Daily Cybersecurity Intelligence — 3 September 2026

Executive Briefing

Cybersecurity reporting on 3 September combined immediate patching priorities with major privacy and supply-chain developments. Manchester Airports Group’s previously disclosed breach escalated when an extortion group reportedly published roughly 550 GB of data connected to about 8.8 million people after the operator declined to pay.[1] [2] Cisco reporting highlighted a critical Nexus 9000 flaw that could permit unauthenticated root-level code execution, while HPE addressed a critical unauthenticated ArubaOS-CX remote-code-execution issue.[4] [6] [9] A compromise of Coder’s registry delivery infrastructure showed how a poisoned developer module can reach cloud, CI/CD, AI-tooling, and workspace credentials even when the software project itself is legitimate.[11] [12]

Web administrators faced active exploitation of Elementor Pro CVE-2026-32475, while Plex users received an urgent update notice without public CVE details.[13] [15] Privacy reporting covered C-Track court-system files and a criminal marketplace allegedly offering 153 million driver-license images.[17] [20] Research also documented misuse of the legitimate Node.js runtime, BraZetsu access-broker tooling, remote-management phishing, Pegasus targeting of Serbian civil society, and an unconfirmed CrowdStrike Falcon privilege-escalation claim.[22] [24] [26] [28] [30] CISA and the G7 Cyber Security Working Group closed the day with a strategic call for governments and organizations to begin post-quantum migration planning now.[32]

Verified Developments at a Glance

| Priority | Development | Category | Affected surface | Evidence confidence |

| --- | --- | --- | --- | --- |

| Critical | Cisco Nexus 9000 CVE-2026-20212 could allow unauthenticated root code execution | Network security | Ten Silicon One-based Nexus 9000 switch models | High |

| Critical | HPE patched ArubaOS-CX CVE-2026-73749 and additional switch flaws | Network security | Multiple ArubaOS-CX branches | High |

| Critical | Elementor Pro CVE-2026-32475 was exploited for webshell delivery | Web security | WordPress sites through Elementor Pro 4.2.1 with affected form configuration | High |

| Critical | Coder registry compromise delivered credential-stealing modules | Software supply chain | Coder module downloads during the 31 August compromise window | High; primary disclosure predates window |

| High | MAG-linked data was reportedly published after ransom refusal | Data breach and extortion | Airport booking, parking, lounge, Fast Track and Wi-Fi records | High for breach; some leak claims remain actor-reported |

| High | Thomson Reuters C-Track files were obtained from court environments | Data breach and privacy | Courts in multiple U.S. and Canadian jurisdictions | High |

| High | 153 million driver-license images were reportedly offered through a criminal service | Identity data | U.S. and Canadian identity documents | Medium–High; provider scope not fully confirmed |

| High | Plex urged immediate updates for server and desktop products | Product security | Plex Media Server 1.43.2 and earlier; Plex Desktop before 1.115.0 | Medium–High; technical details withheld |

| High | Node.js was used as a trusted execution layer in targeted malware activity | Malware and living-off-the-land | Government, technology and hospitality environments | High |

| High | BraZetsu supported commercial access brokerage from compromised Windows hosts | Cybercrime | Iberian and Latin American organizations | High; original research dated 31 August |

| High | Pegasus zero-click compromise of a Serbian activist was newly reported | Spyware and civil society | High-risk Apple users | High; exact infection date withheld |

| Watch | FalconFlank PoC claimed CrowdStrike Falcon privilege escalation | Endpoint security | Specific Falcon remediation configuration | Medium; no CVE or vendor confirmation at report close |

| Strategic | G7 working group issued five post-quantum migration priorities | Cryptographic resilience | Governments, critical infrastructure and technology procurement | High |

1. Manchester Airports Group Data Was Reportedly Leaked After Ransom Refusal

Manchester Airports Group had already confirmed that an unauthorized party obtained customer information connected to Manchester, London Stansted, and East Midlands airports.[2] The operator said the affected data included email addresses, phone numbers, vehicle registrations, and postcodes linked to car park, lounge, Fast Track, and Wi-Fi services. It said bank and payment information, aviation security, passenger safety, airport operations, and existing bookings were not affected.[2]

On 3 September, SecurityWeek reported that the FulcrumSec extortion group published roughly 550 GB of data after MAG declined to pay a ransom, with records connected to approximately 8.8 million people.[1] The group claimed access originated from exposed administrative keys, but that technical assertion was not independently established in the reviewed company notice. The leak date is the material development for this report; the underlying breach was disclosed on 27 August.

