0-day

September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor

0-day, CISO, CrowdStrike, CSO, Don't miss, Fortra, Hot stuff, Microsoft, Microsoft Exchange, News, Patch Tuesday, patching, Proofpoint, SharePoint, Tenable, Trend Micro, Windows, Windows Defender, Windows Server /

September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor 2026-09-09 at 12:04 By Zeljka Zorz September 2026 Patch Tuesday is here, with Microsoft delivering another record-breaking number of patches, including those for two vulnerabilities that have been exploited as zero-days. Another “new normal” is the anonymous security researcher Nightmare Eclipse publishing […]

September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor Read More »

Google patches actively exploited Chrome zero-day (CVE-2026-85046)

0-day, Chrome, exploit, News, vulnerability /

Google patches actively exploited Chrome zero-day (CVE-2026-85046) 2026-09-04 at 15:09 By Sinisa Markovic Google has patched 12 vulnerabilities affecting its popular Chrome browser, among them CVE-2026-85046, which has been exploited in the wild. “Google is aware that an exploit for CVE-2026-85046 exists in the wild,” the company said in a Thursday security advisory. The fix […]

Google patches actively exploited Chrome zero-day (CVE-2026-85046) Read More »

SonicWall SMA 1000 appliances under attack via zero-day flaws

0-day, Don't miss, enterprise, exploit, Hot stuff, News, remote access, SonicWall /

SonicWall SMA 1000 appliances under attack via zero-day flaws 2026-09-02 at 13:13 By Zeljka Zorz Attackers are exploiting two previously undisclosed vulnerabilities (CVE-2026-83548, CVE-2026-83549) in SonicWall SMA 1000 appliances, the vendor confirmed on Tuesday. The vulnerabilities (CVE-2026-83548, CVE-2026-83549) The SonicWall SMA 1000 series is a line of secure remote access appliances (SSL VPN gateways) built […]

SonicWall SMA 1000 appliances under attack via zero-day flaws Read More »

Attackers plant remote access tools on compromised PaperCut servers

0-day, Don't miss, education, enterprise, Hot stuff, Huntress, News, PaperCut, patch, Rapid7, remote access, SMBs, vulnerability, WatchTowr /

Attackers plant remote access tools on compromised PaperCut servers 2026-08-31 at 17:54 By Zeljka Zorz The threat actor targeting internet-facing PaperCut Application Servers is covertly installing legitimate remote access software on them, PaperCut Software shared in the most recent update on the ongoing attack campaign. PaperCut zero-days exploited to deploy remote access tools The vendor […]

Attackers plant remote access tools on compromised PaperCut servers Read More »

Metabase zero-day exploited to access Framework customer data

0-day, data analytics, data breach, Don't miss, Hot stuff, Metabase, News /

Metabase zero-day exploited to access Framework customer data 2026-08-10 at 16:42 By Zeljka Zorz Framework, the San Francisco-based company that designs repairable and upgradeable laptops, has suffered a data breach after attackers managed to exploit a zero-day vulnerability in the Metabase business intelligence service. According to the notification sent to affected Framework customers, the attackers […]

Metabase zero-day exploited to access Framework customer data Read More »

SonicWall SMA zero-days were exploited weeks before disclosure

0-day, Don't miss, Hot stuff, intrusion, Malware, News, secure access, SonicWall, Volexity /

SonicWall SMA zero-days were exploited weeks before disclosure 2026-07-21 at 13:35 By Zeljka Zorz Two recently disclosed SonicWall SMA 1000 vulnerabilities – CVE-2026-15409 and CVE-2026-15410 – were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances, Volexity researchers revealed. The intrusions began as early as June 22, […]

SonicWall SMA zero-days were exploited weeks before disclosure Read More »

SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)

0-day, CVE, Don't miss, enterprise, Government, Hot stuff, News, secure access, SonicWall /

SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410) 2026-07-14 at 20:40 By Zeljka Zorz SonicWall has fixed two actively exploited vulnerabilities (CVE-2026-15409, CVE-2026-15410) affecting its Secure Mobile Access (SMA) 1000 Series appliances, and is urging customer organizations to upgrade to a fixed firmare version and search for evidence of potential compromise. If the outlined […]

SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410) Read More »

Microsoft working on patch for RoguePlanet Defender zero-day (CVE-2026-50656)

0-day, Don't miss, exploit, Hot stuff, Microsoft, Microsoft Defender, News, vulnerability disclosure /

Microsoft working on patch for RoguePlanet Defender zero-day (CVE-2026-50656) 2026-06-17 at 14:26 By Zeljka Zorz Microsoft has acknowledged the local elevation of privilege issue in Microsoft Defender that can be triggered via the “RoguePlanet” exploit, and is “working to provide a high quality security update that addresses this vulnerability.” The vulnerability, which has been assigned […]

Microsoft working on patch for RoguePlanet Defender zero-day (CVE-2026-50656) Read More »

Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262)

0-day, APT, CISA, Cisco, Don't miss, Hot stuff, News, SD-WAN /

Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262) 2026-06-16 at 13:20 By Zeljka Zorz Cisco has revealed another Catalyst SD-WAN Manager vulnerability (CVE-2026-20262) that its Product Security Incident Response Team observed being exploited by attackers. But the associated security advisory also states that “the vulnerability was found during internal security testing”, raising the […]

Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262) Read More »

Oracle PeopleSoft servers under attack, Oracle pushes out-of-band security alert

0-day, Data leak, data theft, Don't miss, education, extortion, Hot stuff, News, Oracle, vulnerability /

Oracle PeopleSoft servers under attack, Oracle pushes out-of-band security alert 2026-06-11 at 15:41 By Zeljka Zorz A zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft PeopleTools is being exploited in the wild, Charles Carmakal, CTO at cybersecurity firm Mandiant, part of Google Cloud, warned today. The warning comes a day after Oracle published an out-of-band security alert […]

Oracle PeopleSoft servers under attack, Oracle pushes out-of-band security alert Read More »

Google patches Chrome zero-day exploited in the wild (CVE-2026-11645)

0-day, Chrome, Google, News, security update /

Google patches Chrome zero-day exploited in the wild (CVE-2026-11645) 2026-06-09 at 15:21 By Sinisa Markovic Google has fixed 74 vulnerabilities in Chrome, including a high-severity zero-day (CVE-2026-11645) that has been exploited in the wild. “Google is aware that an exploit for CVE-2026-11645 exists in the wild,” the company said in a Monday security advisory. The […]

Google patches Chrome zero-day exploited in the wild (CVE-2026-11645) Read More »

Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751)

0-day, Check Point, data theft, Don't miss, enterprise, Hot stuff, News, Ransomware, secure access, VPN, vulnerability /

Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751) 2026-06-08 at 16:16 By Zeljka Zorz A Qilin ransomware affiliate is believed to be exploiting CVE-2026-50751, an authentication bypass vulnerability in Check Point VPN Remote Access and Mobile Access, the company announced on Monday. About CVE-2026-50751 Check Point Remote Access VPN enables and secures connections between […]

Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751) Read More »

Cisco SD-WAN 0-day exploited, no patch available (CVE-2026-20245)

0-day, APT, Cisco, Don't miss, exploit, Hot stuff, Mandiant, News, SD-WAN /

Cisco SD-WAN 0-day exploited, no patch available (CVE-2026-20245) 2026-06-05 at 15:49 By Zeljka Zorz A 0-day privilege escalation vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager that has yet to be patched by Cisco is being leveraged by attackers. “To exploit this vulnerability, an attacker must have netadmin privileges on an affected system. This would require […]

Cisco SD-WAN 0-day exploited, no patch available (CVE-2026-20245) Read More »

Actively exploited Trend Micro Apex One flaw gets CISA warning (CVE-2026-34926)

0-day, CISA, Don't miss, Endpoint Security, enterprise, Hot stuff, News, security update, Trend Micro /

Actively exploited Trend Micro Apex One flaw gets CISA warning (CVE-2026-34926) 2026-05-26 at 17:32 By Zeljka Zorz A relative directory path traversal vulnerability (CVE-2026-34926) in Trend Micro’s Apex One platform has been exploited in zero-day attacks, the company confirmed. “TrendAI has observed at least one attempt to exploit this vulnerability in the wild,” Trend Micro […]

