cyber.hendryadrian.com
Security News · thehackernews.com

Weekly Security Roundup: Chrome Zero-Day, RouterOS Exploits and Coder Supply-Chain Attack

· Original article ↗

Summary

Weekly roundup covers actively exploited flaws in N-able N-central, Chrome, MikroTik RouterOS, and Magento/Adobe Commerce, plus credential-stealing Coder registry modules, phishing techniques, and risks in SNMPv3 and AI summarization.

Key points

  • N-able patched N-central flaws including a pre-authenticated RCE; Huntress saw signs attackers may have exploited other flaws but could not confirm the specific entry point.
  • Google patched actively exploited Chrome V8 type-confusion flaw CVE-2026-85046.
  • CERT Polska reported active exploitation of the MikroTrick chain, which can enable unauthenticated control of remotely accessible MikroTik RouterOS devices; fixes are available.
  • Attackers exploited the StyleSmuggler zero-day in Magento and Adobe Commerce to inject PHP code and install a Rust backdoor.
  • Attackers compromised Coder’s Cloudflare infrastructure and used unauthorized registry servers to distribute credential-stealing Terraform modules; stolen data was reportedly sent to coder-infra[.]com.
  • RevStealer was distributed through game-cheat videos and rogue GitHub repositories, while the Knight Office phishing kit targeted Microsoft 365 session tokens.
  • Other findings included SNMPv3 pre-authentication information leakage across about 470,000 exposed endpoints, text-based QR phishing, and indirect prompt injection targeting an email summarizer.

Article Details

Event Type
Weekly cybersecurity incident and vulnerability roundup
Impact
The recap reports active exploitation of vulnerabilities affecting N-able N-central, Google Chrome, and MikroTik RouterOS, as well as a zero-day used to backdoor Magento and Adobe Commerce stores. It also describes a Coder supply-chain compromise that exfiltrated credentials and secrets, phishing activity, and malware distribution. N-able said it had no confirmation of production exploitation, while Huntress reported signs attackers were likely exploiting two N-central flaws but could not confirm the exact exploit.

Indicators of compromise

TypeIndicatorContext
DOMAINcoder-infra[.]comLookalike domain to which data stolen in the Coder supply-chain attack was exfiltrated.
IPV4103[.]102[.]31[.]18IP address CERT Polska said was used in attempts to exploit the MikroTik RouterOS vulnerability chain.
IPV482[.]192[.]72[.]4IP address from which CERT Polska said observed successful MikroTik RouterOS attacks originated.
IPV499[.]84[.]67[.]186C2 server that the Rust backdoor deployed in compromised Magento and Adobe Commerce stores connects to.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAttackers exploited unauthenticated vulnerabilities in N-central, RouterOS, and Magento or Adobe Commerce to gain access or execute code.T1195.002 · Compromise Software Supply ChainAttackers compromised Coder's registry infrastructure and delivered malicious Terraform modules through the software supply chain.T1566 · PhishingThe recap describes phishing lures used to distribute malware and direct victims to credential- and session-token-theft pages.

CVE

CVE-2026-67276A total of fix flaws (CVE-2026-67276, CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, CVE-2026-67281, and CVE-2026-86060) have been identified.CVE-2026-85046The high-severity vulnerability, tracked as CVE-2026-85046 (CVSS score: 8.8), has been described as a type confusion bug in V8, Chrome’s JavaScript and WebAssembly engine.CVE-2026-86060A total of fix flaws (CVE-2026-67276, CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, CVE-2026-67281, and CVE-2026-86060) have been identified.CVE-2026-86206Critical N-central Flaws — N-able has released hotfixes to address two severe N-central flaws (CVE-2026-86206 and CVE-2026-86207) that could allow an unauthorized party to bypass authentication controls and gainCVE-2026-86207Flaws — N-able has released hotfixes to address two severe N-central flaws (CVE-2026-86206 and CVE-2026-86207) that could allow an unauthorized party to bypass authentication controls and gain full access to theCVE-2026-86218Also patched is a maximum-severity security flaw (CVE-2026-86218, CVSS score: 10.0) that could allow for pre-authenticated remote code execution on the N-central server.

