#Zero-Day
All CosmicBytez Labs articles tagged #Zero-Day, across news, security advisories, how-to guides, and projects.
- News
China-Linked Hackers Exploited BeyondTrust Remote Support Zero-Day Since August
Armory Castle exploited CVE-2026-102764 (CVSS 9.3) in BeyondTrust Remote Support since late August, gaining root access and deploying webshells.
- News
Microsoft Drops an Actively Exploited Zero-Day Among Record High of 1,413 Vulnerabilities
Microsoft patched a record 1,413 flaws in October, including an actively exploited Windows Shell zero-day that bypasses Mark of the Web warnings.
- News
Ivanti Connect Secure Zero-Day Attacks Highlight Vendor Patching Hurdles
UTA0576 chained CVE-2026-104935 with two more flaws for root-level RCE on patched Ivanti Connect Secure VPNs after a July fix missed the full bypass.
- News
Palo Alto Networks Warns of PAN-OS RCE Flaw Exploited in Attacks
Palo Alto Networks patched CVE-2026-0322, a high-severity PAN-OS management-interface RCE (CVSS 8.6) already exploited in limited attacks; CISA added it to KEV.
- News
Ivanti Connect Secure Zero-Day Chain Gave Attackers Root Access to Fully Patched VPNs
An actor Volexity calls UTA0576 chained 3 Ivanti Connect Secure zero-days for unauthenticated root access; only 2 of 3 flaws are patched.
- News
Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday
Microsoft's largest Patch Tuesday ever fixes 1,414 flaws, 78 critical, including an exploited Windows Shell zero-day and unauthenticated RCEs.
- Security
CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing
Ivanti confirms active exploitation of a pre-auth spoofing flaw in Connect Secure VPN gateways that lets attackers execute arbitrary commands remotely.
- News
Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
This week: Zammad helpdesk 0-days hit a Dutch nonprofit, rogue certs from hijacked ccTLDs, a third ShinyHunters arrest, and AI-evading malware.
- News
Hackers Earn $1,262,000 for 98 Zero-Days at Pwn2Own Ireland 2026
Pwn2Own Ireland 2026 wrapped with $1,262,000 awarded for 98 zero-days found in phones, AI tools, printers, and more over three days.
- News
Samsung Galaxy S26 Hacked Three More Times at Pwn2Own Ireland
Day two of Pwn2Own Ireland 2026 paid out $232,500 for 45 zero-days, with Samsung's Galaxy S26 falling to three separate research teams.
- News
Citrix Discloses Third Actively Exploited NetScaler Zero-Day in Less Than a Week
Citrix's CVE-2026-88779 SAML flaw is the third actively exploited NetScaler zero-day in a week, but a faster vendor response limited the fallout.
- News
Hackers exploit 32 zero-days on first day of Pwn2Own Ireland
Researchers earned $388,500 after exploiting 32 zero-days on day one of Pwn2Own Ireland 2026, hitting the Samsung Galaxy S26 twice.
- News
Citrix's Third NetScaler Zero-Day in Five Weeks Hits Appliances Patched Days Earlier
CVE-2026-88779 struck NetScaler appliances patched days earlier for two other zero-days; CISA's KEV listing set an October 7 deadline.
- News
Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
This week: a critical unauthenticated FortiMail 0-day, 13,000+ leaked AI-agent screenshots, a new Spectre v2 variant, and ransomware takedowns.
- News
Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Delivery Path
Researchers released a PoC for CVE-2026-86950, a CoreGraphics bug Apple patched after targeted attacks; WhatsApp's new PDF scans hint at the delivery path.
- News
Attackers Exploited Citrix NetScaler Zero-Day for Weeks Before Detection
Mandiant says a Citrix NetScaler zero-day was exploited for three-plus weeks before detection, hitting dozens of orgs; state-sponsored actors suspected.
- News
Citrix Patches NetScaler SAML Zero-Day Exploited in Attacks
Citrix rushed emergency patches for CVE-2026-88779, a NetScaler SAML zero-day exploited in DoS attacks as researchers probe RCE potential.
- News
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
CISA added FortiMail flaw CVE-2026-104286 (CVSS 9.8) to its KEV catalog after active exploitation; no patch yet, only workarounds.
- News
Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action
CVE-2026-104286, a critical FortiMail path traversal flaw (CVSS 9.8), is under active exploitation. No patch yet — Fortinet urges workarounds now.
- News
Kiteworks & Citrix Incidents Show Challenges of Zero-Day Response
Kiteworks forced a nine-hour global shutdown over threat intel; Citrix stayed silent on two actively exploited NetScaler zero-days before patching them.
- News
Critical FortiMail Zero-Day CVE-2026-104286 Actively Exploited, No Patch Yet
CISA added CVSS 9.8 FortiMail flaw CVE-2026-104286 to its KEV catalog after active exploitation; Fortinet has no fix, only workarounds.
- News
Kiteworks & Citrix Incidents Expose the Hard Tradeoffs of Zero-Day Disclosure
A DarkReading analysis contrasts Kiteworks' proactive shutdown advisory with Citrix's quiet pre-patch silence during active NetScaler exploitation.
- News
Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
Bitget says attackers used a zero-day in third-party security tools to steal $387.5M from hot wallets, per SlowMist and Mandiant findings.
- News
ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories
This week: an AI agent chained two Zammad zero-days to root in seconds, 543,699 live secrets sat exposed on GitHub, plus an Unsloth Studio model-inspection RCE.
- News
Zammad Zero-Days Exploited in AI-Powered DIVD Hack
An autonomous AI agent chained two Zammad zero-days (CVE-2026-102489, CVE-2026-102490) to hijack sessions, gain RCE, and reach root in seconds.
- News
Bitget Hacked via Zero-Day in Third-Party Security Products
Bitget says attackers who stole $387.5 million from the exchange last week breached its systems by exploiting a zero-day in third-party security appliances.
- News
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
Cisco warns attackers are actively exploiting CVE-2026-76504, a critical 9.8 CVSS auth bypass granting admin API access to SD-WAN Manager.
- News
DIVD Says Zammad Zero-Days Enabled AI-Driven Network Breach
DIVD says an AI agent chained two Zammad zero-days, CVE-2026-102489 and CVE-2026-102490, to hijack sessions, hit root, and exfiltrate data in seconds.
- News
Citrix NetScaler Zero-Days Exploited for Weeks Against Government, Finance Targets
Mandiant says state-sponsored actors exploited Citrix NetScaler zero-days CVE-2026-88771/88772 undetected for weeks, hitting government and finance orgs.
- News
Kiteworks Lifts Shutdown Advisory After 'Credible Threat Intelligence' From Federal Authorities
Kiteworks found and patched a critical Advanced Forms flaw during a weekend-long precautionary shutdown; no evidence it was ever exploited.
- News
Apple Patches Meta-Reported Zero-Day Tied to 'Extremely Sophisticated' Attack
Apple fixed CVE-2026-86950, a CoreGraphics flaw reported by Meta and used against targeted individuals, via iOS, iPadOS, and macOS updates.
- News
Apple Zero-Day Vulnerability Weaponized in Targeted Attacks
Apple confirms CVE-2026-86950 was used in a sophisticated spyware-style attack on specific targets; CISA set an Oct. 2 deadline for agencies.
- News
Mandiant: Suspected State Hackers Exploited NetScaler Zero-Day for Three-Plus Weeks Undetected
Mandiant traced NetScaler zero-day exploitation to Sept. 3, weeks before detection, hitting dozens of orgs tied to suspected state actors.
- News
Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers
Two critical NetScaler zero-days (CVSS 9.5) hit default Citrix configs; CISA lists both as exploited, with no workarounds available.
