0-day

Google researchers uncover criminal zero-day exploit likely built with AI

0-day, AI, APT, attack, cybercrime, cybersecurity, Don't miss, exploit, Google, Google Cloud, Hot stuff, Mandiant, News, report, Russian Federation, threats /

Google researchers uncover criminal zero-day exploit likely built with AI 2026-05-11 at 16:48 By Mirko Zorz Google’s threat intelligence researchers have linked a zero-day exploit to AI-assisted development by a criminal group. The exploit targeted a popular open-source web-based system administration tool. It allowed attackers to bypass two-factor authentication once they had valid user credentials. […]

Google researchers uncover criminal zero-day exploit likely built with AI Read More »

Ivanti EPMM vulnerability exploited in zero-day attacks (CVE-2026-6973)

0-day, Don't miss, endpoint management, Hot stuff, Ivanti, News, vulnerability /

Ivanti EPMM vulnerability exploited in zero-day attacks (CVE-2026-6973) 2026-05-08 at 13:30 By Zeljka Zorz Ivanti has released fixes for 5 high-severity vulnerabilities in its Endpoint Manager Mobile (EPMM) solution, one of which (CVE-2026-6973) has being exploited as a zero-day by attackers. “We are aware of a very limited number of customers exploited with CVE-2026-6973,” the […]

Ivanti EPMM vulnerability exploited in zero-day attacks (CVE-2026-6973) Read More »

State-sponsored hackers likely behind zero-day attacks on Palo Alto firewalls

0-day, APT, Don't miss, firewall, government-backed attacks, Hot stuff, News, Palo Alto Networks /

State-sponsored hackers likely behind zero-day attacks on Palo Alto firewalls 2026-05-08 at 01:14 By Zeljka Zorz Palo Alto Networks believes the in-the-wild exploitation of a zero-day vulnerability (CVE-2026-0300) in its firewalls is likely the work of state-sponsored threat actors. A flaw with no patch (yet) CVE-2026-0300 is a buffer overflow vulnerability in the User-ID Authentication […]

State-sponsored hackers likely behind zero-day attacks on Palo Alto firewalls Read More »

cPanel zero-day exploited for months before patch release (CVE-2026-41940)

0-day, cPanel, CVE, Don't miss, Hot stuff, News, PoC, Rapid7, security update, WatchTowr, web hosting /

cPanel zero-day exploited for months before patch release (CVE-2026-41940) 2026-04-30 at 16:45 By Zeljka Zorz A critical authentication bypass vulnerability (CVE-2026-41940) in cPanel, a popular web-based control panel for managing web hosting accounts, is being exploited by attackers in the wild. What’s more, attackers didn’t have to wait for watchTowr security researchers to release technical […]

cPanel zero-day exploited for months before patch release (CVE-2026-41940) Read More »

Researcher drops two more Microsoft Defender zero-days, all three now exploited in the wild

0-day, Don't miss, exploit, Hot stuff, Huntress, Microsoft, Microsoft Defender, News, PoC /

Researcher drops two more Microsoft Defender zero-days, all three now exploited in the wild 2026-04-17 at 14:32 By Zeljka Zorz The security researcher who earlier this month published a proof-of-concept (PoC) exploit for a zero-day privilege escalation vulnerability in Microsoft Defender is back with two more. The first, dubbed “RedSun,” is another privilege escalation flaw […]

Researcher drops two more Microsoft Defender zero-days, all three now exploited in the wild Read More »

Adobe issues emergency fix for Acrobat Reader flaw exploited in the wild (CVE-2026-34621)

0-day, Adobe, Adobe Reader, Don't miss, Expmon, Hot stuff, News, PDF /

Adobe issues emergency fix for Acrobat Reader flaw exploited in the wild (CVE-2026-34621) 2026-04-13 at 13:22 By Zeljka Zorz Adobe has pushed out an emergency security update for Adobe Acrobat Reader, patching a zero-day vulnerability (CVE-2026-34621) exploited in the wild since November 2025. About CVE-2026-34621 CVE-2026-34621 is a critical prototype pollution vulnerability – a type […]

Adobe issues emergency fix for Acrobat Reader flaw exploited in the wild (CVE-2026-34621) Read More »

Acrobat Reader zero-day exploited in the wild for many months

0-day, Adobe, Adobe Reader, Don't miss, exploit, Expmon, Hot stuff, News, PDF /

Acrobat Reader zero-day exploited in the wild for many months 2026-04-09 at 15:44 By Zeljka Zorz Unknown attackers have exploited a zero-day Adobe Acrobat Reader vulnerability since November 2025 and possibly even earlier, security researcher Haifei Li has discovered. PDF files carry the exploit Haifei Li is one of the creators of EXPMON, a sandbox-based […]