Actively exploited Trend Micro Apex One flaw gets CISA warning (CVE-2026-34926) Read More »

$20 per zero-day is already the WordPress plugin reality

0-day, AI, conferences, cybersecurity, Don't miss, Hot stuff, News, research, Trend Micro, WordPress /

$20 per zero-day is already the WordPress plugin reality 2026-05-22 at 17:05 By Mirko Zorz Vulnerability researchers have spent the past year arguing about whether AI agents can find real bugs at scale or whether they mostly generate noise. A pipeline built in three days by researchers from TrendAI and CHT Security supplies an answer, […]

$20 per zero-day is already the WordPress plugin reality Read More »

Cisco patches another actively exploited SD-WAN zero-day (CVE-2026-20182)

0-day, APT, Cisco, Don't miss, Hot stuff, News, Rapid7, SD-WAN /

Cisco patches another actively exploited SD-WAN zero-day (CVE-2026-20182) 2026-05-15 at 16:07 By Zeljka Zorz Cisco has patched yet another Catalyst SD-WAN Controller authentication bypass vulnerability (CVE-2026-20182) that has been exploited as a zero-day by “a highly sophisticated cyber threat actor”. About CVE-2026-20182 CVE-2026-20182 – affecting both Cisco Catalyst SD-WAN Controller (the “brain” of the Cisco […]

Cisco patches another actively exploited SD-WAN zero-day (CVE-2026-20182) Read More »

Google researchers uncover criminal zero-day exploit likely built with AI

0-day, AI, APT, attack, cybercrime, cybersecurity, Don't miss, exploit, Google, Google Cloud, Hot stuff, Mandiant, News, report, Russian Federation, threats /

Google researchers uncover criminal zero-day exploit likely built with AI 2026-05-11 at 16:48 By Mirko Zorz Google’s threat intelligence researchers have linked a zero-day exploit to AI-assisted development by a criminal group. The exploit targeted a popular open-source web-based system administration tool. It allowed attackers to bypass two-factor authentication once they had valid user credentials. […]

Google researchers uncover criminal zero-day exploit likely built with AI Read More »

Ivanti EPMM vulnerability exploited in zero-day attacks (CVE-2026-6973)

0-day, Don't miss, endpoint management, Hot stuff, Ivanti, News, vulnerability /

Ivanti EPMM vulnerability exploited in zero-day attacks (CVE-2026-6973) 2026-05-08 at 13:30 By Zeljka Zorz Ivanti has released fixes for 5 high-severity vulnerabilities in its Endpoint Manager Mobile (EPMM) solution, one of which (CVE-2026-6973) has being exploited as a zero-day by attackers. “We are aware of a very limited number of customers exploited with CVE-2026-6973,” the […]

Ivanti EPMM vulnerability exploited in zero-day attacks (CVE-2026-6973) Read More »

State-sponsored hackers likely behind zero-day attacks on Palo Alto firewalls

0-day, APT, Don't miss, firewall, government-backed attacks, Hot stuff, News, Palo Alto Networks /

State-sponsored hackers likely behind zero-day attacks on Palo Alto firewalls 2026-05-08 at 01:14 By Zeljka Zorz Palo Alto Networks believes the in-the-wild exploitation of a zero-day vulnerability (CVE-2026-0300) in its firewalls is likely the work of state-sponsored threat actors. A flaw with no patch (yet) CVE-2026-0300 is a buffer overflow vulnerability in the User-ID Authentication […]

State-sponsored hackers likely behind zero-day attacks on Palo Alto firewalls Read More »

cPanel zero-day exploited for months before patch release (CVE-2026-41940)

0-day, cPanel, CVE, Don't miss, Hot stuff, News, PoC, Rapid7, security update, WatchTowr, web hosting /

cPanel zero-day exploited for months before patch release (CVE-2026-41940) 2026-04-30 at 16:45 By Zeljka Zorz A critical authentication bypass vulnerability (CVE-2026-41940) in cPanel, a popular web-based control panel for managing web hosting accounts, is being exploited by attackers in the wild. What’s more, attackers didn’t have to wait for watchTowr security researchers to release technical […]

cPanel zero-day exploited for months before patch release (CVE-2026-41940) Read More »

Scroll to Top