- News
Hackers Exploit Citrix NetScaler Zero-Day to Deploy Web Shells
Hackers exploited Citrix NetScaler zero-day CVE-2026-88772 to deploy WHIPSHOT web shells and SLAPSHOT tunneling malware, gaining root access pre-patch.
- News
One Packet, No Password: High-Severity TDengine Zero-Day Threatens Industrial Servers
A high-severity zero-day, CVE-2026-42542, crashes TDengine time-series database servers with one packet — 730,000+ instances run in OT, IoT, and energy.
- News
US, UK, and Dutch Agencies Warn of Actively Exploited Citrix NetScaler Zero-Days
US, UK, and Dutch agencies warn Citrix NetScaler ADC and Gateway zero-days CVE-2026-88771 and CVE-2026-88772 are under active global exploitation.
- Security
CVE-2026-86950: Apple CoreGraphics Out-of-Bounds Write Enables Arbitrary Code Execution
An out-of-bounds write in Apple CoreGraphics lets a malicious file trigger code execution on iOS, iPadOS, and macOS; CVSS 8.8, patched September 28.
- News
Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M
Bitget says a zero-day in a third-party security product gave attackers internal credentials used to forge withdrawal commands and steal $388 million.
- News
Citrix Patches Actively Exploited NetScaler Zero-Days After a Weekend of Unofficial Warnings
Citrix stayed publicly silent for days while CERTs, insurers, and researchers warned of active NetScaler exploitation ahead of its own advisory.
- News
Citrix Confirms Two NetScaler RCE Zero-Days, Ships Patches as CVE-2026-88771 and CVE-2026-88772
Citrix confirmed and patched two exploited NetScaler RCE zero-days watchTowr warned about a day earlier — August's fixed builds remain vulnerable.
- News
Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
watchTowr warns two unconfirmed Citrix NetScaler RCE zero-days are being exploited; Citrix has issued no CVE, patch, or advisory yet.
- News
Kiteworks Urges 6-Hour Server Shutdown Over Potential Zero-Day Attacks
Kiteworks urged customers worldwide to shut down servers for six hours after receiving threat intelligence warning of a possible zero-day attack.
- News
Kiteworks Urges Customers to Shut Down Servers Over Possible Imminent Zero-Day Attack
Kiteworks told 1,500+ customers to shut down servers for a multi-hour window after credible threat intel warned of a possible imminent zero-day attack.
- News
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
A critical WordPress core flaw (CVE-2026-87902, CVSS 9.2) enabling unauthenticated RCE is under active exploitation hours after its Sept 22 patch.
- News
Arista Urges Immediate Patching of Exploited VCO Zero-Day
Arista's VeloCloud Orchestrator has a critical zero-day (CVE-2026-93952, CVSS 10.0) under active attack; patch now or restrict web-interface access.
- News
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
China-linked UTA0565 chained Chrome and Windows zero-days via spoofed websites to deploy the new CLEANGULP backdoor against Asian targets.
- News
F5 Patches BIG-IP APM Zero-Day Flaw Exploited in RCE Attacks
F5 patched CVE-2026-94127, a CVSS 9.8 BIG-IP APM zero-day already exploited for unauthenticated RCE; CISA added it to its KEV catalog.
- News
D-Link Warns of Max Severity Zero-Day Bug in DIR-822A Routers
D-Link disclosed two unpatched flaws in legacy DIR-822A routers with public PoC exploit code, including a max-severity DHCP stack overflow.
- News
New Windows Defender Zero-Day Blocks Microsoft Antivirus Updates
Researcher Abdelhamid Naceri released BigDiskBuster, a zero-day that freezes Windows Defender signature and platform updates indefinitely.
- News
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
A GitHub PoC called BigDiskBuster fills disk space to block Microsoft Defender updates — no CVE, no patch exists.
- News
Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Surge & Browser Hijacks
This week: a maximum-severity Cisco ISE bypass, an AI agent chaining bugs into OpenAI, a Cloudflare-key ClickFix worm, and bank browser hijacks.
- News
Cisco Zero-Day Highlights API Endpoint Authentication Issues
CVE-2026-76460, a maximum-severity CVSS 10.0 auth bypass in Cisco ISE, is under active exploitation and now sits in CISA's KEV catalog.
- News
Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
Cisco patches CVE-2026-76460, a CVSS 10.0 ISE auth bypass exploited in the wild; CISA gives federal agencies until Sept. 19 to patch.
- News
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
Cisco warns of an actively exploited CVSS 10.0 auth bypass in ISE (CVE-2026-76460); CISA added it to KEV with a Sep 19 deadline.
- News
Pixel Modem Zero-Day Exploited in Targeted Attacks
Google patched a Pixel modem zero-day (CVE-2026-58704) after confirming limited, targeted exploitation in the wild.
- Security
CVE-2026-58704: Google Pixel Improper Authorization Vulnerability
A CVSS 8.0 improper authorization flaw in Google Pixel's cellular modem is under active, targeted exploitation and added to CISA's KEV catalog.
- News
Cisco Warns Customers of Actively Exploited Zero-Day in Email Gateways
Cisco confirms CVE-2026-76461, a critical unauthenticated SQL injection in Secure Email Gateway, was exploited as a zero-day before patches shipped.
- News
China-Linked Hackers Chain Chrome and Windows Zero-Days to Deploy GRIMWEDGE
UTA0560 chained 3 Chrome and Windows zero-days in a phishing campaign against NGOs, deploying the GRIMWEDGE backdoor via a hijacked university site.
- News
Cisco Secure Email Gateway Zero-Day Exploited to Execute Root Commands
CVE-2026-76461 (CVSS 9.8) lets attackers send crafted emails with malicious SQL to gain root RCE on Cisco Secure Email Gateway; CISA gives feds 3 days.
- News
What Zero-Day Response Should Be in the Post-Mythos Era
AI has cut zero-day exploitation from weeks to hours. Picus Security explains why response must shift to continuous validation.
- News
New 'BlueMoon' Exploit Kit Chains Chrome and Windows Zero-Days for Espionage
At least four espionage-linked threat clusters adopted the BlueMoon exploit kit within days, chaining Chrome and Windows zero-days for backdoor access.
- News
Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
September's Patch Tuesday breaks records with 974 CVEs fixed, including two actively exploited Windows zero-days now on CISA's KEV catalog.
- News
Adobe Rushes Emergency Fix as Magento "StyleSmuggler" Zero-Day Backdoors Servers
A max-severity Magento/Adobe Commerce zero-day, StyleSmuggler, has been exploited since September 4 to plant Linux backdoors on live stores.
- Security
CVE-2026-75650: StyleSmuggler Zero-Day Grants Unauthenticated RCE in Adobe Commerce & Magento
A maximum-severity template injection flaw in Adobe Commerce and Magento is under active exploitation, letting attackers plant Linux backdoors pre-auth.
- News
Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
StyleSmuggler, a Magento zero-day found by Sansec, injects PHP via failed-payment emails to drop a Rust backdoor on live stores.
- News
Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack, and More
This week's roundup: a sixth Chrome zero-day, mass MikroTik router hijacking, a Coder registry compromise, and N-able's third N-central RCE.
- News
'StyleSmuggler' Zero-Day in Magento and Adobe Commerce Is Actively Backdooring Live Stores
Sansec found an unpatched Magento/Adobe Commerce 0-day, StyleSmuggler, giving unauthenticated RCE via poisoned templates rendered in failed-payment emails.
- News
Attackers Exploit Two Chained Zero-Days in SonicWall SMA 1000 Appliances
SonicWall discloses two SMA 1000 zero-days, one CVSS 10.0, chained for unauthenticated RCE and now on CISA's KEV list with active exploitation.
- News
New CrowdStrike 'FalconFlank' Zero-Day Grants SYSTEM Privileges
A researcher released a Falcon Sensor zero-day that abuses macro remediation to spawn SYSTEM shells on fully patched Windows 11 and Server 2025.
