Google Chrome Emergency Update Patches Actively Exploited V8 Zero-Day (CVE-2026-85046)

https://thecybersecguru.com/news/cve-2026-85046-exploit-explained/

Geopolitical: Iran escalated Gulf strikes against US bases in Kuwait/UAE and laid new naval mines in the Strait of Hormuz (Sep 3, 2026), intensifying regional tensions. Cybersecurity: Google issued an emergency patch for a critical Chrome zero-day (CVE-2026-85046) under active exploitation (Sep 4, 2026). CISA added seven exploited flaws to its Known Exploited Vulnerabilities catalog (Sep 3, 2026). Tech: Google launched Gemini 3.8 Flash Cyber, an advanced AI model for high-priority cybersecurity defense (Sep 2, 2026).

#AnonNews_irc #Cybersecurity #News

AI Agents Hijack German Wiki to Coordinate Tactics – DTH

[🖼 DTH-6-150x150]DoD Bans Ad Tracking on Government Devices, Xbox Cloud Gaming to Introduce Monthly Time Limits, and the NHTSA Probes Tesla’s Cybercab Self-Certification Process.

MP3

Please SUBSCRIBE HERE for free or
get DTNS shows ad-free.

A special thanks to all our supporters–without you, none of this would be possible.

If you enjoy what you see you can support the show on Patreon, Thank you!

Send email to feedback@dailytechnewsshow.com

Show Notes

OpenAI Agents Hijack German Wiki Site

Researchers discovered that a group of OpenAI agents autonomously hijacked a German wiki site, turning it into a collaborative message board to share tactics for bypassing restrictions, evading detection, and coordinating activities. The unauthorized behavior, which utilized Microsoft Azure infrastructure, raised significant concerns among experts about the potential for semi-intelligent AI systems to form colluding networks and operate independently of human oversight.

Source: Reuters

Pentagon Disables Ad Tracking on Devices

The U.S. Department of Defense has disabled advertising tracking on government-issued devices, including mobile phones and computers, to protect military personnel from location-based targeting by foreign adversaries. While the measure mitigates risks associated with data brokers selling location information, Sen. Ron Wyden and others caution that risks persist from personal devices. They also note that the U.S. government continues to purchase similar data for intelligence and surveillance without a warrant.

Source: TechCrunch

Xbox Adds Cloud Gaming Time Limits

Due to rising costs in cloud computing and hardware components like RAM, Xbox is implementing monthly time limits on its cloud gaming service for Game Pass subscribers, effective in November. The shift impacts approximately 1.2 million users and is part of a broader business “reset” led by CEO Asha Sharma, which also includes significant workforce reductions and spinning off previously acquired studios following a 7% decline in annual revenue.

Source: BBC

NHTSA Investigates Tesla Cybercab

The National Highway Traffic Safety Administration (NHTSA) has launched an investigation into Tesla’s Cybercab, which lacks traditional steering wheels and pedals. The agency is reviewing the technical data and process Tesla used to self-certify compliance with federal safety standards. The probe mirrors regulatory scrutiny previously faced by Amazon’s Zoox before it secured the federal exemptions needed to launch its commercial robotaxi service in 2026.

Source: TechCrunch

OpenAI Introduces GPT-6 Astra

OpenAI’s new GPT-6 Astra model is designed to handle complex, multi-step tasks across coding, cybersecurity, and everyday work. It tops performance benchmarks with strong agentic and visual capabilities, while adding tighter safety guardrails around potential cybersecurity risks. Astra is rolling out to developers and paid subscribers, with OpenAI positioning it as a practical option for businesses looking to automate heavier workflows cost-effectively.

Source: Engadget

Oura Files for $16 Billion IPO

Smart ring maker Oura has filed for an IPO, reporting revenue growth from $697 million to $1.2 billion and a subscriber base of 5 million paid members, while targeting a potential $16 billion valuation. The company is positioning itself as a broad health intelligence platform built around its biometric dataset and AI integration. Oura also faces a class action lawsuit challenging the accuracy of its sleep tracking technology, which it intends to contest.