Defensive actions

Affected customers should expect targeted phishing or smishing that reuses booking, vehicle, contact, or location context. They should avoid unexpected payment or password requests, verify airport communications through official channels, and review accounts where exposed contact information may aid social engineering. Organizations should treat client-side secrets and administrative keys as compromised, remove them from public code, rotate them, and review their historical use.

2. Cisco Addressed Critical Switch Flaws and Secure Email Disclosure Risk

Cisco’s Nexus 9000 advisory described CVE-2026-20212, a critical flaw affecting ten Silicon One-based switch models.[6] Affected services exposed TCP ports 43210 and 43211 in the default Layer 3 virtual routing and forwarding instance. An unauthenticated remote attacker able to reach those ports could send crafted input that executes as root or crashes the S1HAL process and reloads the device.[4] [6]

Cisco also published an IOS XR hardening release addressing several vulnerabilities, including CVE-2026-20274 and CVE-2026-20279, both rated 9.8, and Secure Email S/MIME issues CVE-2026-20354 and CVE-2026-20355 that could expose decrypted content under specific conditions.[4] [7] [8] Cisco said it was not aware of malicious exploitation when the advisories were issued.[4]

Defensive actions

Operators should identify affected models and software trains, move to the fixed Cisco releases, and apply Cisco’s documented infrastructure access-control lists so only required management and control-plane traffic reaches device interfaces. Cisco Live Protect shielding may provide a temporary layer for CVE-2026-20212, but it is not a substitute for upgrading.[4] [6]

3. HPE Patched Critical ArubaOS-CX Remote Code Execution

HPE addressed CVE-2026-73749, a CVSS 9.8 buffer overflow in an ArubaOS-CX daemon that could allow an unauthenticated remote attacker to execute code with elevated privileges by sending malformed input.[9] [10] The bulletin covered several release branches and also documented twenty-three additional vulnerabilities, including command execution, arbitrary file writing, authentication bypass, default-password risk, denial of service, and stored cross-site scripting.[9]

HPE reported no known active exploitation or public proof of concept at publication. Fixed targets included 10.18.1002 or later, 10.17.1030 or later, 10.16.1060 or later, 10.13.1190 or later, and 10.10.1181 or later, depending on the deployed branch.[9] [10]

Defensive actions

Network teams should inventory ArubaOS-CX devices, map each branch to the appropriate fixed release, restrict management exposure, and monitor for unexpected traffic targeting switch daemons. End-of-maintenance branches should be treated as migration risks rather than long-term secure platforms.

4. Coder Registry Infrastructure Served Credential-Stealing Modules

Coder’s advisory said an unidentified actor gained access to its Cloudflare infrastructure and added unauthorized addresses to the pool serving registry.coder.com.[12] The rogue servers distributed modified registry artifacts designed to identify credentials and exfiltrate them to the lookalike domain coder-infra.com. The affected download window ran from 07:35 UTC to 21:45 UTC on 31 August, and the vendor published the advisory on 1 September; BleepingComputer’s detailed report appeared on 3 September.[11] [12]

Potentially exposed material included environment variables, configuration files, terminal history, cloud credentials, AI-tooling keys, CI/CD tokens, Git credentials, workspace OIDC tokens, and, in some configurations, application or database secrets.[12] Coder released patched versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9 and provided SQL queries and indicators for identifying or purging cached modules.[12]

Defensive actions

Potentially affected operators should review module downloads and workspace builds inside the vendor’s UTC window, search DNS, proxy, firewall, and VPC-flow logs for the reported domain or IP, clear cached modules, upgrade Coder, and rotate every credential reachable by the provisioner or an affected workspace. This is a credential-exposure investigation, not only a software update.

5. Elementor Pro Exploitation Delivered Webshells

Wordfence reported active exploitation of CVE-2026-32475, a critical unauthenticated file-upload vulnerability in Elementor Pro versions through 4.2.1.[13] [14] Exploitation requires an affected Form widget with at least one non-required file-upload field. Attackers could bypass file-type controls, upload executable PHP, run commands, and take over the site. Wordfence reported more than 190,000 blocked exploit attempts since 19 August.[14]

Elementor fixed the flaw in version 4.2.2.[13] The exploitation evidence and wide installation base make patching urgent even though the vulnerability’s original disclosure and exploitation onset predated 3 September.

Defensive actions

Update Elementor Pro to 4.2.2 or later, review the Elementor form upload directory for unexpected PHP files, inspect requests to the form-submission endpoint, remove unused upload fields, validate administrator accounts, and rotate site secrets after suspected compromise. A web application firewall can reduce exposure but should not replace the update.

