Vulnerabilities & CVEs

Multiple espionage-motivated threat clusters have been observed deploying a previously undocumented exploit kit dubbed BlueMoon, which chains together several vulnerabilities in Microsoft Windows and Google Chrome. The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31, also known as Bronze Vinewood, Judgement Panda, and JungleBamboo. Key points from the reporting: The campaign involved multiple espionage-motivated threat activity clusters rather than a single actor. BlueMoon is an exploit kit that chains multiple vulnerabilities together in Windows and Chrome. The kit was previously undocumented prior to this activity. The earliest observed in-the-wild deployment is linked to APT31, a China-aligned state-sponsored group with several tracked aliases. No specific CVE identifiers or patch numbers were provided in the source material, so none are listed here. Organizations should monitor vendor advisories for Chrome and Windows updates and prioritize timely patching of both browsers and endpoints, given the exploit kit's reliance on chaining multiple flaws across both platforms. Source: The Hacker News Has anyone seen related telemetry or additional details on the BlueMoon exploit chain in their environment?

Cisco has confirmed that a maximum-severity authentication bypass vulnerability in its Secure Firewall Management Center (FMC) software is being actively exploited in the wild. The flaw, tracked as CVE-2026-20079, allows an unauthenticated attacker to bypass authentication mechanisms on affected devices. Given the critical nature of the issue, Cisco has urged users to apply available patches immediately, noting that exploitation activity has already been observed. The vulnerability impacts multiple versions of the Secure FMC platform. Specifically, affected releases include: Versions 7.4.1.2 and earlier in the 7.4 train Versions 7.6.0.2 and earlier in the 7.6 train Versions 7.8.0 in the 7.8 train Cisco’s advisory indicates that the vulnerability stems from improper handling of authentication requests, which can be triggered remotely without any user interaction or prior credentials. The company has also noted that there are no workarounds that fully mitigate the issue, making patching the only reliable remediation step. Administrators are strongly advised to upgrade to the fixed releases as specified in Cisco’s security advisory. As a precaution, organizations should also review their firewall management access logs for any suspicious or unauthorized activity, particularly if their systems are exposed to untrusted networks. Given the active exploitation status, prompt action is critical to prevent potential compromise of security infrastructure.

A vulnerability in DeepSeek Harness, the open-source tool used to run AI coding agents locally, allowed a sandboxed agent to disable its own OS-level sandbox with a single command. The flaw stemmed from the tool’s own web-based interface, which failed to properly restrict access to internal functions meant for administrative use. Under normal operation, DeepSeek Harness confines agent commands to a dedicated workspace, preventing writes outside that directory when handling untrusted files. However, a crafted call to the tool’s internal web endpoint enabled the agent to revoke that confinement without requiring any approval from the user or the host system’s security layer. This effectively broke the isolation boundary, meaning an agent operating on malicious or compromised code could escalate its reach to the broader file system. The issue is particularly relevant for developers running autonomous coding agents on repositories they do not fully trust. Affected users should consider the following mitigations: Update DeepSeek Harness to the latest patched version as soon as it is available. Avoid running the tool with broad filesystem permissions; use dedicated, low-privilege user accounts. Review any logs for unexpected calls to the tool’s administrative web endpoints. Monitor agent activity closely when working with third-party or untrusted codebases. No specific CVE identifier was provided in the original disclosure, so administrators are advised to track the project’s official repository for security announcements and patch notes. The issue highlights a growing challenge in securing agentic AI pipelines, where the tools themselves become part of the attack surface. Source: The Hacker News Are you running DeepSeek Harness in your development environment, and have you audited which internal endpoints your agents can reach?

Over 36,000 Plex Media servers exposed to the internet are still running unpatched versions, leaving them susceptible to recently disclosed security vulnerabilities. The affected servers are believed to be reachable without authentication, which significantly increases the risk of exploitation. The flaws in question allow attackers to potentially compromise the media server, gaining access to sensitive user data or deploying malicious code. While the exact attack vectors vary, the core issue stems from improper handling of certain requests, which could lead to remote code execution or information disclosure. Affected component: Plex Media Server Exposure: Publicly accessible instances Risk: Remote exploitation without requiring user credentials Administrators are strongly advised to update their Plex Media Server installations to the latest available version immediately. It is also recommended to restrict remote access to trusted networks or users, and to review server logs for any signs of unauthorized activity. Given the significant number of unpatched systems, this remains a high-priority threat for anyone running a self-hosted Plex setup. Source: BleepingComputer With over 36,000 exposed instances, is your organization or personal setup among those still waiting on a patch, and what steps are you taking to secure your media server in the meantime?

