep bigtlog; alert presence; capture PID/peer; assume interactive bash backdoor |
Auth token Kzwd6jM5 / prefix BSOHAzPB / keys wSLjN1beuR / TrswBWIl90Z5e38n | Implant constants | T1059 | Memory strings, packet capture | Hunt in memory/traffic; do not rely on disk grep alone |
POST to apm_css.php3 / full_wt.php3 / webtop_popup_css.php3 with HTTP 201 + Content-Type: text/css | Webshell traffic | T1505.003 / T1071.001 | F5/Apache access logs, proxy | Alert 201+text/css on webtop php3; block anomalous POSTs |
httpd → /bin/bash; mprotect/mmap around libphp; SELinux not Enforcing; /usr mounted rw | Host behavior | T1059 / T1547 | auditd/EDR on BIG-IP | Hunt Apache workers reading /proc/self/maps + RWX→RX on libphp |
SHA-256 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9 | Sample hash | T1027 | AV/EDR hash intel | Block/hunt; expect variants |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | PARTIAL — Web or Application Server Spawning a Shell | parent_process_name=httpd + linux_shells can catch /bin/bash child from Apache worker. Misses /run/bigtlog.pipe, HTTP 201+text/css, in-memory php3 prepend, CVE-2025-53521 exploit. Legacy F5 stories (CVE-2022-1388 / TMUI) not this APM path |
| Elastic | PARTIAL — Suspicious Child Execution via Web Server | EQL: parent httpd/httpd.worker → suspicious children incl. bash. Same Gap: socket path / 201+css / memory webshell / F5 KEV IOCs unmapped |
| Sigma | PARTIAL — Linux Webshell Indicators | ParentImage /httpd + recon children (whoami,cat,…). Misses /bin/bash itself (not in Image list) and all memory/socket/HTTP artifacts. 0 PoisonedRefresh / CVE-2025-53521 / bigtlog ET rules |
Hunt hint: On BIG-IP APM: ss -xl | grep bigtlog / test for /run/bigtlog.pipe; review access logs for 201 + text/css on apm_css.php3/full_wt.php3/webtop_popup_css.php3; check SELinux Enforcing + /usr mount ro. Follow F5 K000160486 + System Scanner — disk FIM of php3 files will look clean while process memory is poisoned. Patch ≠ remove implant.
Sources: SophosLabs — Dissecting a PHP web server rootkit, SecurityAffairs PoisonedRefresh, F5 K000160486
Status Updates
- CVE-2026-75650 (StyleSmuggler / Magento): Added to CISA KEV (2026-09-08); federal due 2026-09-11 — keep VULN-39341 + full credential rotation. Sep 8
- N-central CVE-2026-86218: Also on KEV same day; federal due 2026-09-11 — HF4 (2026.3.1.14) still required. Sep 7
- ShieldCrash (Defender): Nightmare Eclipse PoC claims incomplete ShieldBreak (CVE-2026-69414) patch — arbitrary file read as SYSTEM post-Sep PT; MpEngine 1.1.26080.3 not proven sufficient per researcher. Continuity with FalconFlank researcher. SecurityAffairs
- CVE-2026-85046 (Chrome V8): Still KEV due Sep 18 — separate from today’s CVE-2026-87491. Sep 5
- FalconFlank: No material change; continue Office-macro remediation / sideload hunts. Sep 5
- MikroTrick (RouterOS): Continue Flagged/
ops/-2SSH hunts on exposed devices. Sep 6