September 4, 2026 by sig9

Hacker Wars - September 04, 2026

Your daily dose of infosec chaos

Google shipped an emergency fix for an actively exploited Chrome zero-day, WordPress admins are catching 440,000+ exploit attempts to the face, and a dev-tools vendor got supply-chain’d through its own registry. Meanwhile OpenAI’s latest model aced an exploit benchmark and a French hospital learned that GDPR fines are very real. Busy day.

Google Patches Actively Exploited V8 Zero-Day In Chrome

Chrome 152 fixes 12 vulnerabilities, including CVE-2026-85046, a high-severity type confusion bug in the V8 engine that Google confirms is being exploited in the wild. That makes six Chrome zero-days patched this year, which feels less like a trend and more like a subscription. Type confusion in V8 is the classic stepping stone to full remote code execution from simply visiting a page.

What to do: Push Chrome 152 everywhere now, including Electron and Chromium-based apps that bundle their own browser.

Half A Million Exploit Attempts Hammer WordPress Plugin Flaws

Wordfence counted over 440,000 exploit attempts against critical flaws in Super Forms (CVE-2026-14894, CVSS 9.8, missing file type validation) and the Elementor Pro RCE chain. Mass scanning started roughly instantly after disclosure, because of course it did. A successful hit means arbitrary file uploads and webshells on your web server.

What to do: Update or remove Super Forms and Elementor Pro today, and grep your uploads directory for surprise PHP files.

Coder Registry Compromise Served Malicious Terraform Modules

Attackers compromised Coder’s Cloudflare infrastructure and quietly added unauthorized registry servers pushing Terraform modules laced with credential-stealing code. When your infrastructure-as-code platform is the threat vector, the trust model gets awkward fast. Malicious modules execute with whatever cloud credentials your pipelines hold, which is usually “all of them”.

What to do: Audit module sources and provider configs, rotate pipeline credentials, and pin your registries to an allowlist.

GPT-6 Astra Aces ExploitBench And Hits Critical Cyber Threshold

OpenAI unveiled GPT-6 Astra days after admitting the model crossed the “Critical” cybersecurity capability line in its Preparedness Framework, having scored 100% on ExploitBench. The company is now blocking proof-of-concept exploit requests, which tells you how capable it thinks the thing is. Offensive AI capability going mainstream changes attacker economics, not just defender homework.

What to do: Refresh your AI usage and data-handling policies before someone’s “productivity agent” starts doing red-team homework.

French Hospital Fined EUR 500,000 After Breach Exposes 727,000 People

CNIL slapped Hôpital privé de la Loire with a 500,000 euro fine after a breach exposed data belonging to 727,000 patients and relatives, citing inadequate protection measures. Healthcare data remains the crown jewels, and regulators have clearly run out of patience. The fine is smaller than the remediation bill, and both are cheaper than doing security properly the first time.

What to do: Check that controls on health data match its sensitivity - encryption, access control, and actual detection coverage.

Until next time, may your logs be clean and your alerts be false positives.

Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown

This bulletin is provided for informational purposes. Contact us for tailored security analysis.