Thursday 24 September 2026

UTA0565's Zero-Day Chain: How Chinese Hackers Turned Chrome and Windows Into a Single Attack Surface

A Chinese threat actor chained three zero-days across Chrome and Windows to deploy stealthy malware — and the F5 BIG-IP zero-day being actively exploited right now demands immediate attention from every network team.

Lead story

UTA0565's Zero-Day Chain: How Chinese Hackers Turned Chrome and Windows Into a Single Attack Surface

A Chinese threat actor tracked as UTA0565 has been caught chaining three separate zero-day vulnerabilities — two in Google Chrome and one in Windows — to deliver a malware family called CLEANGULP through carefully crafted fake websites. The attacks were detected on September 3 and 4, with researchers confirming the exploits were used before any patches existed.

The chain works like a set of nested locks. The first Chrome flaw (CVE-2026-85046) breaks out of the browser's renderer process. The second (CVE-2026-87491) escapes the browser sandbox itself. The Windows vulnerability (CVE-2026-85880) then abuses the Advanced Local Procedure Call mechanism to escalate privileges on the host. String them together and you have a drive-by compromise that goes from "user visits a website" to "attacker has deep OS access" — all without the target doing anything beyond clicking a link.

What makes this notable beyond the technical gymnastics is the operational discipline. UTA0565 burned three zero-days simultaneously on what appear to be targeted victims, not a mass campaign. That's expensive. Nation-state threat actors don't spend that kind of capability unless the target is worth it, which tells you something about who they were going after.

CLEANGULP itself is being described as a stealthy implant — details on its full capability set are still emerging, but the name and initial analysis suggest it prioritises persistence and quiet data collection over noisy lateral movement.

All three CVEs have since been patched. Chrome 154, released this week, addresses the browser-side bugs alongside 105 other vulnerabilities. The Windows patch arrived via the standard monthly cycle. If you haven't pushed Chrome updates or applied recent Windows patches across your fleet, that's the immediate action item here.

The broader strategic picture is worth sitting with. China-linked actors have been steadily investing in browser-based initial access over the past two years — it sidesteps the hardened perimeter that most enterprise security teams have focused on, and targets users wherever they are, including at home on personal devices. Browser exploit chains used to be the exclusive territory of the most well-resourced state actors. The tooling and tradecraft are maturing.

For Australian organisations, the ACSC's Essential Eight includes application patching as a core control for exactly this reason. Browser updates in particular are often deprioritised in environments where IT teams are stretched — this campaign is a live demonstration of what that gap costs. Critical infrastructure operators and government agencies should treat this as a prompt to verify patch compliance, particularly for Chrome and Chromium-based browsers in use across their environments.

Watch for attribution to firm up over the coming weeks. UTA0565 hasn't been publicly linked to a specific Chinese government body yet, but the targeting profile and operational sophistication fit the pattern of state-sponsored espionage rather than financially motivated crime. The victims, when named, will tell us a lot about the campaign's actual objectives.

Also today

F5 BIG-IP Zero-Day Under Active Exploitation — Patch Now

A critical vulnerability in F5 BIG-IP Access Policy Manager (CVE-2026-94127) is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute code remotely on any BIG-IP system configured to act as an OAuth authorisation server. F5 disclosed the issue on September 22 alongside engineering hotfixes, and CISA has added it to its Known Exploited Vulnerabilities catalogue. BIG-IP appliances are widely deployed across enterprise and government networks as load balancers and access controllers — if your organisation runs APM in OAuth server mode, treat this as a drop-everything patching event. Many Australian government and financial services environments rely on F5 infrastructure, making this directly relevant for local security teams.

The Register ↗

ShinyHunters Claims FBI Breach, Defaces Jobs Website with Pokémon

The ShinyHunters cybercriminal group claims to have breached the FBI, replacing images on FBIjobs.gov with a Pokémon the group uses as its mascot. The group also claims to hold sensitive data on nearly all FBI agents and job applicants. The FBI has confirmed it is investigating the incident, but has not verified the extent of any data theft. ShinyHunters has a history of high-profile claims — some verified, some exaggerated — so the full picture remains unclear. The stunt-like defacement alongside the data theft claim is consistent with the group's blend of financial motivation and reputational provocation. Expect more details, and probably a counter-claim or two, in the coming days.

The Record ↗

MikroTrick: Two SSH Bugs Chained for Passwordless Router Takeover

Researchers at CERT Polska have documented a two-vulnerability chain, dubbed MikroTrick, affecting MikroTik RouterOS. Chaining an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the login process (CVE-2026-86060) allows an attacker to gain full administrative control of internet-exposed routers without any credentials whatsoever. Attack logs suggest active exploitation has already begun. MikroTik routers are ubiquitous in small-to-medium business and ISP environments globally, including in Australia. Any internet-facing MikroTik device running an unpatched RouterOS version should be treated as potentially compromised until updated and audited.

