MikroTik routers, Magento zero-day, and Chromium V8 actively exploited

MikroTik routers with internet-exposed SSH are being hijacked without authentication [1]. REVSTEALER malware disables Windows Defender and Update to run crypto miners [2]. Magento and Adobe Commerce face unpatched zero-day exploitation [3].

MikroTik routers with remote-access SSH exposed to the internet are being compromised without authentication, granting full administrative control.

REVSTEALER, an emerging Windows information stealer, deploys four post-infection modules that disable Microsoft Defender and Windows Update before running cryptocurrency miners.

A new unpatched vulnerability in Magento Open Source and Adobe Commerce allows unauthenticated remote code execution to backdoor online stores.

JetBrains disclosed that threat actors exploited a TeamCity vulnerability to breach its Cadence environment and extract AWS credentials.

Google Chromium V8 type confusion vulnerability ( CVE-2026-85046 ) is now in CISA’s Known Exploited Vulnerabilities catalog, affecting Chrome, Edge, and other Chromium-based browsers.

1. MikroTik Router Hijacking via Unauthenticated SSH

Severity: HIGH Affected: Telecom , Technology

Attackers are exploiting MikroTik routers with Internet-exposed SSH access to gain full administrative control without requiring authentication [1] . According to CERT Polska’s attack warning issued September 5, successful compromises have been documented since at least that date ⚠ [1] . Attackers gain unrestricted access to router configuration and network traffic when SSH is reachable from the public internet without proper credential enforcement. Sources: [1] The Hacker News

Audit all MikroTik router deployments for internet-facing SSH services; disable public SSH access or restrict to allowlisted IP ranges immediately.

Rotate all administrative credentials and review access logs for unauthorized logins.

Apply the latest MikroTik firmware patches and enable strong authentication (SSH key-only or multi-factor).

Monitor for unusual configuration changes or traffic anomalies.

2. REVSTEALER Information Stealer Disables Endpoint Security

Severity: HIGH Affected: Technology

Elastic Security Labs has documented four previously unreported modules associated with REVSTEALER, an emerging Windows information stealer, that persist on compromised machines after the stealer itself self-deletes [1] . One module disables Windows Update and Microsoft Defender before launching a cryptocurrency miner ⚠ [1] . This post-infection persistence mechanism reduces detection visibility and enables sustained malicious activity on infected hosts. Sources: [1] The Hacker News

Enable tamper protection and real-time monitoring on Windows Defender; configure Group Policy to prevent unauthorized disabling.

Deploy endpoint detection and response (EDR) solutions to detect post-exploitation modules independently.

Monitor for disabled Windows Update and Defender services; alert on any unauthorized service stops.

Review telemetry for cryptocurrency mining processes or unusual CPU consumption patterns.

3. Unpatched Magento and Adobe Commerce Zero-Day Exploitation

Severity: CRITICAL Affected: Retail , Technology

Attackers are actively exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that permits unauthenticated remote code execution on e-commerce servers [1] . Sansec, a Dutch e-commerce security company, published an advisory on September 5 detailing active exploitation in the wild [1] . The vulnerability allows attackers to inject malicious code without requiring any form of authentication or valid login credentials, creating a direct backdoor into affected online stores. Sources: [1] The Hacker News

Immediately isolate or take offline any Magento or Adobe Commerce instances that cannot be patched pending vendor release.

Monitor web server logs and application activity for anomalous code execution requests or shell uploads to webroot directories.

Implement Web Application Firewall (WAF) rules to block known exploitation patterns pending official patches.

Review order history and customer data for signs of tampering; reset all admin and API credentials.

Sansec or Magento/Adobe security for detailed exploitation indicators and forensic guidance.

4. JetBrains Cadence Breach via TeamCity Vulnerability

Severity: HIGH Affected: Technology

JetBrains disclosed a security incident in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach JetBrains’ own Cadence environment and extract AWS credentials [1] . JetBrains is urging all Cadence users to immediately revoke and rotate all stored credentials [1] . This represents a supply-chain risk whereby a development tool provider’s own infrastructure was compromised, potentially exposing customer credentials or intellectual property. Sources: [1] The Hacker News

Revoke and rotate all AWS credentials and API keys that may have been stored in JetBrains Cadence environments.

Review CloudTrail and AWS API logs for unauthorized API calls using stolen credentials; check for resource creation, data access, or IAM modifications.

Ensure TeamCity instances are patched to the latest security release; disable or restrict public access pending vulnerability remediation.

Audit all developers’ Cadence accounts and CI/CD integrations for suspicious activity or permission changes.

5. Google Chromium V8 Type Confusion Now Actively Exploited

Severity: HIGH Affected: Technology

CVE-2026-85046, a type confusion vulnerability in Google Chromium V8, has been added to the CISA Known Exploited Vulnerabilities catalog as of September 4, 2026, with a federal remediation deadline of September 18, 2026 [1] . The vulnerability allows remote attackers to execute arbitrary code inside the Chromium sandbox via a crafted HTML page [1] . It affects multiple web browsers including Google Chrome, Microsoft Edge, and Opera [1] . Sources: [1] CISA KEV

Prioritize immediate updates to Chrome, Edge, and all Chromium-based browsers to the latest security patch.

Deploy browser updates via mobile device management (MDM) or group policy for enterprise endpoints.

Block access to known malicious HTML payloads via endpoint security and network monitoring.

Educate users to avoid clicking suspicious links or visiting untrusted websites pending full patching.

Today’s Action Checklist

☐ URGENT: Audit and isolate internet-exposed MikroTik SSH services; rotate administrative credentials.

☐ URGENT: Identify and isolate any Magento or Adobe Commerce systems; review logs for exploitation indicators.

☐ URGENT: Revoke and rotate AWS and Cadence credentials across development teams.

☐ HIGH: Prioritize Chromium-based browser updates (Chrome, Edge) to latest security release across all endpoints.

☐ HIGH: Enable Windows Defender tamper protection and audit for REVSTEALER post-exploitation modules on infected systems.

☐ Monitor CISA KEV and vendor advisories daily for patches to Magento/Adobe Commerce and TeamCity vulnerabilities.