CVE-2021-38003

Multiple threat actors are exploiting a new vulnerability chain involving flaws in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) to deploy an undocumented exploit kit called BlueMoon. The campaigns, primarily attributed to China-aligned groups, have targeted fewer than 20 organizations globally. Separately, a zero-click worm dubbed WeWorm exploits a vulnerability in WeChat (patched in August 2026) to hijack accounts and spread via incoming calls on Android and iOS without user interaction, requiring only that the attacker be on the victim's friends list. Additionally, hackers are deploying a fileless Linux rootkit on compromised F5 BIG-IP APM devices, leveraging CVE-2025-53521 to inject a web shell into memory via PHP eval() calls, tracked by ESET as PoisonedRefresh.