Threat Intelligence Brief - Sunday, September 6, 2026

Threat Radar

• An unpatched zero-day in Magento Open Source and Adobe Commerce is being actively exploited to backdoor e-commerce servers without authentication — no patch exists yet.

• JetBrains Cadence was breached via an unpatched TeamCity vulnerability; AWS credentials were extracted and all Cadence users must rotate credentials immediately.

• MikroTik routers with internet-exposed SSH are being hijacked without authentication, granting attackers full administrative control and network pivot capability.

• CVE-2026-32475 (CVSS 9.8) in Elementor Pro is under active exploitation, enabling arbitrary file upload and full WordPress site compromise.

• IDScan faces lawsuits after an alleged breach exposed over 153 million driver’s licenses now offered for sale — organizations using IDScan for identity verification face downstream fraud and compliance exposure.

• REVSTEALER’s post-infection modules disable Windows Defender and Windows Update before deploying crypto miners, leaving endpoints persistently undefended.

Immediate Action Required

• Magento / Adobe Commerce operators: No patch is available. Engage your WAF vendor, restrict server-side execution paths, and monitor for unauthorized file changes or new admin accounts. Treat this as active incident posture until Adobe releases a fix.

• JetBrains Cadence users: Revoke and rotate all AWS credentials and any other secrets stored or accessed through Cadence immediately. Audit CloudTrail and IAM logs for unauthorized access since the breach window.

• MikroTik RouterOS deployments: Audit all MikroTik devices for internet-exposed SSH. Disable or firewall SSH access from the public internet. Verify firmware versions and review admin account integrity.

• Elementor Pro (WordPress): Patch to the latest version immediately. Audit web server directories for unauthorized file uploads. Review form submission logs for anomalous activity. CVE-2026-32475, T1190.

• IDScan customers: Assess your contractual notification rights, engage legal and privacy counsel, and evaluate whether affected identity documents require enhanced fraud monitoring for your user base.

High-Impact Developments

Magento / Adobe Commerce Zero-Day Actively Exploited — No Patch Available

• What happened: Attackers are exploiting an unpatched vulnerability in Magento Open Source and Adobe Commerce to execute arbitrary code on e-commerce servers without authentication. Sansec discovered and disclosed the flaw on September 5. Backdoor installation on compromised stores has been confirmed.

• Why it matters: This is a zero-day with confirmed active exploitation and no vendor patch. E-commerce platforms are high-value targets for payment skimming, customer data theft, and fraud. Compensating controls are the only available defense.

• Who should care: CISOs and application security leads at any organization running Magento Open Source or Adobe Commerce; SOC teams responsible for web application monitoring.

• Recommended action: Implement WAF rules to block unauthenticated code execution attempts, restrict server-side file execution, enable file integrity monitoring, and monitor for new or modified admin accounts. Track Adobe’s advisory channel for patch availability.

• Confidence: High — active exploitation confirmed by Sansec.

• Search metadata: T1190, Magento Open Source, Adobe Commerce, zero-day, code execution

Intelligence Context

• Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores — The Hacker News
  • Context: Sansec’s advisory, reported here, confirms active exploitation of the zero-day and backdoor installation on affected stores. No patch is available as of the report date.

JetBrains Cadence Breached via TeamCity — AWS Credentials Stolen

• What happened: Unidentified attackers exploited a critical, unpatched vulnerability in JetBrains TeamCity to breach the Cadence environment and extract AWS credentials. JetBrains has publicly urged all Cadence users to immediately revoke and rotate all credentials.

• Why it matters: CI/CD build infrastructure holds secrets, cloud credentials, and code signing material. Stolen AWS credentials enable lateral movement into cloud environments, data exfiltration, and resource abuse — often with delayed detection.

• Who should care: DevOps and cloud security teams, identity and secrets management leads, SOC teams monitoring AWS environments, and any organization using JetBrains Cadence.

• Recommended action: Immediately revoke and rotate all AWS credentials and any other secrets associated with Cadence. Review AWS CloudTrail, IAM activity, and S3 access logs for unauthorized actions. Audit TeamCity instances for the disclosed vulnerability and apply available patches.

• Confidence: High — breach confirmed by JetBrains with public credential rotation advisory issued.

• Search metadata: T1190, T1528, TeamCity, JetBrains Cadence, AWS, credential theft

Intelligence Context

• Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials — The Hacker News
  • Context: JetBrains confirmed the breach and issued a direct advisory urging Cadence users to revoke and rotate all credentials, indicating the scope of credential exposure is not yet fully bounded.

MikroTik Routers Hijacked via Unauthenticated Internet-Exposed SSH

• What happened: Attackers are exploiting MikroTik RouterOS devices with SSH exposed to the internet, gaining full administrative control without authentication. CERT Polska issued a formal warning with confirmed attacks dating to at least early September.

• Why it matters: Full administrative compromise of a network router gives attackers the ability to intercept traffic, redirect DNS, establish persistent tunnels, and pivot laterally into enterprise environments. MikroTik is widely deployed in SMB and enterprise edge environments.