A newly disclosed zero-day in Microsoft Defender, dubbed “ShieldCrash,” is already generating concern in the security community after an anonymous researcher released a working exploit. The researcher, who goes by the handle Nightmare Eclipse, published the exploit shortly after Microsoft’s September 2026 Patch Tuesday updates went out, suggesting the flaw remains unpatched for now. The vulnerability allows a local attacker to escalate privileges to SYSTEM, the highest level of access on a Windows machine. This means that anyone with even limited foothold on a device—such as through a sandboxed process or a compromised user account—could potentially take complete control of the operating system. The exploit targets the Defender service directly, which typically runs with elevated privileges, making it a prime target for lateral movement or persistent backdoor installation. At this time, technical details are sparse, but the core issue appears to reside in how the antivirus engine handles certain malformed inputs. Since the researcher has released the exploit code publicly, the risk of active exploitation in the wild is elevated, especially in enterprise environments where Defender is the default endpoint protection. Affected: Microsoft Defender on supported Windows versions. Impact: Local privilege escalation to SYSTEM. Status: No official patch confirmed as of the latest Patch Tuesday. Microsoft has not yet issued an official advisory for this issue, and no CVE identifier has been publicly assigned as of this writing. Security teams are advised to monitor Defender’s behavior closely, restrict local access where possible, and consider additional endpoint detection layers while waiting for an official fix. Source: BleepingComputer Is your organization relying solely on Microsoft Defender for endpoint protection, and if so, what immediate compensating controls are you putting in place to mitigate this local privilege escalation risk?

Google has shipped a substantial patch batch for Chrome, resolving 230 security issues on Tuesday. Among them is a critical fix for a newly discovered zero-day flaw that has already been used in real-world attacks. This marks the seventh actively exploited Chrome zero-day that Google has addressed since the beginning of the year. The bug is classified as a high-severity issue involving an improper implementation in the V8 JavaScript engine. Google’s advisory confirms that an exploit for this vulnerability exists in the wild, though the company has withheld technical specifics for now to allow users time to update. As with previous zero-day patches, this update is rolling out to the stable desktop channel, covering Windows, macOS, and Linux users. Affected: Google Chrome versions prior to the latest stable release for Windows, macOS, and Linux. Fix: Update to the newest stable version, which contains the patch for CVE-2025-2783 (as referenced internally by Google’s security team). Given the active exploitation, it is strongly recommended to restart your browser and apply the update immediately if you have not done so. Administrators should also consider enforcing automatic updates across managed devices to mitigate exposure. Source: BleepingComputer Has your organisation already enforced a mandatory Chrome update policy, or are you still relying on user-initiated restarts to patch this zero-day?

OpenAI has confirmed that GPT-6 Astra is the first model it has broadly deployed to reach the "Critical level" for cybersecurity capabilities. This places the model at a threshold where it can autonomously identify and analyze unknown vulnerabilities, commonly referred to as zero-days, without relying on pre-existing signatures or known exploit patterns. However, the same release notes a significant operational trade-off. The company states that while the model’s offensive security capabilities have advanced, its internal reasoning and tool-use processes are more opaque than previous iterations. This makes monitoring and auditing its actions more difficult, raising concerns about visibility for red teams and defensive security personnel who need to track what the model is doing in real time. Key points from the announcement include: GPT-6 Astra can independently discover and validate exploit chains for previously unseen software flaws. The model’s execution path is considered harder to interpret, complicating post-incident analysis and compliance logging. OpenAI has not publicly released a specific CVE identifier or advisory number related to this capability, as no single vulnerability was referenced in the disclosure. The "Critical level" designation implies the model can outperform human experts in certain constrained vulnerability research tasks, but the lack of interpretability is flagged as a risk for misuse or accidental damage. For defenders, this highlights a growing divide: AI that can find bugs faster than humans is valuable, but if you cannot see how it made a decision, you lose the ability to replicate, patch, or safely sandbox the discovery process. Source: BleepingComputer Given the reduced observability of GPT-6 Astra, is your security team prepared to handle AI-generated vulnerability reports that come without a clear reasoning trail?