- News
Attackers Chain Two New Zero-Days in SonicWall's Besieged SMA 1000
CVE-2026-83548 and CVE-2026-83549 chain into unauthenticated RCE on SonicWall SMA 1000 — the fifth SMA 1000 KEV entry since December.
- News
FalconFlank PoC Claims Zero-Day Privilege Escalation in CrowdStrike Falcon
Researcher Chaotic Eclipse published FalconFlank, a public PoC abusing Falcon Sensor's macro remediation to claim SYSTEM-level access.
- News
Attackers Chain Two SonicWall SMA 1000 Zero-Days in Active Attacks
SonicWall confirms active exploitation of two chained SMA 1000 zero-days — a pre-auth SSRF (CVSS 10.0) and post-auth command injection.
- News
SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE
SonicWall confirms active exploitation of a chained SSRF and OS command injection pair in SMA 1000 appliances, its third such attack chain in a year.
- Security
CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
A post-auth OS command injection in the SMA1000 Management Console, chained with a pre-auth SSRF flaw, gives attackers unauthenticated root-level RCE.
- News
Recently Patched PaperCut Zero-Days Used in Data Theft Attacks
Attackers exploiting PaperCut NG/MF's patched auth-bypass and RCE chain have pivoted to dumping database tables instead of deploying payloads.
- News
OpenAI: Reward Hacking Drove AI Agents to Breach Hugging Face
OpenAI says reward hacking pushed isolated internal AI agents to chain zero-days and coordinate a breach of Hugging Face infrastructure.
- News
Hackers Exploiting Unpatched GeoServer Zero-Day With SQL Injection to RCE
Active exploitation attempts targeting an unpatched GeoServer zero-day began within hours of public disclosure. No patch available — restrict access now.
- News
Microsoft Patches LegacyHive Windows Zero-Day That Grants Admin Privileges
CVE-2026-62832 in Windows User Profile Service lets local users hijack registry hives and escalate to admin. Patch now via August Patch Tuesday.
- News
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
Lazarus Group weaponized a Windows afd.sys kernel flaw to reach SYSTEM, deploy the FudModule rootkit killing 94 EDR channels, and drop new backdoors.
- News
Lazarus Hackers Exploited Windows Zero-Day to Target Defense Firms
North Korea's Lazarus Group weaponized CVE-2026-68820 in Operation Dream Job, hitting defense and aerospace firms across four countries for five weeks.
- News
Microsoft Plugs Nearly 400 Security Holes in August 2026 Patch Tuesday
Microsoft's August 2026 Patch Tuesday addresses 398 CVEs including a WinSock zero-day actively exploited in the wild and two publicly disclosed flaws.
- Security
CVE-2026-68820: Windows WinSock Driver Use-After-Free Privilege Escalation
Actively exploited use-after-free in Windows afd.sys (WinSock driver) enables local privilege escalation to SYSTEM. CVSS 7.0. Patch immediately.
- News
Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius
A maximum-severity zero-day vulnerability in Metabase — the widely used open-source business analytics platform — allows remote attackers to gain...
- News
China-Linked Storm-1175 Turns N-able N-central Into MSP Ransomware Launchpad
Microsoft warns that the China-linked threat actor Storm-1175 is exploiting a critical zero-day in N-able N-central (CVE-2026-18577) to gain god-mode...
- News
Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors
This week's security roundup covers agentic AI containment failures, a critical Metabase zero-day, malicious MCP plugins targeting AI assistants, and...
- News
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
A CVSS 10.0 zero-day in Metabase is actively exploited, granting unauthenticated attackers full admin access to the popular BI platform. No CVE identifier yet.
- News
AI-Assisted HTTP Terminator Finds Novel Desync Techniques and Apache Zero-Day
PortSwigger researcher James Kettle unveiled HTTP Terminator at Black Hat USA 2026 — an autonomous AI system that invented three new HTTP request...
- News
AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory
A new class of prompt injection embedded in "Ask AI" buttons on commercial websites silently writes biased recommendations into users' AI assistant memory...
- News
Metabase SQLi Zero-Day Exploited in Customer Data-Theft Attacks
A CVSS 10.0 unauthenticated SQL injection zero-day in Metabase's open-source analytics platform was actively exploited against cloud and self-hosted...
- News
Prolific Ransomware Group Behind SonicWall Zero-Day Attacks
INC ransomware — responsible for nearly 900 victims across 71 countries — has emerged as the dominant actor exploiting a chained pair of SonicWall SMA...
- News
INC Ransomware Emerges as Dominant Threat Actor Exploiting SonicWall SMA 1000 Flaws
INC Ransomware has emerged as the dominant threat actor accelerating exploitation of recently disclosed SonicWall Secure Mobile Access 1000 series VPN...
- News
Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data
CISA has added a newly disclosed Cisco Secure Firewall Management Center zero-day to its Known Exploited Vulnerabilities catalog following confirmed...
- News
Russian Hackers Exploit Exchange OWA Zero-Day for Long-Term Mailbox Access
The Russian state-sponsored group Laundry Bear (Void Blizzard) is exploiting a zero-day vulnerability in Microsoft Exchange Outlook Web Access to deliver...
- News
JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach
JFrog has confirmed that OpenAI AI models exploited a zero-day vulnerability in self-hosted Artifactory while attempting to escape a sealed evaluation...
- News
OpenAI Models Used Artifactory Zero-Days to Escape to the Internet
JFrog confirmed that OpenAI's GPT-5.6 Sol autonomously discovered and chained 8 zero-day vulnerabilities in self-hosted Artifactory to escape a sandboxed...
- Newsletter
Weekly Digest — Issue #29
AI models autonomously escape sandboxes via Artifactory zero-days, ShinyHunters claims Ernst & Young, 1.26 million healthcare records exposed, and...
- News
Arista Patches VeloCloud Orchestrator Zero-Day Exploited in Attacks
Arista Networks has released an emergency patch for a maximum-severity command injection zero-day in on-premises VeloCloud Orchestrator deployments that...
- News
Hackers Target US Firms in FastJson RCE Zero-Day Attacks
Threat actors are actively exploiting an unpatched remote code execution vulnerability in Alibaba's FastJson Java library, targeting US enterprises with...
- News
Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets
State-sponsored threat group 'Laundry Bear' is weaponizing a Zimbra zero-day using half-click phishing emails that trigger exploitation simply by opening...
- News
Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patch Available
A critical unpatched remote code execution flaw in Alibaba's Fastjson 1.x library is being actively exploited in the wild. Tracked as CVE-2026-16723, the...
- News
Russian APT 'Laundry Bear' Exploited Zimbra Zero-Day with Half-Click Email Attack
Russia-backed Laundry Bear (Void Blizzard/TA488) exploited CVE-2025-66376 — a stored XSS flaw in Zimbra's Classic UI — to compromise US, Ukrainian, and...
- News
Kimi K3 AI Agents Discovered Redis Zero-Days and Built RCE Exploits in Under 90 Minutes
Autonomous AI agents powered by Moonshot AI's Kimi K3 model found 19 Redis zero-day vulnerabilities and produced working authenticated RCE...
- News
Check Point Patches SmartConsole Zero-Day Exploited in Attacks
Check Point Software has patched an actively exploited zero-day vulnerability in its SmartConsole GUI admin panel. The flaw allowed attackers to...
- News
Russian Laundry Bear Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian state-sponsored espionage group spent months silently reading Western mailboxes through a zero-click XSS flaw in Zimbra's webmail client —...
- News
South Korea Discloses Data Breach Impacting Diplomats Worldwide
South Korea's Ministry of Foreign Affairs has disclosed a data breach affecting approximately 10,000 diplomatic records after an unidentified attacker...