• Who should care: Network operations, infrastructure, and SOC teams responsible for perimeter and edge device management.

• Recommended action: Identify all MikroTik devices with SSH reachable from the internet. Disable public SSH access or restrict it to known management IPs via firewall ACLs. Audit device configurations and admin accounts for signs of tampering.

• Confidence: High — active exploitation confirmed by CERT Polska.

• Search metadata: T1190, T1021.004, MikroTik RouterOS, SSH, authentication bypass

Intelligence Context

• Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication — The Hacker News
  • Context: CERT Polska’s warning, covered here, confirms active attacks and provides the basis for the authentication bypass characterization. Attack activity is confirmed as ongoing.

Elementor Pro CVE-2026-32475 Actively Exploited — CVSS 9.8

• What happened: CVE-2026-32475, a critical arbitrary file upload vulnerability (CVSS 9.8) in the Elementor Pro WordPress plugin’s form submission handler, is being actively exploited to compromise WordPress sites.

• Why it matters: Elementor Pro is one of the most widely deployed WordPress plugins. Arbitrary file upload at this severity enables attackers to plant web shells, host malware, deface sites, and steal credentials from site visitors.

• Who should care: Web operations, application security, and SOC teams managing WordPress environments; marketing and digital teams relying on Elementor Pro for site functionality.

• Recommended action: Update Elementor Pro to the latest patched version immediately. Scan web server directories for unauthorized files. Review web application logs for exploitation attempts targeting form submission endpoints.

• Confidence: High — active exploitation confirmed.

• Search metadata: CVE-2026-32475, T1190, Elementor Pro, WordPress, arbitrary file upload, code execution

Intelligence Context

• Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites — SecurityWeek
  • Context: SecurityWeek confirmed active exploitation of CVE-2026-32475 and characterized the flaw as an arbitrary file upload issue in the form submission function, with a CVSS score of 9.8.

IDScan Breach — 153 Million Driver’s Licenses Allegedly Exposed

• What happened: Identity verification provider IDScan faces multiple lawsuits after hackers allegedly breached the service and offered over 153 million driver’s licenses for sale. IDScan has not publicly confirmed the breach, but litigation is underway.

• Why it matters: Organizations that use IDScan for identity verification may have customer identity documents exposed. This creates downstream fraud risk, potential regulatory notification obligations, and legal liability. At 153 million records, this is a systemic identity risk event, not a contained vendor incident.

• Who should care: Identity and access management leads, legal and privacy counsel, compliance teams, and CISOs at organizations that have integrated IDScan into customer onboarding or verification workflows.

• Recommended action: Determine whether your organization uses or has used IDScan. Engage legal and privacy counsel to assess notification obligations. Evaluate whether enhanced fraud monitoring is warranted for affected customer populations. Monitor IDScan’s public disclosures.

• Confidence: Medium — breach alleged and litigation filed; full scope not independently confirmed.

• Search metadata: T1005, IDScan, data breach, driver’s licenses, credential theft

Intelligence Context

• IDScan sued over alleged data breach affecting 153 million drivers — Bleeping Computer
  • Context: Bleeping Computer reported the filing of multiple lawsuits and the alleged sale of 153 million driver’s licenses, establishing the legal and scale dimensions of the incident.

Monitor Only

• REVSTEALER’s post-infection modules (documented by Elastic Security Labs) disable Windows Defender and Windows Update before deploying crypto miners, leaving endpoints persistently exposed after the primary stealer self-deletes — SOC and endpoint teams should validate Defender health monitoring and update compliance alerting on Windows endpoints. Source: Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner — https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html

Analyst Observation

This brief reflects a threat environment where unpatched infrastructure — CI/CD pipelines, e-commerce platforms, network edge devices, and CMS plugins — is being converted into attacker footholds faster than many organizations can respond. The JetBrains Cadence and Magento incidents together illustrate a pattern worth naming directly: build infrastructure and revenue-generating web platforms are being targeted in parallel, and both carry credential or data exfiltration consequences that extend well beyond the initial compromise. The MikroTik situation is a reminder that internet-exposed management interfaces remain a persistent, low-sophistication entry point that attackers continue to exploit at scale. The IDScan incident warrants board-level awareness for any organization in financial services, healthcare, or regulated industries that relies on third-party identity verification — the downstream fraud and notification exposure from 153 million identity documents will not stay contained to the vendor.

Source Links

• Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores — https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html

• Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials — https://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.html

• Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication — https://thehackernews.com/2026/09/attackers-hijack-mikrotik-routers.html

• Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites — https://www.securityweek.com/elementor-pro-wordpress-plugin-vulnerability-exploited-to-hack-sites/

• IDScan sued over alleged data breach affecting 153 million drivers — https://www.bleepingcomputer.com/news/security/idscan-sued-over-alleged-data-breach-affecting-153-million-drivers/

• Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner — https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html

Generated by DevSecOpsDadAttack cyber threat intelligence.