Two weeks that rewarded the patient and punished the exposed. September's Patch Tuesday leaned hard into server-side, zero-interaction code execution, the kind that does not wait for a user to click. A single image-sharing service handed an attacker the metadata of nearly half a billion images. And in the quietest but, for our line of work, the most consequential move, Apple changed how iOS handles a log file that examiners have relied on for years to catch mercenary spyware.
Here is what mattered, and what it means for anyone who has to reconstruct what happened after the fact.
The Week in Security
Patch Tuesday was a zero-click month
The September 2026 Microsoft update cycle was not a routine one. The headline is CVE-2026-55007, a remote code execution flaw in Microsoft Exchange Server. A remote, unauthenticated attacker gets code execution on the Exchange server by sending an email with a malicious Visio attachment. The code runs when the server processes the mail. There is no click to blame, no user to train, no attachment to open. The mail server does the work for the attacker.
Microsoft Office took 22 critical patches, and 12 of them are exploitable through the Preview Pane or Reading Pane. Merely previewing a crafted file triggers execution, with no click, no attachment open + no macro prompt. Alongside that sat at least 17 unauthenticated, network-reachable RCE flaws across core infrastructure services: DNS, DHCP, MSMQ, NFS + the secure socket layer. Two Windows elevation-of-privilege bugs, CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Advanced Local Procedure Call), are being exploited in the wild right now.
The forensic reading: the interesting compromises this month will show no user action at all. If your triage playbook still starts with "which user clicked what," it will miss the server that opened a Visio file by itself. Preservation should lead with the Exchange transport logs, the message tracking logs + the process-creation record on the mail server itself, not the endpoint inbox. The evidence of a zero-click server compromise lives on the server, and it rolls fast.
CISA moved on seven more actively exploited flaws
CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog on September 2, and the list reads like a tour of the modern attack surface. It includes SonicWall SMA1000 appliance flaws (CVE-2026-83548 + CVE-2026-83549), a JFrog Artifactory authentication bypass (CVE-2026-82329), a Sangoma Switchvox SQL injection (CVE-2026-9586), a Kestra OS command injection (CVE-2026-49869) + an authentication flaw in the BerriAI LiteLLM proxy (CVE-2026-59822). That last one is worth a pause: LiteLLM sits in front of AI model deployments, and an authentication bypass there is a door straight into whatever the model can touch. The AI supply chain is now firmly in the exploited-in-the-wild column, not the theoretical one.
A half-billion images, and the metadata that came with them
Helpfeel disclosed a breach of its Gyazo image-sharing service. An attacker exploited a flaw in an upload server to run arbitrary commands + reach backend systems. The unauthorized access occurred on September 11. The exposure: roughly 23.62 million user-related records + metadata tied to about 490 million images.
The metadata is the story. Image metadata is not the picture, but for an investigator it is frequently more useful than the picture. Capture timestamps, device model, software version + in too many cases the GPS coordinates baked into the EXIF header. A breach that leaks the metadata of 490 million images is a location-history + device-fingerprint dataset at a scale most people never consented to. It is also a reminder to examiners on the other side of the table: when you pull images in a case, the metadata is evidence in its own right, and it survives edits, crops + re-saves far more often than people assume. Read the header, not just the frame.
Apple erased a spyware detective's favourite artifact
The one to watch. iOS 26 changes how the operating system handles shutdown logs, and in doing so it erases a key source of evidence for detecting Pegasus + Predator mercenary spyware. For years the shutdown log (the record of processes that resisted a clean shutdown) has been one of the most reliable lightweight tells that a device was carrying that class of implant. It was the artifact behind a great deal of the public Pegasus detection work.
That artifact is now less useful on iOS 26. This is not Apple helping the attackers; hardening the system genuinely closes doors. But every change that reduces what the OS records also reduces what an examiner can recover, and this one lands squarely on the highest-stakes mobile investigations there are. The practical response is to stop leaning on any single artifact. Sysdiagnose captures, crash + panic logs, network + DNS records, the pattern of process deaths + a full-filesystem image where lawfully available together tell a story no single log can. Amnesty's Mobile Verification Toolkit and Google's own new Android Intrusion Logging (part of Advanced Protection) point the same direction: spread the detection across many weak signals instead of trusting one strong one, because the strong ones keep disappearing.
