Today’s Field Note

CISA added N-able N-central CVE-2026-86218 (CVSS 10.0, pre-auth RCE) to the KEV catalog with an FCEB deadline of September 11, which means it is already being used against RMM tooling that sits above your entire estate. Separately, Sophos confirmed active break-ins at F5 BIG-IP APM appliances where attackers inject a fileless PHP web shell straight into Apache’s in-memory copy of the appliance’s own scripts, so disk scans come back clean and a Linux rootkit hides the rest. And Google shipped Chrome 153 to fix CVE-2026-87491, an exploited out-of-bounds write in V8, the seventh Chrome zero-day this year. Microsoft’s record 974-CVE Patch Tuesday and SAP’s CVSS 10.0 OVERPASS kernel flaw (CVE-2026-44756) matter, but the three above are where attackers already are today.

Today’s Action

  • Patch N-able N-central to the fixed build now; if you run it as an MSP or internally, treat any delay past the September 11 KEV deadline as an active incident, not a maintenance window.
  • On F5 BIG-IP APM, assume disk scans lie: hunt in memory and process space for injected PHP and the Linux rootkit per Sophos’s indicators, and rotate any credentials or sessions those appliances brokered.
  • Push Chrome 153 (and Chromium-based browsers) across the fleet to close CVE-2026-87491, then force a restart so the update actually lands.
  • Prioritize Microsoft’s two exploited privilege-escalation zero-days and the ~20 wormable CVEs out of the 974 first; do not try to eat the whole batch at once.
  • Schedule SAP CVE-2026-44756 (OVERPASS, CVSS 10.0) for your next controlled window since it is unauthenticated RCE, even without confirmed exploitation yet.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

You didn’t get to pick which fire started first. Move.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.