6. Plex Issued an Urgent Update Without Public Vulnerability Detail

Plex advised users to update Plex Media Server 1.43.2 and earlier and Plex Desktop releases before 1.115.0.[15] [16] The provider said CVE identifiers had been requested but did not publish technical details, affected attack paths, or exploitation evidence. Plex Media Server 1.43.3 and Plex Desktop 1.115.0 contain the relevant fixes.[15] [16]

Defensive actions

Update through Plex’s official downloads and confirm the installed version afterward, particularly on NAS platforms where package repositories may lag. Internet-exposed media servers should be reviewed for unexpected sessions, plugins, configuration changes, or outbound connections. The lack of technical disclosure increases the value of prompt version confirmation.

7. C-Track Court-System Breach Raised Sealed-Record and Identity Risks

Thomson Reuters disclosed unauthorized activity in the C-Track cloud environment used by courts.[17] The activity occurred in March 2026 and was identified on 30 June. Official court notices said an unauthorized party obtained certain files, potentially including names, Social Security numbers, driver-license numbers, dates of birth, medical or health-insurance information, and sealed court material.[18] [19]

The affected footprint included courts in eleven U.S. states, the U.S. Virgin Islands, and Ontario, Canada. Thomson Reuters said it found no operational disruption to C-Track and no evidence that financial systems were affected.[17]

Defensive actions

Potentially affected individuals should follow official court notices, monitor identity and credit activity, and treat case-specific messages with caution. Courts should verify local exposure, preserve relevant logs, review access to exported files, and coordinate notification where sealed, juvenile, health, or identity records may have been involved.

8. Criminal Service Allegedly Offered 153 Million Driver-License Images

KrebsOnSecurity reported that a dark-web service called Nexus advertised more than 153 million U.S. and Canadian driver-license images, along with additional identity, travel, and medical documents.[20] SecurityWeek reported the material on 3 September.[21] The dataset was suspected to originate from IDScan.net, and the FBI’s New Orleans field office was reported to be investigating, but IDScan.net had not publicly confirmed the full claimed scope when the reviewed reports were published.[20] [21]

Because the headline quantity and source attribution rely partly on the seller’s claims, the scale should be treated as alleged rather than a verified victim count.

Defensive actions

Organizations that collect identity documents should minimize retention, segregate document images from ordinary application data, monitor bulk access, and require verifiable deletion and incident evidence from identity-service providers. Individuals whose license images may be exposed should watch for identity verification abuse and consider credit freezes where available.

9. Attackers Used Node.js as a Trusted Malware Execution Layer

Symantec research published on 3 September described attackers installing or reusing the legitimate Node.js runtime to execute malicious JavaScript and maintain persistence.[22] [23] Observed campaigns targeted government departments, technology companies, and hotels in Asia and the United States. Some operations retrieved commands or payloads through Ethereum blockchain gateways, a technique often described as EtherHiding.[23]

This is not a Node.js vulnerability. The risk comes from an approved or signed runtime executing attacker-controlled scripts, which can reduce the value of binary-signature detection alone.

Defensive actions

Identify Node.js installations on systems that do not require development tooling, review Run keys and scheduled persistence for node.exe, inspect its parent processes and command lines, and alert on scripts launched from temporary or user-writable directories. Unexpected blockchain RPC traffic should be investigated when no approved business use exists.[23]

10. BraZetsu Commercialized Access to Compromised Windows Hosts

Group-IB research described BraZetsu, a Python-based Windows malware framework linked to the Brazilian actor Exilware.[24] [25] The toolkit collects credentials, browser data, certificates, screenshots, and financial files and supports a marketplace where compromised access is sold. Group-IB said the backend uses generative AI for data triage and prioritization, while persistent command-and-control uses WebSockets.[25]

The primary research was published on 31 August; the material became part of the wider specialist news cycle on 3 September.[24] It therefore belongs in this report as newly circulated research, not as a newly launched 3 September campaign.

Defensive actions

Monitor unusual Python or Nuitka-compiled executables, unknown WebSocket sessions, suspicious fake browser-update lures, access to financial remittance files, and credential collection from browsers or certificate stores. Limit standing privilege and treat commercial initial access as an identity and persistence problem, not simply a malware-cleanup event.

11. RMM Phishing Used Legitimate Tools and Rapidly Rotating Infrastructure

ANY.RUN research described a campaign spanning forty-six countries that used localized fake documents, password-protected archives, compromised websites, and disposable Vercel infrastructure to install legitimate remote monitoring and management tools.[26] [27] Abused products included GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian. North American activity accounted for a majority of the reviewed cases, with the United States the largest individual target.[26]

The primary report was published in late August, so this entry is included as 3 September specialist coverage of an ongoing campaign rather than a new same-day incident.

