Several times this summer, Microsoft’s Patch Tuesday, the monthly roundup of major security patches for Microsoft products, has included record-breaking numbers of security fixes. The August 2026 patch set actually seemed to catch up. Was this a sign of the bug apocalypse lessening? Ha, nope!

Brian Krebs at Krebs On Security once again brings his excellent roundup of Patch Tuesday events, with this months patch set absolutely crushing previous numbers with nearly 1,000 security fixes.

Two of the fixes are for zero-day vulnerabilities under active exploitation in the wild, both allowing privilege escalation on Windows. Privilege escalation bugs turn general vulnerabilities in applications and games into full administrator access to gain persistence and deploy ransomware, and generally make any vulnerability significantly worse.

Krebs also calls out a CVSS 9.8 (so close to a perfect 10!) vulnerability that allows remote code execution in the Windows shell with no user interaction and no authentication, a remotely exploitable DNS bug present since Windows Server 2012 and Windows 10 which will likely see exploitation in the wild soon, and over a hundred other bugs are ranked “Critical”.

How the sheer volume of vulnerabilities in this patch will fit with recent Microsoft recommendations that companies should apply the patches immediately remains to be seen. (Likely: not very well, depending on what new behavior and issues the fixes cause!)

Is Your LG TV Spying on You?

Gamers Nexus continues their trend of high-quality investigation, and they have posted another tremendous multi-hour investigatory video. This time Gamers Nexus focuses on the ecosystem of LG televisions and monitors.

It shouldn’t likely surprise many here that “smart” devices are usually more to the benefit of advertisers than consumers. Similarly, it shouldn’t be a surprise that a “smart” device harvests user data to sell to advertises. What may be surprising is the degree to which LG devices appear to collect data, how much data is sent even when collection is turned off, and how overt executives at the company are, with multiple executives making statements in pitches to advertisers that LG “owns the glass”, “owns the living room”, and is designed to correlate devices, inhabitants of the environment, and viewing habits so that ads can be served to the TV and mobile devices in the same room simultaneously.

With tracking enabled, the smart TV captures telemetry of what applications are used, as well as continually capturing the video displayed and reporting fingerprints to LG servers and ad partners. The screen content is tracked not only for TV, but for the HDMI inputs, including if the TV is used as a PC monitor. If voice control is enabled, the TV also records audio and analyzes it. The TV also continually scans the local network and nearby Wi-Fi networks, reporting all the devices it finds on the local network, including host name, MAC address, and sometimes software running depending on the MDNS advertisements. Near-by Wi-Fi networks are sufficient for very precise geolocation, so LG effectively knows the location of every customer, as well.

Gamers Nexus makes the point that while the invasive ad tech is gross, it’s mostly limited if the user does not agree to the end-user license agreement – but the infrastructure required to enable it is riddled with security flaws, both discovered and likely additional undiscovered issues. A smart TV is basically a computer, usually running either some flavor of Android or Linux, with the attendant flexibility, power, and problems. A vulnerability in the TV operating system or its apps can provide a route into your internal network. (Not that this required an exploit: LG was called out earlier this summer because 42% of apps on the official app store contained residential proxy systems to sell your home Internet connection.) But it can also access any of the attached hardware, like the microphone.

Gamers Nexus demonstrates that a LG TV can be exploited to gain local root, and from there, it can record audio from attached devices – even when the primary microphone is muted. Gamers Nexus also discovered that muting the microphone on some models does not disconnect or disable the microphone, it simply sets the gain levels extremely low; recording is still possible, and with amplification, audio is still recoverable.

Spy tech and ad tech goes hand in hand; it will be interesting to see if LG responds by at least hardening the security on the devices, or if another company finds traction in selling modern televisions and monitors without the “smart” advertising.

Shai-Halud NPM Worm Returns

Aikido.dev reports that after 111 days, the Shai-Halud worm returned to the NPM repository.

Shai-Halud was one of several worms hitting package repositories in the Spring of 2026, installing backdoors, stealing cryptocurrency wallets, and taking every login credential and authentication token it could find before infecting every package the tokens linked to. Since then, infections have remained quiet, and repositories like NPM have stated that they now scan every package as it is uploaded.

Charlie Erkisen at Aikido.dev observed that on September 7, 2026, four additional packages uploaded to NPM were infected with Shai-Halud; not a variant of the worm, but the original code, matching the known public signatures. Whatever scanning is in place in the NPM repository didn’t filter them, and if an exact match for a known, major worm isn’t caught by the infrastructure, it’s unclear how a new threat would be.

Boston Scientific Hack Continues

The apparent ransomware attack against Boston Scientific continues to have impacts, with Boston Scientific filing a report with the SEC that the attack is expected to have an impact on the company earnings.

