Threat Brief — 2026-09-09 — Patch Tuesday fallout and fresh root-escalation paths

Executive summary. Today's cycle is dominated by active-exploitation disclosures and privilege-escalation vectors landing alongside Microsoft's record September Patch Tuesday. A new cPanel flaw lets any hosting account with mail privileges escalate to root on the entire server, while a second Microsoft Defender zero-day PoC—dubbed ShieldCrash—surfaced immediately after Patch Tuesday with a working exploit. Google's seventh Chrome zero-day of the year is under active attack. Separately, Sophos published deeper analysis of the F5 BIG-IP APM fileless web-shell campaign, and N-able shipped its fourth N-central fix in recent weeks for a critical pre-auth RCE.

Top items

• cPanel flaw enables mail-privileged account to execute code as root. cPanel has patched a vulnerability that allows an authenticated hosting account with mail-related privileges to create arbitrary files via the EmailTrack feature and escalate to full server control. This is a severe multi-tenant hosting risk: any low-privileged tenant with mail access can potentially own the entire shared server. (src: The Hacker News)

• Microsoft Defender "ShieldCrash" zero-day PoC released; patch bypass demonstrated. A researcher published a proof-of-concept exploit for a Microsoft Defender zero-day granting SYSTEM-level access, released immediately after September Patch Tuesday. A second PoC shows the earlier ShieldBreak patch (CVE-2026-69414) can be bypassed, indicating the fix cycle for this attack surface is not yet stable. First reported today by BleepingComputer. (src: BleepingComputer, The Hacker News)

• Chrome V8 zero-day exploited in the wild — seventh Chrome zero-day of 2026. Google patched 230 vulnerabilities including CVE-2026-87491KEV, a V8 engine flaw under active exploitation enabling code execution inside the browser sandbox. The CVSS score has not been published. This is the seventh actively exploited Chrome zero-day patched this year. First reported today by BleepingComputer. (src: BleepingComputer, The Hacker News)

• Sophos details F5 BIG-IP APM fileless web-shell malware. Malware deployed after breaches of F5 BIG-IP Access Policy Manager appliances injects a PHP web shell directly into Apache's memory space, leaving no on-disk artifacts for filesystem scans to detect. The analysis deepens understanding of post-compromise persistence on network appliances. First reported 2026-09-08 by BleepingComputer. (src: The Hacker News)

• N-able N-central pre-auth RCE — fourth urgent fix in recent weeks. N-able has issued another critical patch for N-central, this time a pre-authentication remote code execution flaw that allows passwordless login. Administrators have had to update the platform four times in recent weeks, signalling a sustained attack surface on RMM tooling. First reported 2026-09-07 by BleepingComputer. (src: SecurityLab)

• Adobe Photoshop patches seven critical RCE vulnerabilities. A series of seven remote code execution flaws in Photoshop could be triggered by malicious files, making it a viable attack vector via shared or downloaded image projects. First reported today by SecurityLab. (src: SecurityLab)

• Cheap Wi-Fi repeater ships with unchangeable hardcoded root password. A budget Wi-Fi repeater was found to contain a hardcoded root credential that cannot be changed, giving anyone on the local network persistent administrative access. The device is described as costing less than a cup of coffee. (src: SecurityLab)

• DenoRAT trojan masquerades as official Deno runtime to steal Telegram sessions and drone data. The trojan targets Russian military personnel and financiers, exfiltrating Telegram session tokens, drone questionnaire data, and financial information. First reported today by SecurityLab. (src: SecurityLab)

• Telegram crashes from sub-kilobyte Lottie sticker via anomalous parameter. A malformed Lottie animation parameter causes Telegram's renderer to crash when processing a sticker under 1 KB. This is a denial-of-service vector that could be delivered through any chat. First reported today by SecurityLab. (src: SecurityLab)

Themes

Patch-gap exploitation. Three of today's top items—ShieldCrash, the Chrome V8 zero-day, and the N-able N-central RCE—involve either zero-days dropped immediately after a patch cycle or critical flaws in products with recent patch histories. Attackers are timing disclosures and exploits to exploit the window between patch release and widespread deployment.

Privilege escalation as the primary objective. cPanel-to-root, Defender-to-SYSTEM, and the Wi-Fi repeater's hardcoded root all represent low-friction paths from limited access to full control. The pattern underscores that initial access is often only the first step; defenders should give equal weight to containment and segmentation.