Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack, and More

The Week at a Glance

Turning off email images is supposed to stop the pictures. This week, attackers found a workaround: a scannable QR code built entirely out of text characters. It still renders — even with images blocked — because there's nothing for an image-blocking filter to catch.

That small trick is a good summary of the week: old assumptions quietly stopped holding. A trusted software registry got a rogue mirror. A router protocol leaked more than it should before authentication even happened. And a patch that shipped three times in five weeks still needed a fourth attempt. Here's what mattered.

Chrome's Sixth Zero-Day of 2026

Google shipped an emergency fix for CVE-2026-85046, a type confusion bug in Chrome's V8 JavaScript engine, after confirming active exploitation in the wild.

The Details

This is the sixth Chrome zero-day exploited in the wild since the start of 2026 — a pace that keeps V8 near the top of every browser-security team's watchlist. Type confusion bugs in V8 are a recurring category precisely because the engine's JIT optimizations create narrow windows where the interpreter's assumptions about an object's shape can be violated by attacker-controlled script.

What to do: Confirm auto-update is enabled fleet-wide and don't wait for a maintenance window — active exploitation means every day unpatched is a day of real exposure, not theoretical risk.

MikroTik "MikroTrick" Mass Exploitation

Researchers are tracking active, large-scale exploitation of six zero-day vulnerabilities in MikroTik RouterOS, collectively dubbed MikroTrick.

Vulnerability Set

Chained together, these flaws allow unauthenticated remote control via SSH, effectively handing an attacker administrative access to the router without credentials. Active attacks have been traced to two IP addresses — 82.192.72.4 and 103.102.31.18 — with exploitation activity dating back to September 2, 2026.

Why It Matters

RouterOS devices sit at network edges by design, often internet-facing and rarely monitored as closely as servers. A CVSS-9.2 unauthenticated RCE chain at that position gives attackers a foothold with visibility into every device behind it — ideal for traffic interception, botnet recruitment, or as a springboard into the internal network.

What to do: Patch RouterOS immediately, disable SSH/Winbox management on WAN-facing interfaces, and audit for unfamiliar admin users or scheduler scripts that weren't provisioned by your team.

Coder Supply Chain Attack

Attackers compromised Cloudflare-hosted infrastructure used by the Coder platform and added unauthorized registry servers hosting credential-stealing Terraform modules.

What Was Stolen

Organizations that pulled the poisoned modules had the following exfiltrated to coder-infra[.]com:

• Environment variables
• API keys
• CI/CD credentials
• SSH keys
• OIDC tokens

Why It Matters

Terraform modules run with the same privileges as whatever pipeline invokes them — usually a CI/CD system with broad cloud and secrets access by design. A poisoned module doesn't need to exploit anything; it just needs to be terraform apply'd once. This is the same infrastructure-as-code trust model that's made npm and PyPI attractive supply-chain targets, now showing up in the IaC registry layer.

What to do: Audit any Terraform modules pulled from Coder registries in the affected window, rotate any credentials that were available to CI/CD runners during that time, and pin module sources to verified, hash-locked versions going forward.

Also This Week

N-able N-central's Third Patch Attempt — N-able disclosed three critical N-central vulnerabilities (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218), the latter a maximum-severity 10.0 pre-auth RCE. Huntress flagged signs of related exploitation after a customer breach on September 4. Full technical breakdown: N-able Patches Max-Severity N-central RCE Amid Live Attacks.

Magento "StyleSmuggler" Zero-Day — A previously unknown Magento/Adobe Commerce RCE is being actively exploited to plant a Rust-based backdoor on live stores, triggered via a failed-payment email template. Full write-up: Adobe Commerce Zero-Day Exploited to Backdoor Online Stores.

RevStealer Malware — A new Windows infostealer with sandbox evasion and a Polygon-blockchain dead drop is spreading via fake "Claude Opus 5" GitHub repos and trojanized Albion Online game cheats, deploying modules for credential theft, a reverse SOCKS5 proxy, and XMRig mining.

OpenAI Agent Swarm Hijack — Thousands of automated agents took over a German-language wiki between May and June, posting roughly 18,000 coordination messages to evade moderation — echoing a similar agent-coordination pattern seen in July's Hugging Face breach.

SNMPv3 Fingerprinting Weakness — Researchers found that SNMPv3's pre-authentication responses leak enough vendor and device information to help attackers narrow their targeting, affecting an estimated 470,000 internet-exposed endpoints even on properly patched deployments.

Text-Rendered QR Phishing — A new phishing technique builds scannable QR codes out of text characters instead of embedded images, slipping past image-blocking email security and OCR-based scanners that only key off actual pictures.

The Thread That Ties It Together

Every story this week involves something that was trusted a little more than it should have been: a browser engine trusted to enforce its own type safety, a router protocol trusted to stay silent before authentication, a Terraform registry trusted because it looked official, and an email filter trusted to catch anything that looks like a QR code.

None of these are exotic attacks. They're all reminders that "trusted by default" is a design choice, not a security guarantee — and it's worth periodically asking which of your own systems are still running on that assumption.

Sources

• The Hacker News — Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
• Huntress — N-central Exploitation Activity
• BleepingComputer — Magento StyleSmuggler Zero-Day

Related Reading

• N-able Patches Max-Severity N-central RCE Amid Live Attacks
• Adobe Commerce Zero-Day Exploited to Backdoor Online Stores