Boston Scientific makes medical devices, like pacemakers, stents, and monitoring equipment. It has not yet been publicly disclosed what happened, or if customer data was compromised, but the SEC filing confirms that unauthorized access on “certain systems” causing an outage. After several weeks of outages, the company reports that it is able to ship almost at capacity, and that the sterilization facilities for medical devices are online. While there is no estimate provided for full recovery, efforts are ongoing.

Commerce Sites Vulnerable

Adobe released a security bulletin that the Adobe Commerce and Magento platforms are under active exploitation from CVE-2026-75650, a flaw in the template engine.

These platforms power tens of thousands of commerce sites, and vulnerabilities in them are usually used to steal payment data or serve malware to customers during the checkout process. Previously this year, Magento patched another vulnerability which allowed uploading executable files to any store, and indications are that the current vulnerability has been exploited in the wild since early September 2026.

The current vulnerability allows implantation of PHP code by injecting custom styles into a query, which is then executed when Magento generates a failure email and renders the template. The attackers then download and install a control binary written in Rust which masquerades as a kernel thread task, which then monitors the store and collects payment data.

The vulnerability was publicly known and used for several days before Adobe made official statements of a fix being available, leaving any store running on Magento vulnerable with no official fixes, but as of writing this, Adobe has published patches and an advisory.

Microsoft to Block Unpatched Servers

Microsoft plans to block emails to to the cloud-hosted Exchange Online from unpatched on-premises Exchange servers.

Apparently the urge to self-host Microsoft Exchange is coupled with antipathy about actually patching it, to such a significant level that Microsoft is taking the steps to detect incoming mail from servers that have not patched since October 2025. While Microsoft updates rarely apply with zero problems, nearly a year is more than enough time to have tested and deployed a security fix.

“This update released nearly a year ago, and all organizations should have updated to it”: so say we all.

Hackers Pose as Recruiters

Government-backed groups in Iran have been posing as recruiters trying to infect targets with malware.

The group, designated “Nimbus Manticore”, is known to develop custom malware and remote access tools (RATs), and typically target specific individuals via spear-phishing attacks. The latest malware from the group is cross-platform and can infect Windows, macOS, and Linux, installing services to run websocket-based remote access tunnels, SSH tunnels, and a command-and-control client that allows live control of the infected device.

The group contacts targets posing as recruiters, but first the target must solve a coding challenge contained in a zip file. The zip contains a trojaned Node.js project which infects the victim system when compiled, deploying the remote access tools and setting up persistence to relaunch them if disabled. Multiple variants have already been spotted, generally targeting different countries, predominately Egypt, Afghanistan, and Ethiopia.

The latest version of the malware package also looks for settings and data from major security vendors like Symantec, CrowdStrike, and SentinelOne, as well as the contents of directories related to Google and Microsoft services.

The fake recruiting method has also been used by other groups in Iran and North Korea. Remember: any project with a build script can execute any commands as part of the build, and most IDE project files also allow embedding custom plugins and commands into the project. Triggering a compile on a project is the same as running arbitrary commands!

150 Million US Drivers Licenses Stolen

As many outlets are now reporting, a major ID validation company was compromised, leading to the theft of scans and data of 150 million US drivers licenses.

IDScan provides drivers license and identification card scanning services used by car rental companies, bars and dispensaries, hotels, concert venues, and a multitude of other businesses. If you’ve ever had to hand your ID over for validation, there’s a high chance you’ve interacted with IDScan or a similar company.

Evidence points to IDScan being compromised for at least a year, with full scans of licenses continually exfiltrated. The scans include everything visible on a typical license or ID card, including name, license identification number, ID photo, and home address, but also the date that it was scanned in. The collection even includes additional scans of the ID in ultraviolet and infrared to catch any watermarks. With 150 million entries, the data set contains everyone from the security researcher Brian Krebs who broke the story, to government officials like Pete Hegseth.

The data has been available for sale, individually or in bulk, although with the recent press coverage the site claiming to sell the data has gone offline for now. Before disappearing, the site claimed that all data was exfiltrated into their own databases, which means it’s still available somewhere, and shutting them out of the IDScan service won’t protect data already stolen.

Many aspects of this echo the scanned ID data stolen from validation services used by Discord and other online services: almost like scanning unchangeable government IDs is a bad plan?

American Meteor Society Knocked Offline

It’s all fun and games until they come for the geek hobbies. The American Meteor Society Fireball tracking program is was knocked offline, seemingly from a ransomware attack. Fortunately it looks like as of writing this, the admins were able to restore a backup and the site is online again.