People

Amir YaryabSenior Iranian official whom the U.S. State Department alleges leads the IRGC's Cyber-Electronic Command and oversees operations by affiliated groups.Kobi Ben-NaimMalanta Co-Founder and CEO quoted on pre-authentication information leakage in SNMPv3.Salvatore GuliziaSecurity researcher credited with discovering and reporting the Chrome vulnerability CVE-2026-85046; the article says he is also known as Serotav.

Threat Actors

Amir YaryabThe U.S. State Department alleges that he leads the IRGC-CEC and oversees operations conducted by its affiliated cyber groups.CyberAv3ngersIdentified by the U.S. State Department as a malicious cyber group affiliated with the IRGC-CEC and involved in operations targeting civilian infrastructure.Dadeh Afzar Arman (DAA)Identified by the U.S. State Department as a malicious cyber group affiliated with the IRGC-CEC and involved in operations targeting civilian infrastructure.Mehrsam Andisheh Saz Nik (MASN)Identified by the U.S. State Department as a malicious cyber group affiliated with the IRGC-CEC and involved in operations targeting civilian infrastructure.

Malware

RevStealer#Nable

Vendors

Adobeactive exploitation of critical flaws in N-able N-central, Google Chrome, MikroTik RouterOS, and Magento/Adobe Commerce, alongside supply-chain abuse and phishing tricks that bypass common defenses.CloudflareAttack on Coder — Attackers compromised Coder’s Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code to harvest environmentCoder#NableGoogleThis week’s security recap highlights active exploitation of critical flaws in N-able N-central, Google Chrome, MikroTik RouterOS, and Magento/Adobe Commerce, alongside supply-chain abuse and phishing tricks that bypassMikroTiksecurity recap highlights active exploitation of critical flaws in N-able N-central, Google Chrome, MikroTik RouterOS, and Magento/Adobe Commerce, alongside supply-chain abuse and phishing tricks that bypassN-ableThis week’s security recap highlights active exploitation of critical flaws in N-able N-central, Google Chrome, MikroTik RouterOS, and Magento/Adobe Commerce, alongside supply-chain abuse and phishing tricks that bypass

Products

Adobe Commerceexploitation of critical flaws in N-able N-central, Google Chrome, MikroTik RouterOS, and Magento/Adobe Commerce, alongside supply-chain abuse and phishing tricks that bypass common defenses.Claude Opus 5The malware is distributed via social engineering attacks, using YouTube videos claiming to advertise hacks for the Albion Online game or rogue GitHub repositories for Anthropic’s Claude Opus 5 Free Desktop project.Google ChromeThis week’s security recap highlights active exploitation of critical flaws in N-able N-central, Google Chrome, MikroTik RouterOS, and Magento/Adobe Commerce, alongside supply-chain abuse and phishing tricks that bypassMagentoactive exploitation of critical flaws in N-able N-central, Google Chrome, MikroTik RouterOS, and Magento/Adobe Commerce, alongside supply-chain abuse and phishing tricks that bypass common defenses.MikroTik RouterOSsecurity recap highlights active exploitation of critical flaws in N-able N-central, Google Chrome, MikroTik RouterOS, and Magento/Adobe Commerce, alongside supply-chain abuse and phishing tricks that bypass commonN-centralThis week’s security recap highlights active exploitation of critical flaws in N-able N-central, Google Chrome, MikroTik RouterOS, and Magento/Adobe Commerce, alongside supply-chain abuse and phishing tricks that bypassTerraformCoder’s Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code to harvest environment variables, API keys, CI/CD

Tools

Knight OfficeNew Knight Office Microsoft 365 AitM Phishing Kit — A new adversary-in-the-middle (AiTM) phishing toolkit called Knight Office has been spotted in the wild using Docusign-themed lures to direct victims to fake landing

Countries

GermanyLast month, Apple agreed to make changes to the feature across almost all ​European Union countries following a probe in Germany.

Industries

E-commerceUnpatched Magento and Adobe Commerce 0-Day Exploited to Backdoor Online Stores — E-commerce storefronts are being compromised to inject a backdoor by exploiting an unpatched Magento and Adobe Commerce zero-day dubbedGaming“Beyond credential theft, REVSTEALER targets gaming platforms for additional monetization; the developer clearly understands that victim accounts on these platforms hold real monetary value in resale markets,” Elastic

Related Articles