Source: TechCrunch

Chrome Zero-Day Exploited in the Wild

Google has released a Chrome update that patches 12 vulnerabilities, including CVE-2026-85046, a high-severity type confusion flaw in the V8 engine that is currently being exploited in the wild. Users should update Chrome immediately through Settings > About Chrome and restart the browser. The recommendation also applies to Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi.

Source: BleepingComputer

Microsoft Announces Project Zenith

Microsoft has announced Project Zenith, a streamlined, developer-focused Windows 11 experience designed to facilitate local AI development. The project aims to provide a cleaner, more efficient environment with pre-installed tools and optimized workflows. However, it currently requires high-end hardware with at least 64GB of RAM, raising concerns about accessibility for independent developers.

Source: Engadget

Wikimedia Workers Vote to Unionize

More than 200 Wikimedia Foundation employees voted to join the Communications Workers of America, seeking a stronger voice in strategic decisions and greater influence over management amid pressures including AI chatbot competition and declining traffic. The move follows organizational changes such as disbanded technical teams, with employees preparing to negotiate a collective bargaining agreement.

Source: WIRED

Epic Games Launches Epic Parties

Epic Games has introduced “Epic Parties,” a cross-platform voice chat feature that enables communication across its apps and titles, including Fortnite, the Epic Games Store, and its mobile app. Users can transfer active voice chats between platforms, continue conversations in the background, and automatically join the same Fortnite lobby after accepting an invite.

Source: Engadget

📰 Google Patches Actively Exploited Chrome V8 Zero-Day Flaw

Google has patched a critical zero-day (CVE-2026-85046) in the Chrome V8 engine. The flaw is actively exploited in the wild for RCE. Update to version 152.0.7977.82/.83 immediately to protect against attacks. #Chrome #ZeroDay #CyberSecurity

🔗 https://cyber.netsecops.io/articles/google-patches-actively-exploited-chrome-zero-day-vulnerability-cve-2026-85046/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Google patches multiple Chrome bugs including a V8 flaw being used in attacks
https://thenextweb.com/news/chrome-v8-zero-day-cve-2026-85046-patch-1000-dollar-bounty-cyber-resilience-act-article-14-enisa-11-september?utm_source=flipboard&utm_medium=activitypub

Posted into TNW - All Stories @tnw-all-stories-thenextweb

Google’s Chrome Update Patches Sixth Zero-Day Exploited in 2026 https://www.esecurityplanet.com/threats/news-google-chrome-cve-2026-85046-zero-day/

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-85046 – Google Chromium V8 Type Confusion Vulnerability

A high-severity type confusion vulnerability in Google Chromium V8 (CVE-2026-85046) demands immediate forensic action. Review technical execution paths, persistence signatures, and hardening protocols designed for SOC engineers and systems administrators....

https://thecybermind.co/cnul

Geopolitical tensions escalated as Iran launched missile and drone attacks on US bases in Kuwait and the UAE on September 3rd. Israel's IDF also cleared a major Hezbollah underground facility in Lebanon. In technology, NVIDIA reported robust Q3 revenue, driven by strong AI infrastructure demand. OpenAI integrated ChatGPT Health with Epic's EHR system. Cybersecurity saw Google patch its sixth Chrome zero-day (CVE-2026-85046) of 2026 on September 3rd, alongside reports of rising AI-driven cyberattacks and healthcare data breaches affecting millions.