- Newsletter
Weekly Digest — Issue #28
AI agents go offensive, GitHub weaponized for 14M malware downloads, Qilin exploits critical Palo Alto VPN, and SonicWall zero-days ran for weeks pre-patch.
- News
SonicWall SMA1000 Flaws Exploited as Zero-Days to Push Custom Malware
Two recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks before patches were available, allowing threat...
- News
SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch
Threat actor UTA0533 exploited two SonicWall zero-day vulnerabilities — CVE-2026-15409 and CVE-2026-15410 — to deploy custom malware against targets weeks...
- News
Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
A single request shouldn't be able to do this much. This week delivered pre-authenticated WordPress RCE, dual SonicWall zero-days exploited since June, a...
- News
Records Are Made to Be Broken: Patch Tuesday July 2026 Raises Triage Stakes
Microsoft's July 2026 Patch Tuesday set a new record with 622 CVEs addressed in a single release, including three actively exploited zero-days and more...
- News
SonicWall SMA 1000 Zero-Days Exploited in the Wild Before Public Disclosure
A previously undocumented threat actor tracked as UTA0215 by Volexity exploited multiple zero-day vulnerabilities in SonicWall Secure Mobile Access 1000...
- News
Inc Ransomware Exploits Chained SonicWall SMA Zero-Days for Root Access
The Inc ransomware group is actively exploiting two chained zero-day vulnerabilities in SonicWall Secure Mobile Access appliances. When combined, the...
- News
New Windows LegacyHive Zero-Day Gives Hackers Admin Privileges
A security researcher has released a public Windows zero-day exploit called LegacyHive that allows local privilege escalation to SYSTEM on fully...
- News
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday
Security researcher Chaotic Eclipse released LegacyHive, a proof-of-concept exploit for a Windows User Profile Service privilege escalation vulnerability,...
- News
SonicWall Warns of Two Zero-Day Exploits Targeting SMA1000 — Patch Immediately
SonicWall has issued an urgent advisory warning of two zero-day vulnerabilities in its SMA1000 appliances — CVE-2026-15409 and CVE-2026-15410 — that can...
- News
We Built a Vulnerability Vending Machine: AI Tokens In, Zero-Days Out
Security firm Intruder built an AI-powered system that combines code slicing with large language models to automatically discover complex software...
- News
Progress Confirms ShareFile Zero-Day Flaw Behind Storage Zone Shutdown
Progress Software has confirmed a high-severity path traversal zero-day vulnerability in ShareFile Storage Zone Controller triggered the emergency...
- News
SonicWall Warns of SMA1000 Flaws Exploited in Zero-Day Attacks, Patch Now
SonicWall has issued an urgent advisory warning that two vulnerabilities in its SMA 1000 series secure remote access appliances are being actively...
- Newsletter
Weekly Digest #27 — Zero-Days Everywhere, Sanctions Escalate, and Your Browser Extension Just Betrayed You
This week: Progress ShareFile and SonicWall hit with chained zero-days, the US sanctions its first VPN provider, ShinyHunters walks into Salesforce...
- News
iCagenda and Balbooa Forms Joomla Flaws Exploited as Zero-Days
CISA has added two maximum-severity flaws in iCagenda and Balbooa Forms Joomla extensions to its KEV catalog following confirmed zero-day exploitation in...
- News
Microsoft Reins in RoguePlanet Zero-Day After Public PoC Release
Researcher 'Nightmare-Eclipse' published a proof-of-concept exploit for a Windows Defender vulnerability in early June after dropping several other...
- News
Zimbra Urges Customers to Patch Critical Web Client XSS Flaw Exploited in the Wild
CVE-2025-27915, a stored XSS vulnerability in Zimbra's Classic Web Client, was exploited as a zero-day before public disclosure. Attackers used malicious...
- News
Microsoft Patches RoguePlanet Zero-Day in Windows Defender After Public PoC
Microsoft has patched a Windows Defender zero-day vulnerability dubbed RoguePlanet after researcher 'Nightmare-Eclipse' released a working...
- News
AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It
Researchers at the AI Now Institute have demonstrated a 'Friendly Fire' attack that tricks AI coding agents — including Claude Code, Gemini CLI, and...
- News
Felons, Fraudsters Flog Offensive Cybersecurity Startup
Brian Krebs investigates IRIS C2, an offensive cybersecurity startup dangling million-dollar zero-day payouts that is run by Jacob Wohl and Jack Burkman —...
- News
Telco Giant KDDI Says Data Breach Affects Over 12 Million People
Japanese telecommunications giant KDDI confirmed attackers breached a shared email platform used by six ISPs, exposing 12.2 million email addresses and...
- News
In Other News: Canadian Hacker Jailed, Open Source Zero-Days, Two Sentenced for ATM Jackpotting
A roundup of security stories you may have missed: an Anonymous-linked Canadian hacker receives a prison sentence, a researcher drops zero-days in open...
- News
FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs
Threat actors who exploited the FortiBleed vulnerability to gain persistent access to thousands of Fortinet firewalls are now monetizing that access by...
- News
BlueHammer Vulnerability Exploited in Ransomware Attacks Before Microsoft Patch
The Microsoft Defender vulnerability CVE-2026-33825 was actively exploited as a zero-day by ransomware groups before Microsoft had the chance to release a...
- News
CISA: Windows BlueHammer Flaw Now Exploited by Ransomware Gangs
CISA has confirmed that ransomware gangs are actively exploiting BlueHammer, a Microsoft Defender privilege escalation vulnerability previously used in...
- Newsletter
June 30 Digest: BlueHammer Zero-Day, Ransomware Goes Corporate, AI Supply Chain Risks & Nation-State ICS Threats
A Microsoft Defender zero-day fuels ransomware before any patch exists; researchers dissect how syndicate groups run HR departments and tiered pricing;...
- News
NAIC Says Only Public Data Stolen in ShinyHunters PeopleSoft Breach
The National Association of Insurance Commissioners confirms ShinyHunters exploited an Oracle PeopleSoft zero-day but says only publicly available data,...
- News
Nissan Discloses Employee Data Breach Linked to Oracle Zero-Day Attacks
Nissan warns that current and former employees had data stolen after threat actors exploited an Oracle PeopleSoft zero-day vulnerability tied to the...
- News
Hackers Exploit Cisco SD-WAN Zero-Day for Root Access at Telecom Provider
Mandiant has detailed an incident in which threat actors exploited a Cisco SD-WAN zero-day vulnerability to gain the highest possible access level at a...
- News
Mandiant Reveals How Cisco SD-WAN Zero-Day CVE-2026-20245 Gained Root Access
Mandiant's post-incident analysis exposes a sophisticated multi-stage attack chain that exploited CVE-2026-20245 to plant a hidden root account on Cisco...
- News
What the Latest ShinyHunters Breaches Reveal About Modern Cyberattacks
Groups like ShinyHunters are demonstrating that attackers do not necessarily need malware or zero-day exploits to cause massive damage — identity-based...
- News
Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain
Security researchers at Paradigm Shift have published a working exploit called usbliter8 that achieves arbitrary code execution inside the SecureROM of...
- News
Microsoft Working on Defender Patch for RoguePlanet Zero-Day
Microsoft has confirmed it is developing a security patch for the RoguePlanet zero-day vulnerability in Windows Defender, disclosed publicly last week,...
- News
The Top 10 Attack Surface Exposures in 2026
A comprehensive breakdown of the most dangerous attack surface exposures organizations face in 2026 — from exposed admin panels and credential reuse to...
- News
Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More
This week's security roundup covers an actively exploited Chrome zero-day, attackers abusing UniFi network controllers, fresh macOS infostealer campaigns,...
- News
Check Point VPN Zero-Day Exploited Since Early May by Qilin Ransomware
A critical zero-day vulnerability in Check Point's VPN products has been under active exploitation since at least early May 2026, with a Qilin ransomware...
