The 5-Minute Cyber Brief: September 10, 2026

By George Bailey   Published: 09/09/26   Updated: 09/24/26   2 min read
Cybersecurity

Published: 09/10/26

Today’s pattern is shared kits and authentication that fails open: a Chrome exploit chain four espionage groups picked up in days, an orchestrator that trusted a suffix match, an AI gateway that swapped failed auth for an empty session object, and a Windows Update Stack zero-day that turns footholds into SYSTEM.

Lead Story

BlueMoon Turns Chromium’s Patch Gap Into a Shared Espionage Kit

Proofpoint’s BlueMoon kit chains CVE-2026-85046 (V8 type confusion), a V8 sandbox escape, and CVE-2026-85880 (Windows ALPC LPE). Both V8 issues were patch-gap zero-days—fixed upstream weeks before stable Chrome/Edge. Four clusters (TA412, UNK_LateNight, UNK_QuietRacket, UNK_DoubleCheck) adopted it from late August into early September. CISA has both CVEs in KEV.

Why it matters: Force Chromium to current stable, apply September Windows updates for the ALPC bug, and hunt chrome → cmd → curl → msgbox.exe trees plus fake Gemini extensions.

Read more on CyberExperts: Read the analysis

Also Worth Your Attention

Kestra’s endsWith(“/configs”) Badge Skip

CVE-2026-49869 (CVSS 10.0) lets unauthenticated callers create and run workflows named configs, yielding root RCE in the worker via default script plugins. Fixed in 1.0.45 / 1.3.21. KEV since September 2.

Why it matters: Orchestration hosts hold credentials and cloud reach. Patch, hunt flows named configs, and treat exposed instances as incident-grade.

Read more on CyberExperts: Read more

LiteLLM’s Empty MCP Session Object

CVE-2026-59822 lets arbitrary Bearer tokens fall through to an empty UserAPIKeyAuth() on MCP Streamable HTTP routes before 1.84.0. KEV deadline September 16 for federal civilian agencies.

Why it matters: AI gateways broker model keys and tools. Upgrade, lock down /mcp, rotate reachable secrets.

Read more on CyberExperts: Read more

Windows Update Stack Link-Following Zero-Day

CVE-2026-81963 (CVSS 7.8) is an exploited Update Stack elevation of privilege to SYSTEM on Windows 11 and Server 2025. KEV September 8. Exploitation Detected outranks the base score for triage.

Why it matters: Stage-two for every foothold. Ship September cumulatives in parallel with domain-controller critical RCEs from the same Patch Tuesday.

Read more on CyberExperts: Read the analysis

Go Deeper

Related reading: Cybersecurity Tools · Cybersecurity Frameworks · Get the Daily Brief

Editorial Promise

CyberExperts should help you turn headlines into decisions. The value is in pulling the operational facts forward before the day turns them into background noise.

Start your morning with the signal that matters.

Subscribe to the 5-Minute Cyber Brief

Stay Current

Newer CyberExperts coverage on this topic

This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.

Latest Daily Brief

Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler

The fastest way to catch up on what changed after this article was published.

Read Today's Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].