This week’s priorities are an actively exploited Australian e-commerce vulnerability, Windows September-update problems affecting remote access, and new TP-Link router firmware advisories.
Important and actionable
1. Critical Magento/Adobe Commerce flaw exploited in Australia
On 9 September, the ACSC warned that CVE-2026-75650 is being actively exploited and that a substantial number of potentially vulnerable Australian systems exist.
The flaw affects Adobe Commerce and Magento Open Source installations with an exposed /graphql endpoint and permits unauthenticated remote-code execution. Adobe released patches on 7 September.
Actions:
- Identify clients, web developers or hosting providers operating Magento.
- Require confirmation of the installed version and patch—not simply “the host handles security.”
- If immediate patching is impossible, restrict access to
/graphqlwhere operationally feasible and increase monitoring. - Review unfamiliar scheduled tasks, altered templates, failed notifications and unusual application logs.
- Investigate possible compromise separately; patching does not remove access an attacker has already established.
ACSC Australian exploitation alert
Support opportunity: Offer an internet-facing systems audit that records each website, CMS, firewall, VPN and remote-access service, its responsible provider and evidence of current patching.
2. Windows September update can destabilise Remote Desktop
Microsoft confirmed that the 8 September security update, KB5124008, can make Remote Desktop Services unstable across numerous Windows and Windows Server releases.
Reported symptoms include:
- RDP sessions failing after several minutes
- Sign-in failures
- Servers hanging at “Please wait for Remote Desktop Configuration”
- MMC, File Explorer and the RDS Licensing Diagnoser becoming unresponsive
- Windows Update continually displaying a loading indicator
Microsoft lists the issue as mitigated but is still developing a permanent update. If an affected virtual machine becomes unreachable, stopping/deallocating and restarting it may temporarily restore access.
Continue security patching, but for RDS servers:
- Confirm that console, hypervisor or hosting-portal access works before updating.
- Patch a pilot system first where multiple session hosts are involved.
- Arrange a maintenance window and an alternative way back into the server.
- Do not rely exclusively on RDP for recovery.
Microsoft Windows release-health notice
3. The same Windows update has two additional support traps
KB5124008 can also cause:
- USB Audio Class 1.0 failures: Code 10, no sound, frozen volume controls or failed multichannel audio. Switching an affected device to two-channel mode may help temporarily.
- Missing Linux VM shared folders: Plan9 shares may disappear in WSL and other HCS-managed environments, including Claude Cowork. Ordinary Hyper-V VMs not using Plan9 are unaffected.
Both remain under investigation. Check update history before replacing USB audio equipment or rebuilding WSL. Microsoft’s current issue details
The good news: this update resolves the previously reported ARM Outlook/Teams launch failures, black desktop backgrounds, mouse-setting resets and RGB-driver game crashes.
4. New TP-Link router firmware advisories
TP-Link published two relevant advisories on 10 September.
- Deco BE11000 v2: A high-severity adjacent-network vulnerability can allow root command execution. Update to firmware 1.3.5 Build 26071712.
- Archer MR600 and TL-MR6400: Several hardware revisions have vulnerabilities affecting file uploads and VPN configuration. One can allow an unauthenticated attacker on an adjacent network to view or change VPN configuration.
The MR600 is particularly relevant to mobile-broadband and backup-internet installations. Firmware is hardware- and region-specific, so record the complete model and revision before updating.
TP-Link Deco BE11000 advisory · TP-Link MR600/TL-MR6400 advisory and fixed versions
5. A clean antivirus scan is not proof that a scam-affected computer is clean
The ACSC’s 8 September advisory explains how criminals use “crypters” to repeatedly repackage malware so signature-based antivirus products are less likely to detect it.
For a computer involved in a remote-access scam, supplement malware scanning with checks for:
- Unfamiliar local users and administrators
- UltraViewer, AnyDesk, ScreenConnect, Supremo and similar tools
- Startup items, services, scheduled tasks and browser extensions
- Added VPNs, proxies, profiles or security exclusions
- Email forwarding rules and active account sessions
- Changed recovery details and financial-account activity
Behaviour-based endpoint monitoring and application control provide stronger ongoing visibility than relying only on a one-off scan. ACSC crypter advisory
Apple, Microsoft 365 and AI
Apple released iOS and iPadOS 26.6.2 on 8 September for iPhone 11 and newer and supported iPads. Apple lists no published CVE entries, so treat it as a recommended maintenance update rather than an emergency zero-day response. Older iPhone XS/XR devices remain on the separate iOS 18 update branch. Apple security releases
No urgent tenant-wide Microsoft 365 change emerged this week. However, ChatGPT can now connect SharePoint, Dropbox and Box to its Library and work across selected files and folders.
That creates a useful documentation workflow, but existing file permissions become critical. Before enabling it for client or internal records:
- Review inherited SharePoint permissions and broad “everyone” access.
- Connect only the required business identity.
- Keep credentials and unredacted customer-sensitive information out of general documentation folders.
- Review ChatGPT shared-folder access and ownership: files uploaded to someone else’s shared folder remain with that folder’s owner if the uploader later loses access.
Lower-priority watch items
- Windows Server 2022 leaves mainstream support on 13 October 2026, but this is not the end of security updates: extended support continues until October 2031.
- The recurring false “Microsoft Defender is turned off” notification remains unresolved. Verify actual Defender status before installing another antivirus.
- New AI voice, image and research features are useful demonstrations, but do not require immediate client action.
- Wi-Fi 8 announcements are premature purchasing drivers; firmware support, coverage design and reliable wired backhaul remain more important for current clients.
Parting Shot!
“A clean antivirus scan isn’t the whole scam check”
When cleaning a computer after possible or confirmed access I take the following into account:
Modern malware can be disguised to evade a traditional scan. After someone has allowed a scammer remote access, the computer should also be checked for leftover remote-control tools, new user accounts, startup entries, browser extensions and compromised online sessions—not just given a quick antivirus scan.