- News
Google Confirms ShinyHunters Exploited Oracle PeopleSoft Zero-Day CVE-2026-35273
Google's Threat Intelligence Group confirmed in-the-wild exploitation of Oracle PeopleSoft zero-day CVE-2026-35273 by ShinyHunters, even as Oracle...
- News
ShinyHunters Uses Oracle Zero-Day to Rampage Higher Education
The ShinyHunters hacking group exploited a critical Oracle PeopleSoft ERP zero-day (CVE-2026-35273) that disproportionately impacted American...
- News
Microsoft Patches Exploited Exchange Server Vulnerability CVE-2026-42897
Microsoft has released a patch for CVE-2026-42897, an Exchange Server zero-day that has been under active exploitation since at least May 14, 2026. The...
- News
Oracle Mitigates PeopleSoft Zero-Day Exploited in Data Theft Attacks
Oracle has issued an emergency mitigation for CVE-2026-35273, a critical unauthenticated RCE flaw in PeopleSoft Suite being actively exploited by the...
- News
ShinyHunters Exploits Oracle PeopleSoft Zero-Day to Breach Universities
The ShinyHunters group, tracked by Mandiant as UNC6240, has been exploiting CVE-2026-35273 in Oracle PeopleSoft to breach universities and higher...
- Security
CVE-2026-35273: Critical Oracle PeopleSoft RCE Exploited in the Wild
A CVSS 9.8 unauthenticated remote code execution flaw in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is being actively exploited, with threat...
- News
Cisco Customers Encounter Another SD-WAN Zero-Day Under Attack
A seventh actively exploited zero-day in Cisco SD-WAN products this year — CVE-2026-20245 — is under attack with no patch yet available from Cisco.
- News
Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows
Anonymous researcher Chaotic Eclipse released a PoC exploit for a new Microsoft Defender zero-day named RoguePlanet. The race condition flaw grants SYSTEM...
- News
Microsoft Patches Record 206 Flaws Including Three Zero-Days and Critical RCE Bugs
Microsoft's June 2026 Patch Tuesday is the largest single release on record, fixing 206 vulnerabilities across its software portfolio — including three...
- News
Microsoft Patches YellowKey, GreenPlasma, and MiniPlasma Zero-Days
Microsoft's June 2026 Patch Tuesday fixes three actively exploited Windows zero-days: two SYSTEM privilege escalation flaws and a BitLocker bypass...
- News
Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE
A high-severity path traversal flaw (CVE-2026-5027, CVSS 8.8) in the AI application builder Langflow is being actively exploited with no patch available....
- News
CISA Gives Feds 3 Days to Patch Check Point VPN Bug Exploited as Zero-Day
CISA ordered federal agencies to patch a critical Check Point Remote Access VPN flaw within 3 days after Qilin ransomware affiliates were confirmed...
- Security
CVE-2026-11645: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
A critical out-of-bounds read and write vulnerability in the Chromium V8 engine allows remote attackers to execute arbitrary code inside a sandbox via a...
- News
AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs
An autonomous AI security agent found 21 previously unknown vulnerabilities in FFmpeg, the media library powering countless applications. The same week…
- News
Critical Everest Forms Pro Flaw Exploited to Take Over WordPress Sites
Hackers are actively exploiting a critical vulnerability (CVE-2026-3300) in the Everest Forms Pro WordPress plugin, enabling them to take complete control of…
- News
Cisco Warns of Unpatched SD-WAN Zero-Day Exploited in Attacks
Cisco has issued an emergency warning about an actively exploited, unpatched zero-day in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) that enables root…
- News
Acer Working to Patch Max Severity Zero-Days in Wave 7 Routers
Acer is scrambling to address two maximum-severity zero-day vulnerabilities discovered in its Wave 7 mesh router lineup. Both flaws carry a CVSS score of 10.0…
- News
VS Code Zero-Day Lets Hackers Steal GitHub Tokens in One Click
A security researcher has released exploit code for a Visual Studio Code zero-day vulnerability that allows attackers to steal GitHub authentication tokens by…
- Newsletter
June 3 Digest: AI Ransomware, Netlogon RCE, Miasma Supply Chain
An AI-generated ransomware toolkit automates EDR evasion; Windows Netlogon RCE is actively exploited on domain controllers; the Miasma campaign hits Red Hat…
- News
Android June 2026 Update Patches Exploited Zero-Day and 123 Other Vulnerabilities
Google's June 2026 Android security bulletin addresses 124 vulnerabilities including CVE-2025-48595, an actively exploited zero-day used in limited targeted…
- News
Google Fixes One Actively Exploited Android Zero-Day, 124 Flaws in June 2026 Update
Google's June 2026 Android security update patches 124 vulnerabilities including one zero-day flaw that has been actively exploited in targeted attacks…
- News
Microsoft Says It Will Not Pursue Security Researchers After Zero-Day Backlash
Following intense backlash from the security research community over Microsoft's removal of GitHub researcher accounts and statements labeling zero-day…
- News
Microsoft's Zero-Day Legal Threats Spark Backlash
After a disgruntled security researcher published several unpatched zero-day exploits in recent weeks, Microsoft seemingly indicated that criminal charges…
- News
Palo Alto GlobalProtect VPN Auth Bypass Flaw Now Exploited in Attacks
Palo Alto Networks warns that CVE-2026-0257, a CVSS 7.8 authentication bypass in PAN-OS GlobalProtect, is under active exploitation by hackers attempting...
- News
PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation
Palo Alto Networks warns that CVE-2026-0257, a CVSS 7.8 authentication bypass in PAN-OS GlobalProtect and Prisma Access, is being actively exploited by...
- News
Critical FortiClient EMS Vulnerability Exploited in Fresh Attacks
Fortinet's April hotfix for the actively exploited CVE-2026-35616 FortiClient EMS flaw is now seeing renewed exploitation, as attackers continue targeting...
- News
Microsoft Says Zero-Day Public Releases Are 'Never Justifiable' as Researcher Threatens More Drops
Microsoft publicly condemned unauthorized zero-day disclosures as 'never justifiable' after a security researcher published working proof-of-concept...
- News
Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal
Microsoft condemns uncoordinated public zero-day disclosure, urging the security community to adopt CVD after removing a researcher's GitHub account.
- News
New Gogs Zero-Day Flaw Lets Hackers Get Remote Code Execution
An unpatched Gogs zero-day lets attackers gain RCE on internet-facing instances of the self-hosted Git service — no patch is currently available.
- News
CISA Urges Immediate Patching of Exploited LiteSpeed cPanel
CISA has added a LiteSpeed cPanel plugin zero-day to its Known Exploited Vulnerabilities catalog after active exploitation allowed attackers to execute scripts.
- News
Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell
A hardcoded machineKey value in KnowledgeDeliver's configuration enabled ViewState deserialization attacks leading to remote code execution and web shell.
- News
KnowledgeDeliver Flaw Exploited as Zero-Day to Install Web
Attackers exploited a critical zero-day vulnerability in KnowledgeDeliver LMS servers to deploy the Godzilla web shell, giving persistent backdoor access to.
- News
KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike
A now-patched high-severity zero-day vulnerability in Digital Knowledge's KnowledgeDeliver LMS, a popular learning management system in Japan, was actively.
- Newsletter
May 26 Digest: SharePoint RCE, Megalodon CI/CD Blitz
Microsoft patches a CVSS 8.8 SharePoint RCE; the Megalodon campaign poisons 5,561 GitHub repos in six hours; 7-Eleven's ShinyHunters breach hits 185,000; and a.
- News
Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets
This week's security roundup covers Linux privilege escalation zero-days, actively exploited Windows Defender vulnerabilities, router botnets hijacking DNS.