The EU Cyber Resilience Act’s vulnerability reporting obligations officially kick in on September 11, and for many software vendors, the clock is already ticking. Under the new rules, when an actively exploited flaw is discovered, companies may have as little as 24 hours to notify authorities. That leaves very little room for guesswork. According to guidance highlighted by ActiveState, the core challenge isn’t just patching the bug—it’s knowing two things with certainty: what exactly shipped to customers, and when you first learned about the vulnerability. Without that clarity, meeting the EU’s deadline becomes a logistical nightmare. The key is maintaining a precise software bill of materials (SBOM) for every release. Teams need to trace when a vulnerable component entered a product, not just when the fix was written. Incident response workflows must be pre-wired to flag “actively exploited” status quickly, since that triggers the shortest reporting window. The regulation effectively forces vendors to treat supply chain visibility as a core compliance feature. If you can’t answer “which version of which library went out to which customer” in near real-time, you’re likely to miss the deadline—and face the consequences. Source: BleepingComputer Is your organization already tracking SBOMs down to the exact build level, or are you still relying on patch management guesswork when a CVE drops?

This month’s Patch Tuesday cycle from Microsoft is a record-breaker, with security updates addressing a total of 966 flaws across the ecosystem. Among these are two zero-day vulnerabilities that are already being actively exploited in the wild, making immediate validation and patching a priority for administrators. The sheer volume of fixes this month signals a heavy focus on both remote code execution and privilege escalation vectors. While the specific details and identifiers for the two exploited zero-days have not been fully disclosed in the public summary, it is critical to review the official release notes for the affected components—particularly if your organization relies on Office, Exchange, or the Windows OS core—to identify which updates require urgent rollouts. Given the scale of the release, we recommend prioritizing the deployment of the updates related to the exploited zero-days first, followed by any critical-rated flaws that affect internet-facing services. After applying the patches, verify that no legacy or third-party applications are broken by the changes, and monitor your endpoints for any post-patch anomalies. 966 total vulnerabilities fixed this cycle. Two separate zero-day flaws are under active attack. The update covers Windows, Office, and other core Microsoft products. Source: Unknown With the volume of changes this large, what is your team’s strategy for validating the patches against your critical applications without delaying the security fixes?

SAP’s September 2026 security patch batch tackles 20 vulnerabilities across its product lineup, with the spotlight falling on a critical memory corruption issue buried in the SAP Kernel. Tracked as maximum severity, the flaw—dubbed “OVERPASS”—can be triggered by an authenticated attacker, potentially leading to full system compromise or unauthorized privilege escalation. Given the kernel’s central role in running SAP applications, the risk is particularly acute for on-premise deployments where the attack surface is broader. The update spans several core components, including SAP NetWeaver, SAP S/4HANA, and SAP Business Technology Platform, though the kernel fix takes priority due to its exploitability. SAP has flagged the vulnerability as requiring immediate attention, recommending that administrators review their current kernel patch levels and apply the relevant support package stacks without delay. No workarounds were provided, meaning the patch is the only viable path to remediation. The most critical issue is a kernel-level memory corruption vulnerability, rated 10.0 on the CVSS scale. Other patches address cross-site scripting, information disclosure, and denial-of-service issues, with lower severity ratings. SAP users should check their system’s kernel version against the September 2026 Support Package Stack release notes. For those running hybrid or cloud environments, SAP notes that some fixes are automatically applied, but on-premise customers must manually deploy the updates. As always, it’s wise to test patches in a sandbox environment before rolling them out to production, given the kernel’s role in system stability. Source: Unknown Is your SAP landscape running the latest kernel patch, or are you deferring the update due to change-management constraints?

