These news items are automatically aggregated from industry sources and are not individually reviewed. Any inaccuracies are unintentional —
let us know and we'll correct or remove it.
The Dutch data protection authority fined Uber almost 825 million euros for letting a fully automated system suspend and permanently deactivate driver accounts between 2018 and 2022, with no meaningful human review and no clear disclosure to the drivers affected. It is the second-largest GDPR fine ever issued, and the underlying failure, automated decisions without a real human check, is one many European companies deploying AI and fraud-detection tooling still have not fixed.
StyleSmuggler (CVE-2026-75650, CVSS 10.0) is an unauthenticated remote code execution flaw hitting every current version of Magento and Adobe Commerce, exploited in the wild since September 4 before Adobe’s emergency hotfix landed on September 7. The first confirmed victim was fully patched against every prior advisory, which means patch history alone no longer proves a European storefront is safe.
N-able shipped an emergency hotfix on September 5 for CVE-2026-86218, a maximum-severity pre-authentication remote code execution flaw in N-central that was already being exploited before the patch existed. It is the third zero-day disclosed against the platform in six weeks, and N-central sits at the center of how thousands of managed service providers, including many across Europe, monitor and control their clients’ infrastructure.
CVE-2026-85046, a type confusion flaw in Chrome’s V8 JavaScript engine, lets an attacker execute code inside the browser sandbox from a single crafted web page. Google confirmed active exploitation, shipped Chrome 152.0.7977.82 on September 3, and CISA added the bug to its Known Exploited Vulnerabilities catalog the next day with a September 18 remediation deadline for federal systems.
A routing failure in Microsoft Azure’s East US infrastructure on September 3 knocked ChatGPT, Claude and Grok offline within the same 90-minute window, since all three lean on Azure compute in that region. Google’s Gemini, running on entirely separate infrastructure, stayed up throughout. Full recovery took nearly five hours, and the incident is a clean case study in what shared cloud dependency actually costs when it fails.
CVE-2026-59822 lets an unauthenticated attacker open an authenticated session on LiteLLM’s MCP Streamable HTTP endpoint using nothing but a made-up Bearer token, thanks to an OAuth2 passthrough fallback that silently replaced failed key validation with an empty, but accepted, auth object. CISA added it to its Known Exploited Vulnerabilities catalog on September 2, separate from the supply chain compromise the same gateway suffered earlier this year.
CVE-2026-48710, nicknamed BadHost, lets an unauthenticated attacker bypass path-based security middleware in Starlette, the Python framework underneath FastAPI, vLLM, LiteLLM and countless MCP servers, by sending a single malformed character in the HTTP Host header. Belgium’s Centre for Cybersecurity issued a patch-immediately advisory, and CISA added it to its Known Exploited Vulnerabilities catalog on September 2.
CNIL fined Hopital Prive de la Loire 500,000 euros after an attacker used compromised credentials, with no multi-factor authentication in the way, to browse the medical records of 524,867 patients undetected through summer 2025. The regulator also found the hospital never notified 202,246 affected third parties, a separate violation of GDPR’s breach notification duty.
During routine network maintenance on September 1, a procedural error at Google caused an engineer to sequentially disconnect every fiber path across the routing devices in a us-central1-b cluster within about thirteen minutes, pushing traffic-drop rates to 100 percent at peak and leaving VMs unreachable from outside the zone for over four hours. The redundancy Google’s design assumed did not help, because the failure removed every redundant path at once.
SonicWall disclosed two SMA1000 vulnerabilities on September 1: a perfect-10 pre-auth SSRF in the Work Place portal (CVE-2026-83548) and a high-severity command injection in the Appliance Management Console (CVE-2026-83549). Chained together they give an unauthenticated attacker remote code execution on the appliance, and CISA added both to its KEV catalog with a federal remediation deadline of September 5.
This site uses cookies. By continuing to use this website, you agree to their use.
We’ll help you resolve your infrastructure challenges
Our team of experts is ready to help you with your infrastructure challenges. We’ll give you honest and personal treatment. Get in touch to learn more.