Acrobat Reader zero-day exploited in the wild for many months Read More »

BlueHammer: Windows zero-day exploit leaked

0-day, CYDERES, Don't miss, exploit, Hot stuff, News, PoC, Windows, Windows Defender, Windows Server /

BlueHammer: Windows zero-day exploit leaked 2026-04-08 at 23:29 By Zeljka Zorz A buggy but functional proof-of-concept (PoC) exploit for an unpatched Windows local privilege escalation vulnerability dubbed BlueHammer has been published on GitHub by someone who goes by the handle Chaotic Eclipse and Nightmare Eclipse. Several security researchers have fixed the bugs in the exploit […]

BlueHammer: Windows zero-day exploit leaked Read More »

FortiClient EMS zero-day exploited, emergency hotfixes available (CVE-2026-35616)

0-day, Defused Cyber, Don't miss, enterprise, Fortinet, Hot stuff, News /

FortiClient EMS zero-day exploited, emergency hotfixes available (CVE-2026-35616) 2026-04-04 at 17:39 By Zeljka Zorz Defused Cyber has spotted a critical Fortinet FortiClient Endpoint Management Server (EMS) zero-day vulnerability (CVE-2026-35616) being exploited in the wild. This time around, the confirmation of active exploitation came almost immediately from Fortinet, as well. “Fortinet has observed [CVE-2026-35616] to be […]

FortiClient EMS zero-day exploited, emergency hotfixes available (CVE-2026-35616) Read More »

Google fixes Chrome zero-day with in-the-wild exploit (CVE-2026-5281)

0-day, Chrome, Don't miss, Hot stuff, Microsoft Edge, News, Vivaldi /

Google fixes Chrome zero-day with in-the-wild exploit (CVE-2026-5281) 2026-04-01 at 14:31 By Zeljka Zorz Google has fixed 21 vulnerabilities affecting its popular Chrome browser, among them a zero-day (CVE-2026-5281) with an in-the-wild exploit. About CVE-2026-5281 As per usual, information about the fixed zero-day is limited, and there’s no details about the exploit (or how/if it’s […]

Google fixes Chrome zero-day with in-the-wild exploit (CVE-2026-5281) Read More »

Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131)

0-day, AWS, Cisco, Don't miss, enterprise, firewall, Hot stuff, News, Ransomware /

Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131) 2026-03-20 at 15:21 By Zeljka Zorz A critical vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) that Cisco disclosed and patched in early March 2026 has been exploited as a zero-day by the Interlock ransomware gang, Amazon CISO and VP of Security Engineering […]

Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131) Read More »

Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127)

0-day, ACSC, CISA, Cisco, Don't miss, exploit, Government, Hot stuff, News, SD-WAN /

Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127) 2026-02-25 at 19:04 By Zeljka Zorz A “highly sophisticated” cyber threat actor has been exploiting a zero-day authentication bypass vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller (formerly vSmart), Cisco has announced today. The vulnerability was reported by Australian Signals Directorate’s Australian Cyber Security Centre, who said […]

Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127) Read More »

CISA flags exploited FileZen command injection bug, patch now! (CVE-2026-25108)

0-day, CISA, Don't miss, file-sharing, FileZen, Hot stuff, Japan, JPCERT/CC, News, Ransomware, Soliton, vulnerability /

CISA flags exploited FileZen command injection bug, patch now! (CVE-2026-25108) 2026-02-25 at 12:14 By Zeljka Zorz CISA has added CVE-2026-25108, an OS command injection vulnerability in Soliton Systems’ FileZen secure file transfer solution, to its Known Exploited Vulnerabilities (KEV) catalog. The vendor has confirmed active exploitation, stating it has received multiple reports of damage caused […]

CISA flags exploited FileZen command injection bug, patch now! (CVE-2026-25108) Read More »

European Commission hit by cyberattackers targeting mobile management platform

0-day, CERT-EU, Don't miss, EU, Hot stuff, Ivanti, mobile security, NCSC-NL, News /

European Commission hit by cyberattackers targeting mobile management platform 2026-02-09 at 16:02 By Zeljka Zorz The European Commission’s mobile device management platform was hacked but the incident was swiftly contained and no compromise of mobile devices was detected, EU’s executive branch announced on Friday. The intrusion was detected on January 30, 2026, by CERT-EU, the […]