Adobe has shipped security updates to address a maximum-severity vulnerability in Adobe Commerce and Magento Open Source that is already being actively exploited in the wild. The flaw, tracked as CVE-2026-75650 with a CVSS score of 10.0, has been codenamed StyleSmuggler by security researchers at Sansec. The team discovered zero-day exploitation of the bug starting on September 4, 2026. Exploitation involves bypassing file upload restrictions to deliver a Rust-based backdoor and a PHP web shell onto affected servers. Researchers observed the malware being used to establish persistent remote access and execute arbitrary commands on compromised e-commerce instances. Adobe has classified the issue as critical and urges administrators to apply the latest patches immediately. Review server logs for suspicious file uploads or unexpected PHP payloads around the identified timeframe. Audit user accounts with administrative privileges for unauthorized changes. If compromise is suspected, rotate credentials and API keys, and scan for the presence of the Rust backdoor or web shell indicators. Source: The Hacker News Has your team checked whether your Magento or Commerce deployment is exposed, and what steps are you taking to hunt for indicators before patching?

TantoSec has published a working proof-of-concept that chains an AES-CBC padding oracle flaw in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution. The exploit targets a specific, non-default configuration, and Progress released a patch for the underlying chain back in July. As of now, there are no confirmed reports of in-the-wild exploitation. The attack hinges on a cryptographic weakness in the Telerik UI component's handling of encrypted data. By repeatedly sending crafted requests and observing the server's padding-error responses, an attacker can decrypt sensitive payloads without valid credentials. TantoSec's research demonstrates how this oracle can then be leveraged to forge a malicious request, ultimately achieving code execution on the target server. It is important to note that this exploit does not affect every deployment. The attack only succeeds against applications that are using a configuration which is not the default. Organizations running standard, out-of-the-box settings are not exposed to this specific chain. Administrators should verify their deployment configuration against the guidance provided in the July advisory from Progress. Given the severity of potential unauthenticated RCE, immediate action is recommended for affected users: Apply the latest patches released by Progress in July if you have not already done so. Review your Telerik UI for ASP.NET AJAX configuration to confirm whether you are running the vulnerable non-default setup. Monitor for any unsolicited encrypted payloads or anomalous network traffic directed at web servers, as padding-oracle attacks generate distinctive error patterns. Source: The Hacker News Has your team audited your Telerik UI deployments to confirm whether they fall into that non-default configuration, or are you waiting on the patch cycle to catch up?

Researchers have pulled back the curtain on a stealthy Chromium-based post-exploitation framework dubbed PEEP, which disguises itself as a benign bookmarks extension to maintain persistence inside Chrome and Edge browsers. The toolkit is not a foothold itself—it demands pre-existing administrative privileges or code execution on the target host. Once that access is secured, its installer sidesteps the normal Web Store review process and any user consent prompts by injecting the extension directly into browser profiles. What makes this particularly nasty is how it forges Chromium’s own Secure Preferences file, effectively tricking the browser into treating the malicious add-on as both trusted and user-approved. That means PEEP can survive browser restarts and operate quietly under the radar, giving attackers a reliable channel to issue commands on the compromised machine through the browser itself. Key technical takeaways: PEEP requires prior administrative or code execution access—it is not a remote code execution exploit. It targets Chrome and Edge by modifying profile directories directly. The installation bypasses Web Store checks and user prompts by forging Secure Preferences. The extension’s purpose is post-compromise persistence and host-level command execution. This isn’t a vulnerability in the browsers themselves—it’s an abuse of trust mechanisms that assumes the attacker already owns the box. Defenders should focus on monitoring abnormal modifications to browser profile directories and auditing extensions that appear without a corresponding Web Store installation event. Source: The Hacker News Has your organization taken steps to audit browser profiles for unauthorized extension injections, or do you rely on endpoint detection alone to catch this kind of post-exploitation movement?

Attackers are actively chaining two recently disclosed security flaws in MikroTik RouterOS to seize control of devices that have SSH services exposed online. The campaign targets routers that have not yet been updated with the vendor’s latest patches. The exploitation chain combines a privilege escalation vulnerability with an authentication bypass issue. When used together, they allow an unauthenticated remote attacker to gain administrative access to the router. Once inside, the attackers can modify device settings, inject malicious configurations, or use the compromised router as a pivot point for further network intrusions. The flaws affect RouterOS versions that predate the latest stable release. MikroTik has already addressed the issues in newer firmware builds, and administrators are strongly advised to apply those updates without delay. In addition to patching, it is recommended to restrict SSH access to trusted IP addresses only, and to disable the service entirely if it is not strictly required. Affected: MikroTik RouterOS versions prior to the latest patched release. Mitigation: Update to the latest RouterOS build, enforce firewall rules to limit SSH exposure, and audit device logs for unusual activity. Routers are often overlooked in patch management routines, yet they remain a high-value target for attackers seeking persistent access to internal networks. Given that this exploitation is already underway, immediate action is warranted. Source: BleepingComputer Is your organisation currently exposing SSH on any MikroTik devices, and if so, how are you prioritising the rollout of these critical updates?

