Cybersecurity Radar — 2026-09-04

🔴 Critical Alerts

1. Google Patches Actively Exploited Chrome V8 Zero-Day (CVE-2026-85046) Google has released security updates for Chrome to patch CVE-2026-85046, a high-severity type confusion flaw in the V8 JavaScript engine. This vulnerability is currently being exploited in the wild and allows attackers to execute arbitrary code inside the browser sandbox via a crafted HTML page. It is the sixth Chrome zero-day exploited in 2026. Users are urged to update to Chrome version 152 or later immediately.

2. CISA Adds Seven Exploited Flaws to KEV Catalog The Cybersecurity and Infrastructure Security Agency (CISA) has added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The flaws affect widely used enterprise software including SonicWall, Artifactory, Switchvox, Starlette, Kestra, and LiteLLM. Attackers are reportedly deploying reverse shells and cryptocurrency miners upon successful exploitation. Federal agencies and private sector organizations must prioritize patching these systems to mitigate immediate risks.

Threat Landscape

Malicious .git Configs Target AI Coding Agents Researchers have identified a novel attack vector where malicious .git configuration files can trick AI coding agents—such as Claude, Codex, and Cursor—into executing attacker-controlled code. The flaw exploits how these agents handle git operations during worktree creation, allowing pre-trust execution of harmful scripts. This highlights significant security gaps in the emerging ecosystem of AI-assisted development tools.

BGP Hijack Delivers Malicious Virtualizor Update A sophisticated supply chain attack involving a Border Gateway Protocol (BGP) hijack has been used to deliver a malicious update for the Virtualizor virtualization platform. One hosting provider discovered root compromise on five of 34 checked hypervisors after installing the tampered update. This incident underscores the persistent threat of infrastructure-level attacks targeting software distribution channels.

H1 2026 Threat Report Highlights Abuse of Legitimate Tools A new report on H1 2026 malware trends indicates that threat actors primarily rely on abusing legitimate tools, trusted platforms, and routine workflows rather than developing entirely new malware. While AI is augmenting intrusion tradecraft, it has not replaced existing methods. The report notes widespread exploitation of exposed CVEs and persistent Remote Access Trojan (RAT) activity.

Vulnerabilities & Patches

Chrome CVE-2026-85046

• Severity: High
• Impact: Arbitrary Code Execution
• Status: Actively Exploited
• Action: Update Chrome to version 152.0.7963.0 or later.

SonicWall, Artifactory, and LiteLLM Flaws

• Context: Added to CISA KEV on September 2, 2026.
• Impact: Reverse shells, Crypto Mining.
• Action: Apply vendor patches immediately for all affected versions.

(Note: Specific CVSS scores for the newly added KEV items were not detailed in the source summary; refer to vendor advisories for exact scores.)

Breaches & Incidents

No confirmed new data breaches were reported in the last 24 hours in the provided sources. However, the Check Point Research report from late August highlighted the ongoing impact of the Manchester Airports Group cyberattack, which exposed passenger data, serving as a reminder of the aviation sector's vulnerability.

Industry & Policy

Symantec Report on Government and Tech Targeting A new report from the Symantec Threat Hunter Team reveals that specific attack methods have been used against government departments, technology companies, and hotels since February 2026. This sustained campaign highlights a shift in targeting priorities among certain threat groups, moving beyond traditional financial motives toward espionage and disruption.

What to Watch

• AI Supply Chain Security: Monitor developments regarding the exploitation of AI coding agents via .git configs. Expect increased scrutiny and potential patches from major AI vendors (Anthropic, OpenAI, etc.) in the coming weeks.
• Infrastructure-Level Attacks: The BGP hijack incident involving Virtualizor signals a rise in attacks targeting network routing and update servers. Organizations should verify update integrity through cryptographic signatures more rigorously.
• Chrome Patch Cadence: With six zero-days exploited in 2026 alone, watch for further emergency updates from Google as attackers accelerate their discovery of V8 engine flaws.

Reader Action Items

1. Update Chrome Immediately: Ensure all endpoints are running Chrome version 152 or later to mitigate the active CVE-2026-85046 exploit.
2. Audit Enterprise Software: Check if your organization uses SonicWall, Artifactory, Switchvox, Starlette, Kestra, or LiteLLM. If so, review CISA's KEV list and apply patches immediately to prevent reverse shell deployments.
3. Secure AI Development Workflows: If you use AI coding agents (Claude, Cursor, etc.), restrict access to untrusted repositories and audit .git configuration files for suspicious hooks or commands before cloning or executing them.