The phones! They were one of the basic utilities of the 20th century, and were just about as reliable as death and taxes. Even when then power grid went down, you still had a fair shot of getting a phone call through thanks to the reliability of the Plain Old Telephone Service.

Today, we eschew the simplicity of copper and mechanical switches for the supreme bandwidth and capability of high-speed cellular connectivity. With that, we accept that the additional complexity comes with a risk of complicated failures that bring everything tumbling down. Australia’s largest telecommunications provider found that out to its peril just a few short months ago.

Networked Failures

Generally, we expect our telecommunications networks to be supremely reliable. There is no moment of the day when someone doesn’t need to make a call, particularly in emergencies, and the wheels of industry and commerce depend on constant connectivity these days. Tolerance for failure is generally very thin. Despite this, and the efforts of engineers to maintain uptime at as many nines as possible, Telstra fell badly short on July 8th, 2026. The company had a nationwide outage that affected 8.8 million people, leaving them unable to make calls or connect to the network at all.

The cause of the outage would prove to be particularly embarrassing. Telstra owns and operates a highly advanced cellular network, offering 4G and 5G service across the nation’s cities and much of its outback areas. The company may outwardly appear to be a shining beacon of modern connectivity, but there was something dank lurking in the company’s server closets. Namely, three aging network time servers that had the capacity to bring the whole system to its knees.

The culprit? A Microchip Technologies SSU 2000 NTP server. The model dates back to the early 2000s. Twenty four years later, Telstra still relied upon three of the units to provide network time protocol (NTP) services across its network. The servers were generally perfectly adequate in this role on any given day. That was, until the Melbourne server had a wobble.

A technician was working in the early morning to replace a backup power feed in the chassis housing the server. This caused the server to be rebooted at 3:38 AM, which normally would not be a problem. However, at some point in the last two decades or so, the server had gone through a configuration change. While it was originally intended to be a Stratum 3 NTP server, getting its time reference from a Stratum 2 unit, that process had failed at some point. It had been reconfigured instead to use its internal GPS card to gain time directly from the satellite network instead. Unfortunately, the server was also remarkably old, and suffered from a well-documented GPS date rollover bug, such that when it rebooted, it reported the time as 2006 rather than 2026.

The problem that stemmed from this was because time is critical to authentication. An endless cascade of devices downstream of the NTP server picked up the wrong time, and started using it to sign digital certificates and the like. This immediately caused other systems on the network to reject the spurious traffic with certificates that were 20 years out of date. The impact was swift and vast—Telstra was quickly facing a nationwide outage affecting millions of customers.

The issue was first detected at 4:20 AM. The naughty server was isolated by 7:11 AM, but it would take until 10:30 AM to identify all the network components which had received erroneous time data. It took several hours further—until 4 PM—to properly quell the NTP issues. In the meantime, a significant portion of the country had seen its phones offline all day, and entire rail networks had ground to a halt as their Telstra-based communications systems went completely offline.

Later submissions to a government inquiry would reveal Telstra had received two reminders to patch the GPS card, in 2020 and 2022. The vendor itself had issued warnings about the GPS rollover bug as early as November 2000. A decision not to fix the bug had been taken as recently as January 2026, because the undocumented change to have the server rely on GPS time was unknown, and thus the update was considered unnecessary. Simply patching the system would have prevented the issue from ever occurring in the first place.

The issue once again brought telecommunications availability in Australia to the forefront of the conversation. Repeat outages across Australian mobile networks have led to particular concerns about the ability for people to reach emergency services by calling Triple Zero from mobile handsets. The latest failure on Telstra’s behalf has led the local telecommunications industry to issue new guidance to the public on what to do when a call to Triple Zero doesn’t go through.

Modern handsets are designed to switch to a different cellular network in the case an emergency call can’t be connected—a process called emergency camp-on. However, this process takes time, and the caller will often hear silence on the line while the phone is attempting to connect. The new advice is that callers should hang up and try again straight away if their first call to Triple Zero doesn’t connect within a few seconds. On the second call, though, the phone should be given up to a minute to find another network to get the call through.

In the case of this outage, camp-on functionality worked—some 3,200 Triple Zero calls were passed to Optus and TPG networks when Telstra’s failed. However, there were some ongoing issues that saw a further 604 Triple Zero calls fail over the period to 2 PM the next day.

Overall, Telstra’s failure was a major one. It’s rare for a major network to go down so completely and over such a wide geographical area. The fact that it happened because of an undocumented change to an ancient network appliance is all the more embarrassing. It will drive home the message that documenting even seemingly minor changes is important, with the lesson likely to be told in the halls of the Australian telco for some decades to come.