Most of what broke this week was old-fashioned. A PostgreSQL bug had been sitting untouched since 2014, and a Magento zero-day was owning stores before the patch shipped. Two build systems, Coder and JetBrains, got turned against the developers who trust them. None of it needed a frontier model.
Anthropic's Claude Mythos flagged 23,000 possible vulnerabilities across open-source projects. A human has checked about eight percent. The rest are not confirmed bugs, just unread candidates, which is exactly why Dark Reading argued this week that the panic is overblown.
Cyera disclosed CVE-2026-6471, a flaw in PostgreSQL's logical replication that has been present since 2014 and reaches every version from 9.4 through 18. They named it PostGREShell and built a working proof of concept during disclosure.
Logical decoding lets a client name an output plugin, and the parser accepts nearly anything inside a double-quoted plugin name: slashes, backslashes, ../ traversal, even Windows UNC paths. Any account holding the Replication privilege can point that name at a file on disk, and PostgreSQL loads it through dlopen() and runs it as the postgres system user. From there the code rewrites the pg_authid catalog directly and hands itself superuser.
Twelve years is a long time for a gap like this to sit in the replication path of a database this widely deployed. The fixes are out in 18.6, 17.11, 16.15, 15.19 and 14.24, with anything on 9.4 through 13 now past end of life and left unpatched, and there is no confirmed exploitation yet.
Nobody granted the Replication privilege expecting to hand out code execution, which is exactly why it tends to be over-provisioned in databases that have been around a while. Pull the list of roles that hold it and cut every one that is not actually running replication.
Sansec found attackers exploiting a Magento and Adobe Commerce flaw it calls StyleSmuggler, now CVE-2026-75650 at CVSS 10.0. Exploitation started September 4, public disclosure followed on September 5, and Adobe shipped an emergency hotfix on September 7, three days into active attacks.
The delivery avoids the click. Attackers plant PHP into files Magento itself generates, such as failure reports, then trigger the store's ordinary Payment Transaction Failed Reminder email, and the code runs while Magento renders the message. As Sansec put it, no one has to open it. Every current version reproduces the bug, including 2.4.9, and one store running 2.4.8 behind a web application firewall was hit late on September 4, hours before Sansec's first blocking rules went live.
Magento was not the only commodity platform taking fire this week. Wordfence has blocked more than 190,000 attempts against an Elementor Pro file-upload flaw, CVE-2026-32475 at CVSS 9.8, where an empty upload slot ahead of a PHP payload trips an early return and skips validation on the rest. Elementor patched it on August 19, and attackers moved the moment the fix told them where to look.
Because both bugs were being exploited before their patches landed, a patched store tells you nothing about whether it is a clean one. If you run Magento or Elementor, the honest next move is to go looking for the web shell someone may have already dropped, not to close the ticket.
Two compromises this week skipped the application entirely and went after the systems developers pull from. For most of Monday, August 31, attackers who had compromised a Cloudflare API key ran a rogue server inside Coder's module registry pool, so a subset of users pulling Terraform modules got malicious copies that harvested cloud, CI/CD, AI and SSH credentials and shipped them to coder-infra[.]com. Coder's user list includes Dropbox, Palantir, Mercedes-Benz and parts of the U.S. government.
The JetBrains incident took longer to notice. Attackers used an unpatched TeamCity flaw, CVE-2026-63077, to breach the Cadence cloud service after August 8, then pulled AWS IAM credentials, source code, and secrets from a 2024 server backup. JetBrains caught it on August 23 and pulled the server offline the next day.
Neither attack touched a line of the victims' code. They took the registry and the build server, because a poisoned module or a leaked CI credential inherits all the trust the pipeline already extends to those systems.
Most IaC and CI pull paths fetch a URL and trust whatever answers, so a poisoned pool like Coder's leaves nothing in the logs you would think to check. That both vendors led with rotate-every-credential, rather than patch-and-move-on, says how little detection they trust here.
The Claude Mythos number made the rounds again this week. Anthropic ran the model against 281 open-source projects and collected 23,019 candidate vulnerabilities. About 1,900 went out for external review, roughly 8%, and 90.8% of those held up.
The firm that analyzed the results flagged the catch, that the reviewed 1,900 were "unlikely to be a random draw from the pile." They were the confident ones, so the accuracy rate describes the easy 8% while the other 21,000 candidates have not been graded by anyone. Of everything, 97 fixes landed upstream and 88 became published advisories.
