Daily Security Intelligence Briefing — September 08, 2026
Tier 2 — Essential Intelligence (Summaries & Analysis)
1. Adobe Commerce Zero-Day 'StyleSmuggler' Under Active Exploitation
Domain: Application Security / Zero-Day
Subject / Topic Summary: Attackers are actively exploiting a maximum-severity zero-day vulnerability (CVE-2026-75650, CVSS 10.0) in Adobe Commerce and Magento Open Source. Codenamed StyleSmuggler, the flaw allows unauthenticated attackers to execute arbitrary code and establish persistent backdoors by abusing Magento's Style properties.
Key Technical & Strategic Takeaways: Unauthenticated CVSS 10.0 flaw allows full system takeover on vulnerable e-commerce servers.; Attackers bypass existing web application security controls by abusing Magento Style property parsing to deploy PHP webshells and Rust backdoors.
Essential Direct Quote: When the attack succeeds, a backdoor background process is established...
Source: The Hacker News
2. WeChat Zero-Click Worm Takes Over Accounts via Incoming Calls
Domain: Mobile Security / Zero-Click Vulnerabilities
Subject / Topic Summary: Security firm Calif developed a zero-click worm capable of hijacking WeChat accounts across iOS and Android devices via incoming calls. The vulnerability requires no user interaction or answer from the recipient, though the attacker must already be in the victim's contact list.
Key Technical & Strategic Takeaways: Zero-click call-handling flaw enables complete account takeover without caller interaction.; Propagation relies on existing contact connections, allowing automated worm-like spreading across user networks.
Essential Direct Quote: The person being called does not have to answer or touch their phone for it to work, but the caller must already be one of their WeChat contacts.
Source: The Hacker News
3. FreeIPA Flaw Chain Enables Anonymous Creation of Admin Credentials
Domain: Identity Infrastructure / Privilege Escalation
Subject / Topic Summary: Red Hat disclosed a critical vulnerability chain affecting FreeIPA and 389 Directory Server. An unauthenticated client with no prior history in the domain can forge a Kerberos identity and leverage an LDAP database flaw to add itself directly to the domain administrators group.
Key Technical & Strategic Takeaways: Flaw chain permits unauthenticated attackers to gain domain admin privileges across Linux environments.; Requires chaining a FreeIPA identity creation bug with a secondary flaw in 389 Directory Server.
Essential Direct Quote: A flaw in FreeIPA lets a client that has never logged in create a Kerberos identity of its own choosing in the directory and end up in the administrators group...
Source: The Hacker News
4. PREY-0058 Vishing Attacks Target Executives for M365 Access
Domain: Cloud & Identity Security / Extortion
Subject / Topic Summary: Arctic Wolf is tracking an active campaign where threat actors impersonate internal IT help desks to vish corporate executives. Attackers steal M365 session tokens and route authentications through residential proxies to bypass location controls and conduct data theft and extortion.
Key Technical & Strategic Takeaways: Specifically targets directors and executives via phone-based social engineering to bypass MFA.; Stolen session tokens are combined with residential proxy networks to mask anomalous login activity.
Essential Direct Quote: IT help-desk vishing calls, stolen session tokens, and sign-ins routed through residential proxies are behind a wave of data theft and extortion...
Source: Help Net Security
5. BigBear 2.0 PhaaS Bypasses MFA Across 250+ Organizations
Domain: Identity Security / Phishing-as-a-Service
Subject / Topic Summary: CloudSEK uncovered BigBear 2.0, an updated phishing-as-a-service framework targeting Microsoft 365 environments. Operating via Adversary-in-the-Middle (AitM) relays, the service has stolen over 5,000 authenticated session cookies after users complete MFA prompts.
Key Technical & Strategic Takeaways: AitM phishing architecture successfully bypasses standard multi-factor authentication controls.; Over 5,000 enterprise session cookies harvested across at least 258 organizations.
Essential Direct Quote: The panel contained 5,000+ Microsoft credentials... harvested after victims complete multifactor authentication.
Source: CSO Online