European Commission hit by cyberattackers targeting mobile management platform Read More »

Ivanti provides temporary patches for actively exploited EPMM zero-day (CVE-2026-1281)

0-day, CISA, Don't miss, endpoint management, enterprise, Hot stuff, Ivanti, News, patch /

Ivanti provides temporary patches for actively exploited EPMM zero-day (CVE-2026-1281) 2026-01-30 at 05:32 By Zeljka Zorz Ivanti has released provisional patches that fix two critical code injection vulnerabilities in Endpoint Manager Mobile (EPMM), one of which (CVE-2026-1281) has been exploited in zero-day attacks and has been added to CISA’s Known Exploited Vulnerabilities catalog. Investigating potential […]

Ivanti provides temporary patches for actively exploited EPMM zero-day (CVE-2026-1281) Read More »

Fortinet starts patching exploited FortiCloud SSO zero-day (CVE-2026-24858)

0-day, Don't miss, firewall, Fortinet, FortiOS, Hot stuff, News, SSO, vulnerability /

Fortinet starts patching exploited FortiCloud SSO zero-day (CVE-2026-24858) 2026-01-28 at 02:21 By Zeljka Zorz Fortinet has begun releasing FortiOS versions that fix CVE-2026-24858, a critical zero-day vulnerability that allowed attackers to log into targeted organizations’ FortiGate firewalls. “This vulnerability was found being exploited in the wild by two malicious FortiCloud accounts, which were locked out […]

Fortinet starts patching exploited FortiCloud SSO zero-day (CVE-2026-24858) Read More »

Microsoft reveals actively exploited Office zero-day, provides emergency fix (CVE-2026-21509)

0-day, Don't miss, Hot stuff, Microsoft, MS Office, News, security update /

Microsoft reveals actively exploited Office zero-day, provides emergency fix (CVE-2026-21509) 2026-01-27 at 11:22 By Zeljka Zorz Microsoft released emergency Office security updates to fix a security feature bypass vulnerability (CVE-2026-21509) that its threat intelligence and security teams spotted being exploited in the wild in zero-day attacks. Users and admins are advised to review the associated […]

Microsoft reveals actively exploited Office zero-day, provides emergency fix (CVE-2026-21509) Read More »

Actively exploited SonicWall zero-day patched (CVE-2025-40602)

0-day, Don't miss, Google Cloud, Hot stuff, News, SonicWall, vulnerability /

Actively exploited SonicWall zero-day patched (CVE-2025-40602) 2025-12-17 at 18:46 By Zeljka Zorz SonicWall has patched a local privilege escalation vulnerability (CVE-2025-40602) affecting its Secure Mobile Access (SMA) 1000 appliances and is urging customers to apply the provided hotfix, as the flaw is being leveraged by attackers. “This vulnerability was reported to be leveraged in combination […]

Actively exploited SonicWall zero-day patched (CVE-2025-40602) Read More »

Update your Apple devices to fix actively exploited vulnerabilities! (CVE-2025-14174, CVE-2025-43529)

0-day, apple, Don't miss, Hot stuff, iOS, macOS, News, security update /

Update your Apple devices to fix actively exploited vulnerabilities! (CVE-2025-14174, CVE-2025-43529) 2025-12-15 at 12:58 By Zeljka Zorz Apple has issued security updates with fixes for two WebKit vulnerabilities (CVE-2025-14174, CVE-2025-43529) that have been exploited as zero-days. Several days before the release of these updates, Google fixed CVE-2025-14174 in the desktop version of Chrome, though at […]

Update your Apple devices to fix actively exploited vulnerabilities! (CVE-2025-14174, CVE-2025-43529) Read More »

Google fixes Android vulnerabilities “under targeted exploitation” (CVE-2025-48633, CVE-2025-48572)

0-day, Android, Don't miss, Google, Hot stuff, Motorola Solutions, News, Samsung /

Google fixes Android vulnerabilities “under targeted exploitation” (CVE-2025-48633, CVE-2025-48572) 2025-12-02 at 16:48 By Zeljka Zorz Google has shipped patches for 51 Android vulnerabilities, including two high-severity flaws (CVE-2025-48633, CVE-2025-48572) that “may be under limited, targeted exploitation”. According to the December Android security bulletin, both vulnerabilities affect the Android Framework, which is a collection of core […]

Google fixes Android vulnerabilities “under targeted exploitation” (CVE-2025-48633, CVE-2025-48572) Read More »

Scroll to Top