Defensive actions

Maintain an explicit allowlist of approved RMM products and tenants, alert on any unexpected RMM installation regardless of code signature, inspect password-protected document delivery, monitor new free-hosting or disposable domains, and focus detection on the recurring delivery chain rather than short-lived URLs alone.[27]

12. Pegasus Zero-Click Infection Targeted Serbian Civil Society

Citizen Lab and SHARE Foundation reported that a member of Serbia’s student protest movement was infected with NSO Group’s Pegasus spyware through an iMessage zero-click exploit.[28] [29] High-confidence infection indicators covered a period between December 2025 and January 2026. Citizen Lab said the exploit targeted a vulnerability addressed by Apple in iOS 18.4.1.[29]

The disclosure also followed Apple threat notifications sent to users in numerous countries. The exact infection date was withheld, and the reviewed evidence did not publicly identify the operator behind the infection.[28] [29]

Defensive actions

High-risk users should install operating-system updates promptly, enable Lockdown Mode where appropriate, and treat an Apple threat notification as requiring expert incident support rather than ordinary troubleshooting. Organizations supporting journalists, activists, lawyers, political groups, and civil society should maintain a specialist escalation path and preserve devices for forensic analysis.

13. FalconFlank PoC Remained an Unconfirmed Endpoint-Security Claim

A researcher published FalconFlank, a proof of concept claiming local privilege escalation through CrowdStrike Falcon’s Office macro-remediation behavior.[30] [31] The researcher said the technique worked under a specific Windows and Falcon configuration. At report close, the reviewed material contained no CVE, confirmed exploitation, or final CrowdStrike advisory, and vendor confirmation remained incomplete.[30]

Defensive actions

Treat this as a watch item rather than a confirmed broadly exploitable vulnerability. Follow CrowdStrike guidance, restrict unnecessary local administrative access, retain endpoint telemetry, and monitor for unexpected DLL or file operations associated with Office remediation. Avoid disabling broad endpoint protections solely on the basis of an unverified public claim.

14. G7 Working Group Called for Immediate Post-Quantum Migration Planning

CISA and the G7 Cyber Security Working Group published Preparing for the Post-Quantum Era: A Call to Action on 3 September.[32] The document identified five priorities: raise awareness of quantum risk and post-quantum cryptography; develop national adoption strategies; advance quantum-safe research and development; expand public-private cooperation; and integrate post-quantum requirements into cybersecurity rules and procurement.[32]

Practical takeaway: Post-quantum migration is an inventory and dependency-management program before it is a cryptographic replacement project.

Organizations should identify where vulnerable public-key cryptography protects long-lived sensitive data, authentication, software signing, VPNs, certificates, and supplier integrations. Procurement and architecture teams should require algorithm agility and migration evidence so new technology does not extend the lifetime of legacy cryptographic dependencies.

Watchlist

| Item | What remains uncertain | Evidence that would change the assessment |

| --- | --- | --- |

| MAG extortion leak | Independent validation of the complete 550 GB and 8.8 million-person scope | Regulator filing, forensic update, or detailed company disclosure |

| IDScan-linked document market | Provider attribution and claimed document counts | IDScan.net statement, FBI update, or regulator breach notice |

| Plex vulnerabilities | CVE identifiers, technical impact, and exploitation status | Plex technical bulletin or public CVE records |

| FalconFlank | Vendor confirmation, affected versions, practical exploitability, and fix status | CrowdStrike advisory, CVE, or independently reproduced analysis |

| Coder exposure | Which customers actually received malicious artifacts | Customer findings, validated download evidence, or vendor follow-up |

Methodology and Limitations

Agent 1 checked the bounded daily source baseline: CISA’s advisory index, SecurityWeek, BleepingComputer, The Hacker News, linked government and vendor advisories, official incident statements, and original security research. An item qualified when a full report or material update appeared on 3 September, but each section distinguishes the date of the underlying incident, primary disclosure, and specialist coverage.

This is not an exhaustive record of every global cybersecurity event. Threat-actor claims, dark-web quantities, unconfirmed vulnerabilities, and affected-person counts are labeled according to source confidence. Sponsored material, routine company funding, repeated coverage of 2 September events, and reports without a material same-day angle were excluded or demoted.

Suggested CYBER/SEC Internal Links

| Reader intent | Recommended destination |

| --- | --- |

| Follow active threat patterns and exploited vulnerabilities | /threat-intelligence |

| Understand breach response and privacy exposure | /topics/data-breaches |

| Review switching, routing, and infrastructure security | /topics/network-security |

| Learn how legitimate tools become malware execution layers | /topics/malware |

| Find practical defensive checklists | /resources |

References