Daily Security Intelligence Briefing — September 06, 2026
Tier 2 — Essential Intelligence (Summaries & Analysis)
1. Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Domain: E-Commerce / Vulnerability Management
Subject / Topic Summary: Dutch e-commerce security firm Sansec disclosed an unpatched zero-day vulnerability in Magento Open Source and Adobe Commerce dubbed StyleSmuggler. Threat actors began actively exploiting the flaw on September 4 to execute arbitrary code without authentication and install backdoors on e-commerce web servers.
Key Technical & Strategic Takeaways: Unpatched zero-day StyleSmuggler allows unauthenticated remote code execution on Adobe Commerce and Magento.; Attackers are actively deploying backdoors on vulnerable e-commerce platforms.
Essential Direct Quote: Sansec, which discovered the flaw and named it StyleSmuggler, said attacks started on September 4.
Source: The Hacker News
2. Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication
Domain: Network Infrastructure / Access Control
Subject / Topic Summary: CERT Polska issued a warning regarding ongoing attacks targeting internet-exposed SSH remote-access services on MikroTik routers. Attackers are obtaining full administrative control without authenticating, with confirmed malicious activity dating back to at least September 2.
Key Technical & Strategic Takeaways: Internet-exposed SSH on MikroTik routers allows attackers to gain admin control without credentials.; Administrators should immediately restrict external access to device management ports.
Essential Direct Quote: Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication...
Source: The Hacker News
3. Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
Domain: Supply Chain / Credential Compromise
Subject / Topic Summary: JetBrains reported a security breach affecting its Cadence environment following the exploitation of a critical TeamCity vulnerability. Threat actors extracted secrets and credentials, prompting JetBrains to urge all Cadence users to immediately revoke and rotate all associated credentials and secrets.
Key Technical & Strategic Takeaways: Unpatched TeamCity flaw was exploited to breach JetBrains Cadence infrastructure.; Users must rotate all secrets and AWS credentials associated with Cadence executions.
Essential Direct Quote: Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions...
Source: The Hacker News
4. Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
Domain: Virtualization / Privilege Escalation
Subject / Topic Summary: Broadcom released security patches for an integer-overflow vulnerability (CVE-2026-59346, CVSS 9.3) in VMware Workstation and Fusion. The bug enables local attackers with elevated privileges inside a virtual machine to escape guest isolation and execute arbitrary code on the host operating system.
Key Technical & Strategic Takeaways: CVE-2026-59346 allows elevated VM users to escape guest environments to execute code on the host.; Patches are now available across affected VMware Workstation and Fusion releases.
Essential Direct Quote: The vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges can exploit to run arbitrary code.
Source: The Hacker News
5. Over 5,400 Hacked Sites Serve ClickFix Payloads Stored on the Blockchain
Domain: Web Security / Social Engineering
Subject / Topic Summary: A large-scale cybercriminal campaign has compromised over 5,400 small-business websites to distribute ClickFix social engineering lures. The attackers are hosting malicious payloads within smart contracts on the BNB Smart Chain (BSC) to bypass traditional web takedown efforts.
Key Technical & Strategic Takeaways: Threat actors host social engineering payloads inside smart contracts on the BNB Smart Chain.; Over 5,400 compromised websites serve the malicious prompts to site visitors.
Essential Direct Quote: A massive cybercriminal operation is leveraging thousands of compromised small-business websites to deliver ClickFix payloads stored in smart contracts on the BNB Smart Chain (BSC).
Source: BleepingComputer