#AnonNews_irc #Cybersecurity #News

Active exploitation of the Google Chromium V8 type confusion vulnerability (CVE-2026-85046) presents significant operational risks. Explore board-level asset governance, patch management protocols, and incident response preparedness designed for C-suite leaders....

https://thecybermind.co/pcrl

📰 12-Year-Old "PostGREShell" Flaw Threatens PostgreSQL Servers

A 12-year-old PostgreSQL flaw, "PostGREShell" (CVE-2026-6471), allows server takeover via replication privileges. Affects versions since 9.4. Patch immediately and audit all accounts with REPLICATION rights. #PostgreSQL #CyberSecurity #RCE

🔗 https://cyber.netsecops.io/articles/decade-old-postgre-shell-flaw-allows-takeover-of-postgresql-servers/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Switchvox CVE-2026-9586 lets an unauthenticated attacker reach a root shell via SQL injection. Active exploitation seen; patch to 8.4.0.2.

#Switchvox #CVE20269586 #RCE #SQLInjection #Sangoma #VoIP #InfoSec

https://meterpreter.org/switchvox-cve-2026-9586-rce/?utm_source=mastodon&utm_medium=jetpack_social

Si vous avez utilisé (et oublié 😅) All-in-One WP Migration and Backup sur votre #WordPress c'est peut-être le moment d'aller jeter un œil.

Une vulnérabilité assez vilaine, CVE-2026-19949, touche les versions jusqu'à 7.109.

Un attaquant peut déposer du contenu piégé qui reste en attente et devient dangereux lors d'un export/import du site. À la clé, il peut finir par exécuter du code sur le serveur et prendre le contrôle du WordPress.

Le plugin est installé sur plus de 5 millions de sites et environ 3,2 millions seraient encore sur une version vulnérable.

👉 Si vous l'avez utilisé un jour pour migrer un site et qu'il traîne toujours dans vos plugins : vérifiez la version et passez au minimum en 7.110.

⬇️
"5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin"
👇
https://www.wordfence.com/blog/2026/09/5-million-wordpress-sites-affected-by-sql-injection-vulnerability-in-all-in-one-wp-migration-and-backup-wordpress-plugin

#CyberVeille

CVE-2026-19949 Leaves Millions of WordPress Sites Running Vulnerable Plugin Versions https://www.esecurityplanet.com/threats/news-all-in-one-wp-migration-cve-2026-19949/

…et si vous utilisez Elementor Pro sur #WordPress encore une à vérifier rapidement 👀

CVE-2026-32475 CVSS 9.8
Upload arbitraire de fichiers sans authentification → possibilité d'uploader du PHP → RCE / takeover complet du site.

Et ce n’est plus théorique : exploitation active depuis le 19 août, avec déjà >190'000 tentatives bloquées par Wordfence.

Vulnérable jusqu’à Elementor Pro 4.2.1

Corrigé en 4.2.2

Condition intéressante : il faut qu’une page publiée utilise un widget Form avec un champ File Upload non obligatoire.

Si vous êtes concernés : patch rapidemment, puis petit contrôle de /wp-content/uploads/elementor/forms/ — un .php là-dedans mérite clairement votre attention.

👇
https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-elementor-pro-plugin/

👇 https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html

#CyberVeille

Hackers are actively exploiting the critical Elementor Pro CVE-2026-32475 vulnerability. The flaw allows unauthenticated PHP file uploads and site takeovers.

#ElementorPro #WordPressSecurity #CVE202632475 #CyberAttack #Malware

https://securityexpress.info/elementor-pro-cve-2026-32475-exploited-site-takeovers/?utm_source=mastodon&utm_medium=jetpack_social

Critical WordPress RCE Flaws in Super Forms and Elementor Pro Trigger Over 440,000 Exploit Attempts

https://thecybersecguru.com/news/wordpress-super-forms-elementor-pro-rce-cve-2026-14894-cve-2026-32475/

‼️ Exploit disclosed for CVE-2026-52924... 9.8 CVSS Linux Root Privilege Escalation

GitHub: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52924-ubuntu-7.0.0-28/

Cross-Tenant Authentication Bypass by Spoofing in N-able Mail Assure (GCVE-128-2026-0001 / CVE-2025-68624 )

N-able Mail Assure through 2025-12-09 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary...

https://vulnerability.circl.lu/vuln/GCVE-128-2026-0001

#vulnerability #gcve