Daily Cybersecurity News – September 3, 2026

What happened

Security researcher Chaotic Eclipse (also known as INFINITE NIGHTMARE) released a proof-of-concept exploit for FalconFlank, a zero-day local privilege escalation in CrowdStrike Falcon Sensor.

The flaw abuses the sensor's Office malicious macros remediation path. The PoC succeeds on fully updated Windows 11 25H2 and Windows Server 2025 systems running Falcon. The researcher noted CrowdStrike may already have detections, so testing requires exclusions or obfuscation of the DLL load technique.

Who is affected

Organizations running CrowdStrike Falcon Sensor on Windows 11 25H2 or Windows Server 2025 endpoints.

Any environment where Falcon is deployed for endpoint protection and local privilege escalation could enable further compromise after initial access.

Why it matters

Endpoint detection and response tools are trusted high-privilege components. A priv-esc in the sensor itself lets an attacker who already has code execution on a host elevate to SYSTEM-level control and potentially disable or evade the same protection meant to stop them.

Builders and operators relying on Falcon for containment must treat this as a high-priority local risk until vendor mitigations or patches are confirmed.

How it could have been prevented

Apply any CrowdStrike detections or sensor updates addressing the macros remediation path as soon as they are available. Add temporary exclusions only for controlled testing and remove them afterward.

Restrict local user privileges, enable application control, and monitor for unusual DLL loads or file writes under System32. Validate Falcon health and sensor integrity regularly. Isolate high-value hosts and require multi-factor authentication for admin actions.

What happened

Manifold Security disclosed eight flaws across seven command-line AI coding agents in which a repository's .git/config can name a command the agent executes on the developer's machine.

The command runs as the user, outside any agent sandbox and without an approval prompt. Exploitation needs the repo delivered as files with an intact .git directory (shared archive, drive, sync folder, or USB), not a normal clone. core.fsmonitor is a common trigger: Git runs the configured command on index refreshes such as status or diff that agents invoke at startup.

Fixes shipped for goose, Claude Code (core path), and Cursor. Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path remained vulnerable on retest. OpenAI issued CVEs including CVE-2026-19592 for the same class in Codex.

Who is affected

Developers and organizations using affected AI coding agents: goose (before 1.44.0), Codex CLI (0.102.0-0.130.0) and Desktop variants, Claude Code (specific versions), Hermes Agent, Qwen Code, and Grok Build.

Anyone who opens untrusted repositories that arrive with a preserved .git directory is exposed. Scale includes individual developers and enterprise teams adopting agentic coding tools.

Why it matters

AI coding agents run with the developer's full privileges and often access source, credentials, and cloud resources. A malicious repo can achieve silent code execution before trust prompts or authentication complete, turning routine repo sharing into a supply-chain style compromise.

Operators must treat agent startup Git interactions as untrusted input paths. The pattern is foundational plumbing rather than a model flaw, so it will recur in new agents unless configs are sanitized.

How it could have been prevented

Update immediately to fixed versions: goose 1.44.0+, Codex 0.131.0+ (and matching Desktop builds), Claude Code 2.1.196+ for the primary path. For still-unpatched agents, avoid opening repos that retain .git from untrusted sources; strip or sanitize .git/config before use.

Prefer clean git clones over archive or USB copies. Run agents in isolated environments with least privilege, block unexpected subprocesses, and audit core.fsmonitor and similar Git hooks. Disable automatic Git status calls where possible until vendors fully patch.

What happened

Researchers confirmed Pegasus and a NoviSpy variant infected devices of Serbian student activists and others in what SHARE Foundation called the largest documented spyware wave in the country so far.

Citizen Lab forensically confirmed a Pegasus infection (first of 2026 for the lab) on a student activist with high probability, using an iMessage zero-click exploit. Amnesty International confirmed NoviSpy variant infections on two devices. SHARE Foundation identified 14 people targeted, including a member of parliament and a local official. Timing aligned with local elections and ongoing protests after the 2024 Novi Sad railway station collapse.