None of that makes the model bad at finding things. It moves the work to what a source cannot answer on its own, which deployment assumptions hold, whether the precondition is reachable, whether the severity survives contact with the real system. Those calls still come from a person, and there were not enough of them to reach more than 8% of the pile.
When a vendor sells you an AI finder on a 90-percent accuracy number, ask what share of its findings a human ever checked. Anthropic's own answer was 8 percent, and the other 21,000 candidates are still nobody's job to read.
• Magento & Adobe Commerce CVE-2026-75650, CVSS 10.0, the StyleSmuggler flaw. Exploited from September 4, disclosed September 5, and covered by an Adobe emergency hotfix on September 7. PHP planted in Magento-generated files runs when a payment-failure email renders. Affects 2.4.4 through 2.4.9. (Sansec)
• Elementor Pro CVE-2026-32475, CVSS 9.8 arbitrary file upload, where an empty upload slot ahead of a PHP payload skips validation on the rest. Wordfence has blocked more than 190,000 attempts, and roughly two-thirds of the plugin's installs were on vulnerable builds as of September 4. Patched in 4.2.2 on August 19.
• Google Chrome CVE-2026-85046, a V8 type-confusion bug with an exploit confirmed in the wild, the sixth actively exploited Chrome zero-day of 2026. Fixed in 152.0.7977.82.
• PaperCut CVE-2026-81578 and CVE-2026-82078, an authentication bypass chained into remote code execution, confirmed exploited in the wild and used against schools and universities to create privileged accounts and drop Meterpreter.
• JetBrains TeamCity CVE-2026-63077, the unpatched remote code execution attackers used to breach JetBrains' own Cadence service and take AWS credentials.
• PostgreSQL CVE-2026-6471, CVSS 7.2, the twelve-year-old PostGREShell flaw that turns the Replication privilege into superuser code execution. Patched, with no confirmed exploitation. (Cyera)
• HAProxy "Ted" implant, analyzed by Rapid7. Not a HAProxy vulnerability, but a post-compromise backdoor recompiled into the HAProxy 2.8.12 binary as a ted_plugin that hides its own traffic from the load balancer's connection stats. Rapid7 attributes it with medium confidence to North Korean actors (APT37).
• Security leaders must prepare for likely threats, not sensationalized agentic attacks (CSO Online) Why it's worth your time: the counterweight to a loud week, and a case for spending your attention on the attacks that actually show up rather than the demo-day ones.
• Companies Have 6 Months to Prepare for Automated Attacks (Dark Reading) Why it's worth your time: a concrete timeline to plan against, and a useful frame for the "how urgent is this really" conversation with leadership.
• Dirty Frag (CVE-2026-43284): the Linux kernel bug that turns read access into root (Aikido) Why it's worth your time: a clear walk through how a low-privilege process corrupts the kernel's in-memory copy of a file to escalate to root, written by the researchers rather than summarized.
• Testing race conditions with memory access tracing and stack-based delay injection (Google Project Zero) Why it's worth your time: Jann Horn on a repeatable method for provoking race conditions, the tradecraft that turns "probably not exploitable" into an actual answer.
• The Validator Can Lie: SSRF Beyond URL Validation (r/netsec) Why it's worth your time: SSRF that survives URL validation across GitLab, Mealie, Apache ShenYu and Thumbor, a reminder that a check passing is not the same as the request being safe.
• A "proof" of Fermat's Last Theorem that fits the margin (Trail of Bits) Why it's worth your time: a bug in the Lean theorem prover where native code and the logical spec disagree just enough to "prove" anything, Fermat included. Formal verification, it turns out, has bugs of its own.
P.S. We didn't cover all this from the outside. MoneyGram has been a Pixee customer straight through the shift the whole industry is now scrambling through, from hand-triaged findings to AI-speed development, running our triage and remediation across 200-plus of their GitLab repos. They let us publish what it did: 96% of findings handled automatically, roughly 6,500 engineer-hours back. The full story is here.
The briefing security leaders actually read. CVEs, tooling shifts, and remediation trends — distilled into 5 minutes every week.
Join security leaders who start their week with the briefing. Free, 5 minutes, no fluff.
First briefing drops this week. Check your inbox.
Weekly only. No spam. Unsubscribe anytime.