Daily Signal — 2026-09-09

This is FLLC's automated morning scan of named public sources. It is intentionally concise: what changed, why it may matter, what to verify next, and where the claim came from. 5/5 sources were live for this edition.

At a glance

• CVE-2026-75650 leads the latest CISA exploited-vulnerability entries.
• CISA advisory watch: China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies.
• M5.2 was the strongest M4.5+ event in the USGS 24-hour feed.
• Long March 2D/YZ-3 | Unknown Payload is next on the public launch manifest.

Exploited vulnerabilities

• CVE-2026-75650 — Adobe Commerce and Magento. Added 2026-09-08; remediation due 2026-09-11. Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• CVE-2026-81963 — Microsoft Windows. Added 2026-09-08; remediation due 2026-09-22. Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• CVE-2026-86218 — N-able N-central. Added 2026-09-08; remediation due 2026-09-11. N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

KEV priority queue

• CVE-2026-75650 · Adobe Commerce and Magento · added 2026-09-08 · due 2026-09-11
• CVE-2026-81963 · Microsoft Windows · added 2026-09-08 · due 2026-09-22
• CVE-2026-86218 · N-able N-central · added 2026-09-08 · due 2026-09-11
• CVE-2026-85880 · Microsoft Windows · added 2026-09-08 · due 2026-09-22
• CVE-2026-85046 · Google Chromium V8 · added 2026-09-04 · due 2026-09-18
• CVE-2026-59822 · BerriAI LiteLLM · added 2026-09-02 · due 2026-09-16
• CVE-2026-48710 · Kludex Starlette · added 2026-09-02 · due 2026-09-16
• CVE-2026-49869 · Kestra Kestra OSS · added 2026-09-02 · due 2026-09-05

Defensive move: match the cited products against your actual inventory, follow the vendor remediation, and prioritize internet-facing or privileged systems. A catalog entry is evidence of exploitation in the wild—not proof that your environment is compromised.

Threat-actor and campaign watch

• China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies — published 2026-09-08 12:00 UTC. This is an actor-linked signal because the official CISA title or summary explicitly names an actor, campaign, or ransomware operation; FLLC is not independently assigning attribution.

Trace responsibly: preserve the source and timestamp, map only explicitly reported infrastructure and MITRE ATT&CK behaviors, separate observed facts from assessment, and record confidence. A vendor, geography, malware family, or IP address alone is not actor attribution.

Earth systems

• M5.2 — 123 km NNE of Ruteng, Indonesia, 2026-09-08 15:36 UTC. The M4.5+ day feed contained 11 events when retrieved. Open the USGS event.

• NOAA space-weather data was unavailable or malformed during this run.

Interpretation boundary: earthquake magnitude does not establish local impact, and Kp is planetary-scale context. Follow the issuing agency and local authorities for decisions.

Orbital watch

• Long March 2D/YZ-3 | Unknown Payload — China Aerospace Science and Technology Corporation; Go for Launch; no-earlier-than 2026-09-10 09:00 UTC. Pad: Launch Area 94 (SLS-2 / 603) · Jiuquan Satellite Launch Center, People's Republic of China.

Launch times and status can move. Confirm with the launch provider before travel, viewing, or operational decisions.

Source health

• CISA: live
• ADVISORIES: live
• USGS: live
• NOAA: live
• LAUNCHES: live

Primary sources

• CISA Known Exploited Vulnerabilities
• CISA Cybersecurity Advisories
• USGS M4.5+ earthquakes, past day
• NOAA SWPC planetary K-index
• Launch Library 2 upcoming manifest

Retrieved 2026-09-09 15:15 UTC. Automated, source-linked, and reviewed by machine rules for completeness. It is not emergency, navigational, investment, or legal advice.