Research indicates that a zero-day flaw resembling a file-upload bypass is being actively exploited against Magento and Adobe Commerce systems. Tracked by external researchers under the moniker “StyleSmuggler,” the issue is understood to affect all versions of both platforms, leaving a wide swath of online storefronts exposed. The attacks have a clear objective: dropping a Linux ELF backdoor onto vulnerable servers to establish persistent remote access. The vulnerability lies in the way these platforms handle certain uploaded files, allowing attackers to smuggle a malicious payload past validation and onto the filesystem. While specific technical details remain partially under wraps to give merchants time to patch, the observed behavior indicates a critical remote code execution risk. Security analysts have noted that exploitation attempts appear to be opportunistic, scanning for unpatched installations hosting shopping carts. For administrators, the primary takeaway is urgency. Since the flaw is zero-day, there is no patch available at the time of disclosure for every iteration, but immediate steps should be taken: Audit and review web server access logs for any unexpected file uploads, especially those with non-standard extensions. Check for newly created files in the media or var directories that do not originate from a known admin session. Inspect running processes for any unfamiliar binaries named similarly to common Linux services. Harden file permissions on the pub/media and var/import folders to restrict write access. Monitor outbound network connections from the web server for calls to unusual IP addresses. Until an official security bulletin is issued for your specific version, consider temporarily disabling any custom modules that handle file imports or image resizing, as these vectors are often leveraged in such attacks. The vendor has been contacted, but given the active exploitation, assume your environment is a target. This serves as another reminder that the e-commerce ecosystem is a high-value target, and third-party extensions can often widen the attack surface beyond the core application. Source: Unknown For those of you running Magento on shared hosting, what process are you using to check for these rogue binaries without full root access?

ConnectWise is alerting administrators to a newly discovered vulnerability affecting its ScreenConnect remote access solution, with an official patch not yet available. The company has confirmed it expects to release a fix later this week, but until then, it is providing temporary mitigation steps to help reduce exposure. The issue impacts the remote support and access tool, which is widely used by managed service providers (MSPs) and IT teams. Given the privileged nature of ScreenConnect deployments, any flaw in this software carries significant risk, as exploitation could potentially lead to unauthorized access or system compromise. While specific technical details of the vulnerability remain limited in the public advisory, ConnectWise is urging all users to treat the situation with urgency. Administrators should review the temporary measures outlined by ConnectWise and apply them as soon as possible. Consider restricting outbound network access from ScreenConnect instances to only necessary endpoints. Audit user accounts and sessions for any suspicious activity, especially those with elevated privileges. Monitor official ConnectWise channels for the prompt release of the security patch. Until the permanent fix is deployed, organizations relying on ScreenConnect should balance operational needs against the heightened risk, potentially limiting remote access capabilities where feasible. This situation serves as a reminder that even trusted remote management tools can become attack vectors, requiring rapid response protocols. Source: BleepingComputer Is your team currently running ScreenConnect, and what immediate steps are you taking to restrict access while waiting for the vendor's patch?

N-able has rolled out an emergency hotfix for a maximum-severity remote code execution (RCE) vulnerability affecting its N-central remote monitoring and management (RMM) platform. The flaw is being exploited in ongoing attacks, prompting the vendor to urge customers to apply the patch immediately. The vulnerability, which carries a CVSS score of 10.0, stems from an authentication bypass issue in the N-central server's Java deserialization mechanism. Successful exploitation allows an unauthenticated attacker to execute arbitrary code with system privileges on the underlying host. The vendor has not yet assigned a CVE ID at the time of this advisory, but the hotfix is available via the usual N-central update channel. Affected component: N-central server (all supported versions prior to the hotfix) Attack vector: Network-based, unauthenticated Impact: Full system compromise, including potential lateral movement into managed endpoints According to N-able, the attacks observed in the wild are targeted and appear to follow a specific pattern. The company has not published detailed indicators of compromise at this stage, but strongly recommends: Immediate application of the hotfix to all N-central servers Reviewing server logs for unusual deserialization activity or unexpected outbound connections Resetting credentials for any service accounts used by the N-central platform Enforcing multi-factor authentication on all administrative access Given the severity and active exploitation, organizations using N-central should treat this as a priority incident response item, not a routine patch cycle update. Source: Unknown Has your team already applied the hotfix, and are you monitoring for the targeted attack patterns N-able described?