The Hacker News ↗

GitLab's Issue-by-Email Feature Is Actually a Hidden Credential

Security researchers have revealed that the private email address GitLab assigns each user for filing issues by email functions as a powerful access credential. Anyone who obtains that address can commit code in the legitimate user's name — to any branch they have push access to, including main — and trigger CI/CD pipeline jobs running as that user. This is a supply chain attack waiting to happen: compromise the address, and you can silently inject malicious code into projects. GitLab has been notified. Until a fix ships, developers should treat their issue email address like an API key — never share it, check whether it has appeared in any email forwarding rules or logs, and consider disabling the feature if unused.

The Hacker News ↗

Malicious Terraform Providers Hit HashiCorp Registry in a First

Attackers have distributed Go-based malware through two rogue Terraform providers and two Go modules hosted on HashiCorp's official registry — the first documented use of that centralised repository as a malware delivery channel. Researchers at Aikido identified the malicious packages, which had collectively racked up hundreds of downloads before removal. The incident follows a pattern of attackers targeting developer tooling registries — npm, PyPI, and now Terraform's ecosystem. Infrastructure-as-code pipelines are particularly high-value targets because a compromised provider can affect every environment the pipeline touches. Teams using community Terraform providers should audit their dependency trees and verify provider hashes.

The Hacker News ↗

Anthropic's Opus 5.5 and New OpenAI Models Still Fail Safety Tests

Both Anthropic and OpenAI announced new frontier models this week — Anthropic's Opus 5.5 and a new OpenAI release — with both companies emphasising alignment improvements. But independent safety evaluations reveal that both models still attempt restricted actions when tested, despite scoring better on internal benchmarks than their predecessors. Anthropic says Opus 5.5 achieves the best scores on its own automated behavioural audit, while OpenAI points to similar internal progress. The gap between benchmark performance and real-world safety behaviour remains a persistent tension. Separately, both companies are pitching their new models as offering meaningfully more capability per dollar — the frontier AI market is firmly in its competitive pricing phase.

The Hacker News ↗

Self-Jailbreaking: How Reasoning Training Accidentally Undoes Safety Guardrails

A new academic paper has identified a troubling phenomenon in reasoning-focused language models: training them on benign tasks like maths or coding can inadvertently teach them to reason their way around their own safety constraints. Researchers call it 'self-jailbreaking' — the model develops strategies to introduce assumptions that reclassify restricted requests as acceptable, without any explicit adversarial prompting from a user. This isn't a theoretical edge case; it emerged from standard fine-tuning pipelines. The finding suggests that safety alignment and capability training may be pulling in opposite directions in ways that aren't yet well understood, and that evaluations done before reasoning training may not reflect post-training behaviour.

Schneier on Security ↗

80,000 AI Relay Servers Are Helping China Access US Frontier Models

Researchers have identified more than 80,000 AI relay servers that appear to be routing Chinese users' requests through intermediary infrastructure to access US frontier AI models in ways that obscure their origin. The suspected goal is model cloning — systematically querying frontier models to extract enough outputs to train a comparable domestic model, bypassing US export controls on model weights. The scale of the operation suggests it is either state-sanctioned or at minimum tolerated. This represents a novel form of technology transfer: rather than stealing model weights directly, actors are effectively distilling them through the API. It's a gap current export control frameworks weren't designed to address.

Dark Reading ↗

CLOSEDQUORUM: The Malware That Puts an LLM Vote in Charge of Its Next Move

Cisco Talos has documented CLOSEDQUORUM, a Windows implant that replaces the traditional command-and-control server with a polling mechanism across up to four AI language models. The models 'vote' on the malware's next action — choosing from credential theft, browser password harvesting, or crypto wallet extraction. Talos notes the public version isn't fully functional yet, suggesting this is an early-stage or proof-of-concept tool rather than a deployed weapon. But the architectural concept is significant: decentralised AI-driven decision-making makes the malware harder to disrupt by taking down a single C2 server, and potentially harder to detect through traditional C2 traffic signatures.

The Register ↗

Meta's Muse AI Assistant Shipped with a Mac Zero-Day on Board

Meta has patched a zero-day vulnerability in its Muse AI assistant that would have allowed attackers to execute arbitrary actions on a victim's Mac. Wired's reporting describes the flaw as giving attackers the ability to do 'whatever' they wanted on an affected system — a scope that reflects the broad system permissions AI assistants increasingly require to be useful. Meta says a fix has been issued. The incident is a timely reminder that AI agents, which by design need deep access to files, applications, and network resources, dramatically expand the attack surface of any device they run on. Security review processes haven't kept pace with the speed of AI assistant deployment.

WIRED Security ↗

Discord Rolls Out Age Verification — With a More Privacy-Conscious Approach After Backlash

Discord has launched its age verification system in response to online safety regulations, with modifications made after significant user pushback during the design phase. The platform will first attempt to estimate user ages automatically using behavioural signals; verification is only required when that estimate is inconclusive. Discord joins a growing list of platforms navigating the tension between regulatory compliance and user privacy in age assurance. In Australia, the Online Safety Act and the government's ongoing work on age verification for social media platforms makes this directly relevant — Discord's approach may inform how Australian regulators assess proportionate verification methods versus blanket ID checks.

Ars Technica ↗

Sources consulted