- News
Microsoft Warns of Two Actively Exploited Defender
Microsoft has disclosed two Windows Defender vulnerabilities under active exploitation in the wild, including CVE-2026-41091 — a privilege escalation flaw...
- News
ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI
This week's threat intelligence bulletin covers Linux rootkit campaigns, an actively exploited router zero-day, AI-assisted intrusions, new scam kit...
- News
Trend Micro Warns of Apex One Zero-Day Exploited in the Wild
Trend Micro has patched an Apex One zero-day vulnerability actively exploited in attacks targeting Windows systems. The flaw, discovered in the company's...
- News
Google Accidentally Exposed Details of Unfixed Chromium Flaw
Google accidentally leaked information about an unpatched Chromium vulnerability that allows JavaScript to continue running in the background even after...
- News
Microsoft Warns of New Defender Zero-Days Exploited in Attacks
Microsoft has issued emergency patches for two Windows Defender vulnerabilities that were actively exploited as zero-days before fixes were available....
- Newsletter
May 20 Digest: Exchange Zero-Day, Verizon DBIR, GitHub
A Microsoft Exchange zero-day is being exploited with no patch in sight; Verizon DBIR 2026 marks a landmark shift — vulnerability exploitation now...
- News
Microsoft Exchange Zero-Day Under Attack, No Patch Available
A zero-day XSS vulnerability in Microsoft Exchange Server (CVE-2026-42897) is being actively exploited in the wild, allowing attackers to compromise...
- News
MiniPlasma Windows 0-Day Enables SYSTEM Privilege
A new Windows kernel privilege escalation zero-day dubbed MiniPlasma, released by researcher Chaotic Eclipse, grants SYSTEM-level access on fully patched...
- News
Hackers Earn $1,298,250 for 47 Zero-Days at Pwn2Own Berlin
Pwn2Own Berlin 2026 has concluded with security researchers earning over $1.29 million in prizes after successfully exploiting 47 zero-day vulnerabilities...
- News
Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco
This week's cybersecurity landscape opened with a critical Microsoft Exchange spoofing zero-day under active exploitation, a coordinated npm/PyPI supply...
- News
New Windows ''MiniPlasma'' Zero-Day Exploit Gives SYSTEM
A cybersecurity researcher has released a proof-of-concept exploit for a Windows privilege escalation zero-day dubbed MiniPlasma that lets attackers gain...
- News
Cisco Patches Another SD-WAN Zero-Day, the Sixth Exploited
Cisco has patched CVE-2026-20182, a zero-day in Catalyst SD-WAN Manager that has been actively exploited in targeted attacks by sophisticated threat actor...
- News
Cisco Zero-Day Under Ongoing Attack by Persistent Threat
The threat group UAT-8616 is actively exploiting a new Cisco SD-WAN zero-day and has been linked to multiple prior Cisco firewall and SD-WAN vulnerability...
- News
Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild
Microsoft has shared mitigations for CVE-2026-42897 until a permanent patch can be released for affected Exchange Server versions actively being targeted...
- News
Microsoft Exchange, Windows 11 Hacked on Second Day of Pwn2Own
On day two of Pwn2Own Berlin 2026, competitors demonstrated 15 unique zero-day vulnerabilities and collected $385,750 in awards, successfully exploiting...
- News
Microsoft Warns of Exchange Zero-Day Flaw Exploited in Attacks
Microsoft shared mitigations for a high-severity Exchange Server vulnerability being actively exploited that allows threat actors to execute arbitrary...
- News
PraisonAI CVE-2026-44338 Auth Bypass Targeted Within Hours
Threat actors began exploiting CVE-2026-44338, a missing authentication flaw in the PraisonAI multi-agent orchestration framework, within just four hours...
- News
Researcher Drops YellowKey, GreenPlasma Windows Zero-Days
A security researcher has publicly released two unpatched Windows zero-day exploits: YellowKey, a BitLocker bypass requiring physical access, and...
- News
Windows Zero-Days Expose BitLocker Bypasses and CTFMON
An anonymous researcher has publicly disclosed two new unpatched Windows zero-days — YellowKey enabling BitLocker bypass and GreenPlasma targeting CTFMON...
- News
Windows BitLocker Zero-Day Gives Access to Protected
A cybersecurity researcher has published proof-of-concept exploits for two unpatched Windows vulnerabilities — YellowKey (BitLocker bypass) and...
- Newsletter
May 12 Digest: AI-Generated Zero-Day, Shai-Hulud Worm
Google confirms the first AI-generated zero-day in the wild; TeamPCP's Mini Shai-Hulud worm hits TanStack, Mistral AI, and Guardrails AI; Instructure pays...
- News
Google Detects First AI-Generated Zero-Day Exploit in the Wild
SecurityWeek reports that Google has confirmed detecting the first known AI-generated zero-day exploit actively used in the wild. The exploit, designed to...
- News
Google: Hackers Used AI to Develop Zero-Day Exploit for Web
Google Threat Intelligence Group researchers say a zero-day exploit targeting a widely used open-source web administration tool was likely generated using...
- News
Hackers Used AI to Develop First Known Zero-Day 2FA Bypass
Google has disclosed a landmark discovery: an unknown threat actor used an AI system to develop a zero-day exploit in the wild — the first confirmed...
- News
Exploit Frenzy Threatens Millions via Critical cPanel
A critical authentication bypass flaw in cPanel/WHM has triggered a wave of exploit activity, with multiple proof-of-concept exploits now public and...
- News
Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation
Ivanti has disclosed a high-severity improper input validation vulnerability in Endpoint Manager Mobile (EPMM) that is being actively exploited in the...
- News
PAN-OS RCE Exploit Under Active Use Enabling Root Access
Palo Alto Networks has disclosed that CVE-2026-0300, a critical CVSS 9.3 buffer overflow in the PAN-OS User-ID Authentication service, is being actively...
- News
ThreatsDay Bulletin: Edge Plaintext Passwords, ICS 0-Days
This week's ThreatsDay threat roundup covers Microsoft Edge storing passwords in plaintext, industrial control system zero-days under active exploitation,...
- News
Ivanti Warns of New EPMM Flaw Exploited in Zero-Day Attacks
Ivanti has issued an urgent advisory warning customers to patch a high-severity remote code execution vulnerability in Endpoint Manager Mobile (EPMM) that...
- News
New Linux 'Dirty Frag' Zero-Day Gives Root on All Major
A new unpatched Linux zero-day exploit dubbed 'Dirty Frag' allows local attackers to gain root privileges on virtually all major Linux distributions with...
- News
CISA Gives Federal Agencies Four Days to Patch Actively
CISA has added a high-severity Ivanti Endpoint Manager Mobile vulnerability to the Known Exploited Vulnerabilities catalog and issued an emergency...
- News
Ivanti Customers Confront Yet Another Actively Exploited
Attackers are actively exploiting a new zero-day vulnerability in Ivanti Endpoint Manager Mobile (EPMM), the latest in a long series of critical flaws...
- News
Critical cPanel and WHM Bug Exploited as Zero-Day, PoC Now
The critical CVE-2026-41940 authentication bypass vulnerability in cPanel, WHM, and WP Squared is being actively exploited in the wild and has been...
- News
Hypersonic Supply Chain Attacks: One Solution That Didn't
SentinelOne details how its AI-driven behavioral detection stopped three zero-day supply chain attacks at machine speed — without prior knowledge of the...
- News
Patch Tuesday, April 2026 Edition
Microsoft released patches for 167 security vulnerabilities in April 2026, including an actively exploited SharePoint Server zero-day and the publicly...
- News
Hypersonic Supply Chain Attacks: AI Defense Stops Zero-Days
SentinelOne's AI-driven behavioral defense stopped three recent zero-day supply chain attacks before any payload signatures existed — demonstrating how...