One NoviSpy case followed police seizure of a phone during questioning; another coincided with private messages appearing in pro-government media. Evidence points to Serbian authorities.

Who is affected

Serbian student activists, a parliament member, a local government official, and others linked to protests and elections - 14 confirmed targets in this wave.

Broader populations of civil society, journalists, and opposition figures in Serbia who have faced repeated spyware targeting.

Why it matters

Commercial spyware such as Pegasus grants full device access: messages, microphone, camera, location, and files. Zero-click delivery means victims need take no action. State-linked use against domestic activists raises rule-of-law and human-rights concerns and shows continued availability of NSO-class tools despite scrutiny.

Operators and defenders supporting at-risk users must assume high-value mobile devices are priority targets and harden accordingly.

How it could have been prevented

Keep devices fully updated; iOS and app patches close many zero-click vectors. Prefer devices and configurations with strong lock-down modes, disable unnecessary iMessage features if threat model warrants, and use hardware security keys.

Monitor for indicators from Citizen Lab and Amnesty forensic reports. Limit sensitive discussions on mobile, use end-to-end encrypted channels with disappearing messages, and treat any device seized by authorities as potentially compromised. Organizations supporting activists should provide secure devices and rapid forensic capability.

What happened

Symantec Threat Hunter Team reported threat actors abusing the legitimate, signed Node.js runtime (node.exe) to deliver and run malicious JavaScript payloads in targeted attacks since February 2026.

Victims include government departments, technology companies, and hotels. Attackers download the official installer from nodejs.org, then use the trusted binary to execute interpreted scripts that are harder for signature detection to catch. Persistence often uses a registry Run key. Initial access frequently comes via ClickFix social engineering.

In one Asian tech company intrusion (March-July 2026), actors switched to this method after AdaptixC2 and Cobalt Strike beacons were blocked, then employed EtherHiding. Related activity involves ModeloRAT, Mistic (MLTBackdoor), GateKeeper, NexShield Chrome extension, and C2Looper, linked to initial access broker KongTuke (Woodgnat). A U.S. fintech case showed similar chains.

Who is affected

Government, technology, hospitality, and fintech organizations, particularly those whose users can be lured by ClickFix-style lures.

Any Windows environment where Node.js is absent or unexpected yet can be installed, or where developers already have it present.

Why it matters

Living-off-the-land with a popular signed developer runtime bypasses many allow-lists and signature-based controls. Malicious logic stays in scripts rather than new binaries, reducing detection surface while enabling long-term access, command retrieval, and secondary payload delivery.

Defenders must expand behavioral monitoring beyond traditional malware binaries to trusted runtimes executing unusual scripts or network patterns.

How it could have been prevented

Block or alert on unexpected node.exe execution, especially from user-writable paths or after recent official installer downloads. Monitor registry Run keys and parent-child process chains involving node.exe, PowerShell, and cmd.

Restrict outbound connections from Node processes, apply application allow-listing, and train users against ClickFix lures that instruct them to run commands. Hunt for EtherHiding, AdaptixC2, Cobalt Strike, ModeloRAT, and C2Looper indicators. Keep EDR tuned for living-off-the-land binaries.

What happened

Forescout Research - Vedere Labs used Anthropic's Claude to port a working pre-authentication remote code execution exploit from one WAGO PLC model to another, achieving attacker-supplied ARM shellcode execution on live hardware.

The base flaw is CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server USER command handling (CVSS 9.8), reachable before auth on TCP port 21. Researchers started from a prior exploit for WAGO 750-852 and adapted it to 750-831 firmware V01.04.16. Claude (Sonnet then Opus) interacted with Ghidra, a terminal, and the physical target under researcher guidance. Final RCE stage cost about $535 in API usage over roughly 8.5 hours. A later C2 implant attempt bricked the PLC by writing flash-mapped memory.