Google's Android Intrusion Logging is the mirror image of Apple's move, and the more encouraging one. It is an opt-in log that records errors + collects evidence when the software behaves unexpectedly, built specifically to give high-risk users a forensic trail after a suspected spyware hit. New evidence sources are rare. This one is worth knowing exists before you need it.
By the Numbers
- 1 unauthenticated, zero-click Exchange RCE (CVE-2026-55007) that fires when the server processes an email.
- 12 Microsoft Office critical flaws exploitable through the Preview Pane, no click required.
- 17+ unauthenticated network-reachable RCE flaws across DNS, DHCP, MSMQ, NFS + secure sockets in one update cycle.
- 2 Windows elevation-of-privilege bugs (CVE-2026-81963, CVE-2026-85880) confirmed exploited in the wild.
- 7 vulnerabilities added to the CISA KEV catalog on September 2 alone.
- 23.62 million user records exposed in the Gyazo breach.
- ~490 million images whose metadata was exposed in that same breach.
- 1 long-trusted iOS forensic artifact (the shutdown log) materially weakened by iOS 26.
What To Do This Week
Patch the mail server first, and the endpoints second. CVE-2026-55007 is a zero-click Exchange RCE under active interest. If you run Exchange on-prem, this is the patch that jumps the queue. The Office Preview-Pane flaws come next, because "don't open the attachment" is no longer advice that protects anyone.
Assume no click. Update your triage default. When something looks wrong this month, do not start by hunting for the user error. Preserve the server-side transport + process logs first, because a zero-click compromise leaves its trace on the service, not the person.
Treat image metadata as evidence, on both sides. If you hold images in a matter, hash + preserve the originals with their EXIF intact; the header carries timestamps, device identity + often location that survive editing. If you advise on the breach side, understand that leaked image metadata is a location + device-tracking dataset, not a harmless byproduct.
Stop trusting single mobile artifacts. iOS 26 just proved why. Build mobile investigation on a spread of signals: sysdiagnose, crash + panic logs, process-death patterns, network records + a full-filesystem image where the law allows it. Know that Android Intrusion Logging + the Mobile Verification Toolkit exist, and reach for corroboration rather than one silver-bullet log.
Put LiteLLM + your AI proxies in the patch scope. The LiteLLM authentication flaw in this cycle's KEV additions is a sign of where attackers are turning. If an AI gateway sits in your stack, it belongs on the same patch cadence as everything else that faces the network.
The theme across all of it: the evidence is moving. Zero-click compromises hide on the server, breached metadata outlives the files it described + the mobile artifacts examiners relied on are being hardened out of existence one release at a time. The investigators who keep up are the ones who stop depending on any single place for the truth.
Sherlock Forensics builds tools for exactly this problem: reading what a device or an archive actually holds, on your own machine, with a record you can defend. If a matter this fortnight has you staring at a phone, a mailbox or a pile of images, that is the work we do.
Sources
- Zero Day Initiative, The September 2026 Security Update Review: thezdi.com
- CrowdStrike, September 2026 Patch Tuesday Analysis: crowdstrike.com
- CISA, Seven Known Exploited Vulnerabilities added (Sept 2, 2026): cisa.gov
- CISA Known Exploited Vulnerabilities Catalog: cisa.gov
- CyberInsider, Gyazo data breach (23.6M records, 490M image metadata): cyberinsider.com
- TechCrunch, The worst hacks and breaches of 2026 so far: techcrunch.com
- iVerify, Key IOCs for Pegasus + Predator cleaned with the iOS 26 update: iverify.io
- TechCrunch, Google launches Android feature to uncover spyware attacks: techcrunch.com
- Infosecurity Magazine, Google launches Android spyware forensics tool: infosecurity-magazine.com