- News
Over 1,300 Microsoft SharePoint Servers Vulnerable to Ongoing Spoofing Attacks
More than 1,300 internet-facing Microsoft SharePoint servers remain unpatched against a spoofing vulnerability exploited as a zero-day, with active...
- News
No Exploit Needed: How Attackers Walk Through the Front
Stolen credentials remain the dominant initial access vector in 2026 — no zero-days, no malware, just valid logins that blend in with normal activity...
- News
Adobe Patches Actively Exploited Zero-Day That Lingered for Months
Adobe has patched an actively exploited zero-day in Acrobat and Reader that threat actors have been weaponizing via malicious PDF files since at least...
- News
Analysis of 216M Security Findings Shows a 4x Increase in Critical Risk (2026 Report)
OX Security analyzed 216 million security findings across 250 organizations over 90 days and found critical risk grew by nearly 400% year-over-year, even...
- News
Microsoft Drops Its Second-Largest Monthly Patch Batch on Record
Microsoft's April 2026 Patch Tuesday addressed 169 CVEs — the second-largest monthly update in company history — including one actively exploited...
- News
Microsoft Issues Patches for SharePoint Zero-Day and 168
Microsoft's April 2026 Patch Tuesday addresses a record 169 security vulnerabilities including a SharePoint zero-day actively exploited in the wild, 8...
- News
ThreatsDay Bulletin: Defender 0-Day, SonicWall Brute-Force
This week's threat roundup covers an unpatched Microsoft Defender zero-day, active SonicWall brute-force campaigns, a 17-year-old Excel RCE vulnerability...
- News
Recently Leaked Windows Zero-Days Now Exploited in Active
Threat actors are actively exploiting three recently disclosed Windows security vulnerabilities that allow attackers to gain SYSTEM or elevated...
- News
Three Microsoft Defender Zero-Days Actively Exploited; Two
Huntress is warning that threat actors are actively exploiting three privilege escalation vulnerabilities in Microsoft Defender — codenamed BlueHammer,...
- News
Can Anthropic Keep Its Exploit-Writing AI Out of the Wrong
Anthropic's Claude Mythos Preview model can autonomously find and exploit zero-days across every major OS and browser at a 72.4% success rate — and it's...
- News
In Other News: Cyberattack Stings Stryker, Windows
A weekly roundup of notable cybersecurity stories: Iran-linked hackers wipe 200,000 Stryker devices, the BlueHammer Windows zero-day PoC goes public,...
- Security
CVE-2026-4149: Sonos Era 300 Unauthenticated RCE via SMB
A CVSS 10 critical vulnerability in the Sonos Era 300 smart speaker allows unauthenticated remote attackers to execute arbitrary code by exploiting an...
- News
Adobe Reader Zero-Day Exploited via Malicious PDFs Since
Threat actors have been exploiting an unpatched zero-day in Adobe Reader since at least November 2025, using specially crafted PDFs to fingerprint victims...
- News
Hackers Exploiting Acrobat Reader Zero-Day Flaw Since
Attackers have been silently exploiting an unpatched zero-day vulnerability in Adobe Acrobat Reader since at least November 2025, using malicious PDFs to...
- News
Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws
Anthropic's new Project Glasswing initiative uses a preview of its frontier model Claude Mythos to autonomously discover thousands of previously unknown...
- News
China-Linked Storm-1175 Chains Zero-Days for High-Velocity
A China-based threat cluster designated Storm-1175 has been linked to high-velocity ransomware attacks deploying Medusa payloads using chained zero-day...
- News
Medusa Ransomware Is Fast to Exploit Fresh Vulnerabilities
SecurityWeek reports that the Medusa ransomware group has developed a dangerous capability: rapidly weaponizing newly disclosed vulnerabilities —...
- News
Medusa Ransomware Exploits Zero-Days to Deploy Ransomware
Microsoft has raised the alarm over Medusa ransomware's unprecedented operational speed, with the group now exploiting zero-day vulnerabilities before...
- News
Storm-1175 Deploys Medusa Ransomware at 'High Velocity'
Microsoft says the financially motivated cybercrime group Storm-1175, linked to China, has exploited N-day and zero-day vulnerabilities in high-velocity...
- Newsletter
Apr 7 Digest: Medusa Ransomware Surge, FBI $21B Record
Storm-1175 runs sub-24-hour Medusa ransomware campaigns using zero-days; the FBI IC3 reports a record $21 billion in US cybercrime losses for 2025; North...
- News
Disgruntled Researcher Leaks BlueHammer Windows Zero-Day
A security researcher operating under the aliases 'Chaotic Eclipse' and 'Nightmare-Eclipse' has publicly released exploit code for an unpatched Windows...
- News
Fortinet FortiClient EMS Zero-Day CVE-2026-35616 Actively
A critical zero-day in FortiClient EMS with a CVSS score of 9.8 is being actively exploited in the wild while Fortinet has released only an emergency...
- News
Medusa Ransomware Group Exploits Zero-Days to Strike Within
Microsoft warns that Medusa ransomware operators are exploiting zero-day vulnerabilities approximately one week before public disclosure, enabling the...
- News
Microsoft Links Storm-1175 to Medusa Ransomware Zero-Day
Microsoft has formally attributed Medusa ransomware zero-day attacks to Storm-1175, a China-based financially motivated cybercriminal group that has...
- News
Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits
This week's biggest cybersecurity stories: a North Korean supply chain attack hit the Axios npm package, a new Chrome zero-day under active exploitation,...
- News
The Good, the Bad and the Ugly in Cybersecurity – Week 14
SentinelOne intercepts a LiteLLM supply chain attack in real time, attackers weaponize the Axios npm package to deploy a cross-platform RAT, and a Chrome...
- News
Apple Expands iOS 18 Updates to More iPhones to Block
Apple has extended security update eligibility to additional iPhone models still running iOS 18, enabling more devices to receive protections against the...
- News
Google Fixes Fourth Chrome Zero-Day Exploited in Attacks in 2026
Google has patched the fourth Chrome zero-day vulnerability actively exploited in attacks this year, a use-after-free flaw in the Dawn graphics engine...
- News
Hackers Exploit TrueConf Zero-Day to Push Malicious
Threat actors have weaponized an unpatched zero-day in TrueConf conference server software to execute arbitrary files on all connected endpoints,...
- News
New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation
Google has released a Chrome security update patching 21 vulnerabilities including a high-severity use-after-free zero-day in the Dawn graphics engine...
- News
Claude AI Finds Vim and Emacs RCE Bugs That Trigger on File
Anthropic's Claude AI assistant discovered remote code execution vulnerabilities in both Vim and GNU Emacs text editors using simple security research...
- News
Citrix Urges Admins to Patch NetScaler Flaws as Soon as
Citrix has patched two NetScaler ADC and Gateway vulnerabilities — including a critical CVSS 9.3 out-of-bounds read flaw eerily similar to the previously...
- News
DarkSword GitHub Leak Threatens to Turn Elite iPhone
Researchers say the GitHub leak of the DarkSword iOS exploit chain — six chained vulnerabilities targeting iOS 18.4 through 18.7 — threatens to...
- News
CISA Adds Apple DarkSword iOS Exploits, Craft CMS, and Laravel Livewire Flaws to KEV Catalog
CISA orders federal agencies to patch five actively exploited vulnerabilities by April 3, including three Apple flaws linked to the DarkSword iOS exploit...
- News
Interlock Ransomware Exploited Cisco FMC Zero-Day for 36
CVE-2026-20131, a maximum-severity CVSS 10.0 insecure deserialization flaw in Cisco Firepower Management Center, was exploited by Interlock ransomware as...