CERT@VDE notes no updates for affected WAGO controllers. Claude also flagged a possible separate FTP bug.

Who is affected

Owners of vulnerable WAGO PLCs (including 750-852 and 750-831 series) that expose FTP on port 21, common in industrial and OT environments.

Organizations with legacy Nucleus FTP stacks in automation controllers where segmentation is weak.

Why it matters

AI-assisted exploit porting lowers the time and specialized skill needed to move a known critical RCE across hardware variants. Pre-auth RCE on PLCs can disrupt physical processes and enable lateral movement in OT networks.

Operators should assume capable adversaries can accelerate adaptation of old industrial flaws. The research also shows AI can brick hardware during experimentation, underscoring operational risk.

What happened

A dark-web identity theft site called Nexus advertised search access to more than 150 million driver's licenses and passports from the United States and Canada, allegedly sourced from a major identity verification company, with roughly 500,000 new documents added daily and customer photos when available.

Independent journalist Brian Krebs confirmed his own license appeared in the data; Secretary of Defense Pete Hegseth's photo was also listed. Working with researcher Zach Edwards, Krebs identified the likely source as Louisiana-based IDScan, a service used by major brands to verify tens of millions of IDs monthly. IDScan said it was investigating; the FBI New Orleans field office is probing the incident. Nexus went offline after the report.

Who is affected

Individuals in the US and Canada whose government IDs were scanned or uploaded for real-world verification (bars, retail, car rentals, age checks, and similar) through IDScan or its customers - potentially 150 million+ records.

Enterprises and government entities that rely on IDScan for identity proofing, plus anyone whose data now fuels identity theft or fraud.

Why it matters

Bulk theft of high-resolution ID images and biographic data enables large-scale identity fraud, synthetic identities, account takeovers, and targeted social engineering. Age-verification and KYC laws are driving more storage of exactly this data, increasing the blast radius of any single verification-provider breach.

This ranks among the largest known single compromises of identity documents and underscores the risk of long-term retention of scanned IDs.

How it could have been prevented

Verification providers should minimize retention of full ID images, tokenize or hash where possible, segment and encrypt stores, enforce strict access controls and monitoring, and adopt breach-ready detection. Customers should prefer vendors with short retention, strong SOC 2/ISO controls, and clear incident response.

Individuals: monitor credit, enable fraud alerts, be wary of phishing that references real ID details, and use unique passwords plus MFA everywhere. Organizations handling IDs must inventory where scans are sent and demand contractual security and deletion SLAs.

What happened

AWS security leaders and a SANS fellow published guidance stating that system prompts telling an AI agent to respect user clearances are not reliable security controls. Prompts can be bypassed, ignored, or overridden by social engineering or prompt injection.

The recommended fix is to enforce permissions at retrieval time inside existing RBAC or ABAC systems and filter results before they enter the model context window. An agent that authenticates for a user, chains tools, and acts without pause can reach production data quickly. Risk spikes when one agent combines sensitive data access, external communication, and exposure to untrusted content - the classic prompt-injection path. OWASP ranks prompt injection as the top AI application threat.

McKinsey figures cited: ~80% AI adoption vs ~10% governance. IBM data linked ungoverned shadow AI to higher breach costs. Authors urge purpose-built baselines (30 days) for agent behavior and metrics such as attack-surface minutes.

Who is affected

Enterprises deploying or developing AI agents that access internal data, tools, or external channels - especially those relying primarily on prompt instructions for authorization.

Security, platform, and app teams responsible for agentic systems at any scale.

Why it matters

Agents operate with user or service privileges and can complete multi-step actions in milliseconds. Treating natural-language instructions as the permission boundary creates a false sense of safety and turns prompt injection into a direct data-exfiltration or privilege path.

Builders must move authorization into deterministic policy engines and retrieval filters. Failure to separate duties (data + egress + untrusted input) concentrates blast radius.