September 7, 2026 is shaping up as one of the busier threat days of the quarter. Across six trending advisories, defenders are facing a convergence of unpatched remote-code-execution flaws, authentication bypasses on widely deployed infrastructure, a browser engine type-confusion vulnerability now on CISA's Known Exploited Vulnerabilities catalog, and a stealthy new phishing evasion technique. No single team can absorb all of this at once, so this briefing is organized to help you triage, prioritize, and act.

The most urgent item for any organization running an online storefront is the unpatched zero-day in Magento Open Source and Adobe Commerce, disclosed by Sansec on September 5. The flaw allows an unauthenticated attacker to execute arbitrary code directly on the server — meaning no credentials, no social engineering, no foothold required. Attackers are already using it to plant backdoors inside live stores, giving them persistent access to payment flows, customer data, and administrative functions. Because no vendor patch exists yet, defenders cannot simply apply an update and move on. Instead, teams should immediately review web application firewall rules to restrict unexpected POST requests to Magento's admin and API endpoints, audit recently modified PHP files and database entries for injected code, enable file-integrity monitoring if not already in place, and consider temporarily restricting admin panel access to known IP ranges. Sansec's advisory should be monitored closely for patch availability.

Educational institutions face a separate but equally severe crisis. Two PaperCut vulnerabilities — CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a remote code execution flaw — are being actively chained by attackers to steal credentials from schools and universities. PaperCut is ubiquitous in academic environments precisely because it manages print quotas and billing across large, diverse user populations, making it a rich target for credential harvesting. If your organization runs PaperCut NG or MF, patching is the first action, followed immediately by rotating all credentials that the PaperCut service account touches, reviewing logs for unexpected administrative logins or configuration changes, and auditing any LDAP or Active Directory integrations that PaperCut queries, since those credentials may now be in attacker hands.

On the network infrastructure side, MikroTik has released a patch for an SSH authentication bypass that is already being exploited in the wild. SANS ISC's guidance is blunt: at this point, assume compromise on any unpatched device. Attackers are creating new local accounts to maintain persistent access even after reboots or configuration restores. Every MikroTik device in your environment should be patched immediately, all local user accounts should be audited and any unrecognized accounts removed, SSH access should be restricted to management VLANs or jump hosts, and device configurations should be exported and compared against known-good baselines to detect unauthorized changes.

For endpoint and browser security teams, CVE-2026-85046 is a type-confusion vulnerability in Google Chromium's V8 JavaScript engine that CISA has added to its KEV catalog, confirming active exploitation. Type-confusion bugs in browser engines are a classic vector for drive-by compromise — a user visits a malicious or compromised page and the attacker gains code execution in the browser process, often as a stepping stone to a full system compromise. Ensure Chrome and all Chromium-based browsers are updated to the latest stable release across your fleet. If your organization uses enterprise browser management, push the update as a forced policy rather than waiting for user-initiated restarts. Consider enabling Enhanced Safe Browsing where policy permits.

Finally, a technique worth briefing your security awareness and email security teams on: threat actors are now embedding invisible Unicode characters in phishing emails to smuggle malicious content past email security filters. Known as ASCII smuggling, the approach exploits the fact that certain Unicode code points render as zero-width or invisible characters in email clients but carry meaningful data that can confuse or bypass scanning engines. The visible text of the email may look entirely benign while the actual payload is hidden in plain sight. Defenders should work with their email gateway vendors to understand whether their product inspects Unicode character ranges beyond standard ASCII, consider deploying additional header and body analysis rules that flag messages containing high densities of unusual Unicode code points, and reinforce user training around verifying sender identity through out-of-band means before clicking any link, regardless of how legitimate the message appears.

Defensive priorities for today:

- Magento and Adobe Commerce: deploy WAF mitigations now, audit for existing backdoors, monitor Sansec for patch release
- PaperCut: patch CVE-2026-81578 and CVE-2026-82078 immediately, rotate all associated credentials, audit AD integrations
- MikroTik: patch SSH bypass, audit all local accounts, restrict SSH to management networks, compare configs to baselines
- Chrome V8 CVE-2026-85046: force browser updates fleet-wide, do not wait for user restarts
- Phishing Unicode smuggling: engage email gateway vendor, add Unicode anomaly detection rules, reinforce user verification habits

This briefing is informational and does not replace official vendor advisories, patches, or guidance from CISA and your managed security providers.