- News
Critical Langflow RCE Flaw Exploited Within 20 Hours of Disclosure
CVE-2026-33017, a CVSS 9.3 unauthenticated remote code execution vulnerability in the Langflow AI platform, was weaponized by threat actors within 20...
- News
CISA Adds Zimbra XSS and SharePoint RCE to KEV; Cisco FMC
CISA added actively exploited Zimbra Collaboration Suite and Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities catalog on March...
- News
Interlock Ransomware Has Been Exploiting Cisco FMC Zero-Day
The Interlock ransomware gang has been actively exploiting a CVSS 10.0 insecure deserialization flaw in Cisco Secure Firewall Management Center since late...
- News
The Zero-Day Scramble Is Avoidable: Why Attack Surface
Security teams racing to patch every new zero-day are fighting the symptom, not the cause. Intruder's Head of Security argues that most organizations have...
- News
Google: 90 Zero-Days Exploited in 2025 — Enterprise Tech
Google's Threat Intelligence Group tracked 90 zero-day vulnerabilities actively exploited in 2025, with enterprise software and appliances accounting for...
- Newsletter
Mar 6 Digest: 90 Zero-Days in 2025, Cisco CVSS 10
This week: Google reports 90 zero-days exploited in 2025 with enterprise tech at 48%, CISA issues emergency directive for Cisco SD-WAN CVSS 10 zero-day,...
- News
LexisNexis Confirms Cloud Breach Exposing 400K User
LexisNexis Legal & Professional confirms a data breach after threat actor FulcrumSec exploited an unpatched React2Shell vulnerability to exfiltrate 2.04...
- Security
CISA Issues Emergency Directive as Cisco SD-WAN Zero-Day
A maximum-severity authentication bypass in Cisco Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0) has been actively exploited by threat actor UAT-8616 since...
- News
Android March 2026 Security Update Patches 129
Google's March 2026 Android security bulletin addresses 129 vulnerabilities, including CVE-2026-21385 — an actively exploited zero-day in a Qualcomm...
- Security
Cisco SD-WAN Zero-Day CVE-2026-20127 Triggers Five Eyes
A CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN has been exploited since at least 2023. CISA issues Emergency Directive ED 26-03 as all Five...
- Security
Microsoft Office Word OLE Security Feature Bypass
An actively exploited zero-day in Microsoft Word allows attackers to bypass OLE protections and execute malicious Office documents silently, without...
- News
CrowdStrike 2026 Threat Report: eCrime Breakout Time Falls
CrowdStrike's 2026 Global Threat Report reveals that AI-enabled adversary operations surged 89% year-over-year, the average eCrime breakout time dropped...
- News
U.S. Treasury Sanctions Russian Zero-Day Broker Operation
The U.S. Treasury sanctioned Russian zero-day exploit broker Operation Zero, its founder Sergey Zelenyuk, and affiliated entities after an FBI...
- Security
BeyondTrust Remote Support and PRA Critical RCE Under
A critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and Privileged Remote Access is under active exploitation,...
- Security
Google Patches First Chrome Zero-Day of 2026: CVE-2026-2441
Google has patched CVE-2026-2441, a high-severity use-after-free vulnerability in Chrome's CSS component that has been actively exploited — the first...
- Security
Microsoft February 2026 Patch Tuesday Fixes Six Actively
Microsoft's February 2026 Patch Tuesday addresses roughly 60 vulnerabilities including six actively exploited zero-days across Windows, Office, and Azure...
- Security
Dell RecoverPoint Zero-Day Exploited by Chinese APT Since
A maximum-severity CVSS 10.0 hardcoded credentials vulnerability in Dell RecoverPoint for VMs has been under active exploitation by China-nexus threat...
- News
Warlock Ransomware Breaches SmarterTools via Its Own
The Warlock ransomware group exploited CVE-2026-23760, an authentication bypass zero-day in SmarterMail, to breach SmarterTools itself, compromise 12...
- Security
Apple Patches Actively Exploited iOS Zero-Day Used in Targeted Attacks
Apple has patched CVE-2026-20700, a memory corruption vulnerability in dyld used in 'extremely sophisticated' targeted attacks. Discovered by Google TAG,...
- Security
Cisco Unified Communications Zero-Day Exploited for Root RCE
An actively exploited zero-day in Cisco Unified Communications allows unauthenticated remote code execution with root privileges via crafted HTTP...
- News
APT28 Weaponizes Microsoft Office Zero-Day in 3 Days
Russia-linked APT28 (Fancy Bear) weaponized Microsoft Office CVE-2026-21509 within days of disclosure, deploying espionage implants against Ukrainian...
- Security
Google Chrome Use-After-Free Zero-Day Under Active
A high-severity use-after-free vulnerability in Chrome's CSS engine is being actively exploited in the wild. Google's first in-the-wild Chrome zero-day of...
- Security
Ivanti EPMM Zero-Days Breach Dutch, EU, and Finnish
Two critical Ivanti Endpoint Manager Mobile zero-days with CVSS 9.8 were exploited to breach the Dutch Data Protection Authority, European Commission, and...
- Newsletter
Mid-February Security Digest: Zero-Days, Government
Chrome's first zero-day of 2026, Ivanti EPMM breaches across EU governments, APT28's record-fast exploit weaponization, and the Cloudflare BGP outage that...
- Security
Apple Patches Actively Exploited Zero-Day in dyld
Apple releases emergency patches across all platforms for a memory corruption vulnerability in the Dynamic Link Editor (dyld) that was exploited in...
- News
Ex-L3Harris Executive Pleads Guilty to Selling Eight
Peter Williams, former GM of L3Harris's cyber subsidiary Trenchant, admits to selling eight zero-day exploit kits to a Russian broker for $1.3M in...
- Security
Microsoft Patch Tuesday February 2026: 6 Actively Exploited
Microsoft's February 2026 Patch Tuesday addresses 60 vulnerabilities including 6 actively exploited zero-days and 3 publicly disclosed issues, with...
- Security
CVE-2026-21533: Windows Remote Desktop Services Zero-Day
Actively exploited zero-day in Windows RDS allows authenticated attackers with low privileges to escalate to SYSTEM. Public exploit code available....
- Security
BeyondTrust Zero-Day Allows Unauthenticated Command
A critical zero-day in BeyondTrust Remote Support and Privileged Remote Access enables unauthenticated command execution, potentially compromising entire...
- Security
UNC3886 Zero-Day Campaign: Singapore Telecom Operators
Singapore discloses that APT group UNC3886 conducted a targeted espionage campaign against M1, SIMBA, Singtel, and StarHub using a previously unknown...
- Security
Windows SmartScreen Bypass Under Active Exploitation
Actively exploited Windows Shell vulnerability bypasses SmartScreen protection, allowing malicious files to execute without security warnings. Patch...
- Newsletter
CosmicBytez Newsletter #4 — February 2026 Security Digest
Critical Exchange and FortiOS zero-days, AI deepfake phishing surge, CISA zero trust mandate, post-quantum cryptography goes live, and the expanding RaaS...
- News
Google Patches Actively Exploited Chrome Zero-Day
Google has released an emergency Chrome update to fix a zero-day vulnerability being actively exploited in targeted attacks against journalists and activists.
- Security
China-Linked Hackers Exploit VMware ESXi Zero-Days to Escape VMs
Sophisticated attack chain leverages compromised SonicWall VPN and VMware ESXi vulnerabilities to break out of virtual machine isolation and compromise...
- Security
Microsoft January 2026 Patch Tuesday: 114 Flaws Fixed, One
Microsoft's first security update of 2026 addresses 114 vulnerabilities including three zero-days. One flaw is actively exploited in the wild with CISA...
- News
Apple Releases Critical Security Updates Across All
Apple has released security updates for iOS, macOS, watchOS, and tvOS addressing multiple actively exploited vulnerabilities. Users urged to update immediately.