Today’s stories are all patch-cycle stories, but each sits at a different point in that cycle — one bug already weaponized before the fix shipped, one with a public exploit racing ahead of admin adoption, and one that sat undiscovered for over a decade before anyone noticed. Here’s what’s new since yesterday’s digest.
Vulnerability watch: Chrome V8 zero-day added to CISA’s KEV catalog days after emergency patch
Google shipped an emergency Chrome update to fix CVE-2026-85046, a type-confusion flaw in the V8 JavaScript engine that was already being exploited in the wild when the patch landed. A specially crafted HTML page with malicious JavaScript can trigger the bug and potentially achieve remote code execution inside Chrome’s sandboxed renderer process. Google, as is standard for actively exploited bugs, withheld technical details to slow down copycat exploitation while the update rolls out. The fix brings Chrome to version 152.0.7977.82/.83 on Windows and macOS and 152.0.7977.82 on Linux — this is the sixth actively exploited Chrome zero-day patched so far in 2026. CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4, giving federal civilian agencies until September 18 to patch. The Hacker News · BleepingComputer · Help Net Security
A KEV listing is a deadline for federal agencies, not a suggestion for everyone else. If your fleet management pushes Chrome updates automatically, confirm the rollout actually reached endpoints rather than assuming it did — auto-update policies drift, and a zero-day that’s been public for several days is no longer a zero-day for the attackers who reverse-engineer patches for a living.
Vulnerability watch: Public exploit lands for Microsoft Exchange auth-bypass bug — 22,000 servers still unpatched
A working proof-of-concept exploit for CVE-2026-62911, a CVSS 8.0 authentication-bypass-by-capture-replay flaw in Exchange Server 2016, 2019, and Subscription Edition, went public on September 1 — three weeks after Microsoft’s August 11 disclosure. The exploit requires only network access to a target Exchange server, lets an attacker who captures authentication traffic replay it to impersonate legitimate users, and runs the full privilege-escalation chain in under five minutes. As of August 31, scans counted 21,899 unique IP addresses still running unpatched, vulnerable Exchange instances. Help Net Security · BleepingComputer
A five-minute, network-only exploit chain against on-prem Exchange is squarely in “patch this week” territory, not “patch this quarter.” If you’re still running affected builds, this is also a good moment to check whether your detection coverage would actually catch a replayed-authentication attack — it doesn’t look like a brute-force or a new-device login, so a rule built for either of those won’t fire.
Vulnerability watch: 12-year-old PostgreSQL flaw let replication accounts backdoor the server
Researchers disclosed CVE-2026-6471 (“PostGREShell”), a logical-decoding flaw present in PostgreSQL since the feature was introduced in version 9.4 back in 2014. Any account carrying the REPLICATION attribute — typically a limited-purpose backup or replication role, not a full admin — can load and execute arbitrary code on the server when wal_level is set to logical, a common configuration for change-data-capture pipelines. That foothold escalates to full superuser privileges and a persistent backdoor. PostgreSQL shipped the fix on August 13 in versions 18.6, 17.11, 16.15, 15.19, and 14.24, adding a new output_plugin_libraries parameter that restricts which libraries can load as logical-decoding output plugins. The Hacker News · SecurityWeek
If you run PostgreSQL with logical replication for CDC or analytics pipelines, check who holds the REPLICATION attribute today — it’s easy to grant that role broader trust than it deserves because it “only” does replication. Confirm you’re on a patched minor version and that output_plugin_libraries is set to the plugins you actually use, not left wide open by default.
Also noted
Broadcom published VMSA-2026-0007, patching two critical VMware Workstation and Fusion vulnerabilities: CVE-2026-59346 (CVSS 9.3, integer overflow) and CVE-2026-59347 (CVSS 8.1, stack-based buffer overflow), both letting a VM admin with local access escape to code execution on the host. There are no workarounds — patching to version 26H1u1 is the only fix. Broadcom says it has no evidence of in-the-wild exploitation, but a VM-escape bug with a public CVSS score this high tends not to stay theoretical for long. SecurityWeek · The Hacker News
Final thought
Three different disclosure timelines, one common lesson: the gap between “patch available” and “patch applied” is where all of today’s risk actually lives. A zero-day fixed the same week it was found, a three-week-old bug with a five-minute public exploit and 22,000 exposed servers, and a twelve-year-old bug nobody looked for until someone did — none of these are exotic. They’re a reminder to check your own patch cadence against what’s actually running in production, not what your inventory says should be. If you want help confirming your logging would catch exploitation of a bug like these before the patch lands, see our how-to guides or book a discovery call.