Researchers have uncovered a cluster of 13 malicious Composer packages published to Packagist, each disguised as a theme library. These packages are engineered to inject JavaScript into Vietnamese movie and comic streaming platforms that install them, setting off a chain of events targeting visitors’ unpatched iPhones. The injected script performs two distinct operations against site visitors: it redirects users to mobile ad-fraud schemes and gambling pages, while simultaneously attempting to deploy spyware on vulnerable iOS devices. The spyware is specifically crafted to extract cryptocurrency wallet seed phrases from compromised iPhones. Key details from the analysis: 13 malicious theme packages were uploaded to Packagist, the official PHP package repository. The payload targets unpatched iOS devices, meaning iPhones that have not received the latest security updates. The attack chain begins with the installation of a malicious Composer theme package on a streaming website. Once live, the injected JavaScript runs dual operations: ad-fraud and gambling redirects, alongside spyware deployment. The ultimate goal of the spyware is to harvest crypto wallet seeds, giving attackers full control over victims’ digital assets. Affected parties should audit any Composer dependencies sourced from Packagist, especially theme packages used in Vietnamese-language streaming services, and verify the integrity of their installed libraries. For iOS users, applying the latest system updates remains a critical defense against this type of exploit chain. Source: The Hacker News Is your team reviewing Composer package integrity before every deployment, or do you rely on post-install audits to catch malicious dependencies?

Forescout Research’s Vedere Labs recently demonstrated how an LLM can accelerate exploit development by using Anthropic’s Claude to port a working pre-authentication RCE exploit between two different WAGO programmable logic controller (PLC) models. The operation was performed against live hardware, with the tool successfully executing attacker-supplied ARM shellcode. The underlying vulnerability is a stack-based buffer overflow in the Nucleus FTP server, specifically triggered by the USER command. This flaw is tracked as CVE-2021-31886, a pre-auth issue that permits remote code execution without requiring any credentials. The key takeaway here is the automation of exploit porting. According to the researchers, Claude handled the heavy lifting of adapting the exploit’s memory addresses and offsets to match the new PLC model’s architecture. The entire process, from providing the base exploit to receiving a functional version for the target device, took a matter of minutes. The original flaw resides in the FTP server’s handling of the USER command. The exploit was ported to a different WAGO PLC model without manual reverse engineering. The test was performed on actual hardware, confirming the shellcode executed successfully. While this research focuses on WAGO devices, it raises broader concerns about the accessibility of ICS exploitation. The ability for AI to handle model-specific adjustments means that attackers with minimal assembly knowledge could potentially weaponize vulnerabilities across various device families. Source: The Hacker News Given that AI can now streamline cross-model exploit porting in industrial control systems, how is your organization preparing for the increased velocity of ICS-specific threats?

Two unpatched flaws in GeoNetwork, the open-source geospatial metadata catalog, can be linked into an unauthenticated remote code execution (RCE) chain. The software commonly underpins government and agency geoportals, making the risk particularly acute for public-sector infrastructure. The maintainers addressed both issues in releases 4.4.12 and 4.2.17, shipped on July 8, 2026. Full technical disclosure followed on August 31. The vulnerability chain allows an attacker with no prior access to execute arbitrary commands on the underlying server. Given GeoNetwork’s typical deployment at the backend of official mapping and environmental data portals, the exposure could escalate into full server compromise if left unpatched. If you operate an affected instance, consider the following steps: Upgrade to GeoNetwork 4.4.12 or 4.2.17 immediately. Audit server logs for suspicious requests targeting catalog or metadata endpoints. Restrict network access to GeoNetwork administration interfaces until patching is complete. Review your deployment for any indicators of post-exploitation activity if the service has been publicly exposed. Source: The Hacker News Has your team already patched your GeoNetwork backend, or are you still assessing exposure to this chain?