September 16, 2026
- China-linked UTA0560 used a then-zero-day Chrome–Windows chain against multiple NGOs on September 1. Volexity says the spear-phishing campaign delivered GRIMWEDGE, a JavaScript backdoor, through vulnerabilities that have since been patched (The Hacker News). · Threat Activity & Malware
in CVE-2026-76461 Gives Remote Attackers Root on Cisco Email Gateways