Tag: zero day
368 articles
Acer Rushes to Patch Zero-Days in Wave 7 Routers
Acer is urgently patching a critical vulnerability in its Wave 7 routers that allowed hackers to easily access sensitive login credentials, putting your entire network at risk. This flaw let attackers remotely tap into plaintext passwords stored in log archives, no authentication required.
Unpatched Windows Search Flaw Exposes User Hashes
A newly discovered vulnerability in Windows' search feature can be exploited to steal user passwords, allowing hackers to gain access to sensitive information. By simply clicking on a malicious link, a user's login credentials can be exposed to attackers.
AI-Driven Patching Pressures Redefine Vulnerability Response
The window between patch release and exploitation has dramatically shrunk to just six hours and 40 minutes, leaving organizations scrambling to keep up with increasingly rapid vulnerability response. This alarming trend is fueled by the growing power of large language models that can autonomously discover and even fix vulnerabilities.
VS Code Zero-Day Vulnerability Exposes GitHub Tokens to Theft
A security researcher just revealed a shocking VS Code zero-day vulnerability that lets attackers swipe your GitHub authentication tokens with just one click, exposing your online projects to potential theft. This exploit cleverly abuses VS Code's system to run malicious code and extract sensitive tokens.
Google Patches Actively Exploited Android Flaw Amid June Update
Google just dropped a crucial security update for Android, fixing 124 vulnerabilities, including a high-severity flaw that's being actively exploited - don't wait, patch up your device now! This critical fix tackles a privilege escalation bug that can be triggered without any user interaction, putting your data at risk.
Microsoft Softens Stance After Public Feud with 0-Day Researcher
Microsoft has backpedaled in its public feud with a 0-day researcher, easing tensions with the security community after facing criticism for its aggressive stance. The tech giant now explicitly assures that vulnerability hunters are not in its legal crosshairs.
Google patches actively exploited Android zero-day flaw amid June security updates
Google just patched a high-severity Android flaw that's being actively exploited by hackers, allowing them to gain control of devices running Android 14 or later. The June security update fixes this zero-day vulnerability, along with 123 others, to keep your device safe.
Palo Alto Networks Vulnerability Exploited in Active Attacks
Palo Alto Networks is urging users to patch their systems ASAP, as hackers are actively exploiting a critical vulnerability (CVE-2026-0257) in unpatched PAN-OS devices. This highly sought-after flaw was initially rated medium-severity but quickly upgraded to critical after exploitation was confirmed.
Faster Vulnerability Alerts Disrupt Cyberattack Window
The time it takes for attackers to exploit a newly disclosed vulnerability has dramatically shrunk to just 1.6 days - leaving organizations scrambling to respond. In today's lightning-fast threat landscape, staying ahead of vulnerability alerts is crucial to preventing devastating cyberattacks.
Palo Alto VPN Bug Sees Active Exploitation
Security experts at Rapid7 have confirmed that hackers are actively exploiting a critical authentication bypass flaw in Palo Alto Networks' VPN, putting PAN-OS users at risk of targeted attacks. This urgent development means users must patch their systems ASAP to prevent exploitation.
Windows Netlogon flaw exploited in attacks after patch release
A critical Windows Netlogon flaw, patched just last month, is now being actively exploited in attacks, putting vulnerable systems at risk of remote code execution. This severe vulnerability, rated 9.8 out of 10 in severity, allows attackers to gain control of targeted domain controllers with just a specially crafted network request.
Palo Alto Networks Warns of Active Exploitation of High-Severity VPN Bug
Palo Alto Networks has issued a warning about active exploitation of a high-severity VPN bug, urging users to patch their systems ASAP to avoid falling prey to potential security breaches. The vulnerability, CVE-2026-0257, allows attackers to bypass security restrictions and establish unauthorized VPN connections.
Palo Alto Networks Warns of Active Exploitation of GlobalProtect Flaw
Palo Alto Networks has issued a warning about a critical GlobalProtect flaw, CVE-2026-0257, that is being actively exploited, allowing attackers to bypass security restrictions and establish unauthorized VPN connections. This vulnerability affects specific PAN-OS and Prisma Access deployments with certain configurations.
Microsoft Faces Backlash Over Zero-Day Disclosure Feud
A researcher known as Nightmare Eclipse has unleashed a series of six Windows zero-day vulnerabilities, with working exploit code for at least three, and has threatened to release another on July 14, sparking a public feud with Microsoft. The ominous warning, which has left Microsoft speaking out against uncoordinated disclosures, has security experts on high alert.
Gogs Zero-Day Flaw Enables Remote Code Execution on Exposed Servers
A zero-day flaw in Gogs, a self-hosted Git service, leaves exposed servers vulnerable to remote code execution - and it's surprisingly easy for attackers to exploit, as they can create an account and repository on default-configured instances. This critical-severity vulnerability affects the latest release versions and requires only an authenticated user without admin privileges to launch an attack.
Microsoft Opposes Public Zero-Day Disclosures, Cites Customer Risk
Microsoft is speaking out against public zero-day disclosures, warning that revealing vulnerabilities without prior notice can put customers at unnecessary risk. The tech giant is urging researchers to adopt Coordinated Vulnerability Disclosure, sharing findings with affected vendors before going public.
Microsoft Decries Uncoordinated Zero-Day Disclosures
Microsoft slammed researchers who publicly revealed six zero-day vulnerabilities without giving the company a heads-up, putting customers at unnecessary risk. The tech giant named and shamed the flaws, including privilege escalation vulnerabilities in Microsoft Defender and a security feature bypass vulnerability in Windows BitLocker.
India's CERT-In Urges 12-Hour Patch Deadline for Exploited Vulnerabilities
CERT-In is urging organizations to act fast - patch, mitigate, or remove exposure to exploited vulnerabilities within 12 hours for internet-facing and high-priority systems. This strict deadline aims to minimize risk and protect critical assets from potential attacks.
CISA Mandates Emergency Patch for Exploited cPanel Plugin Flaw
A critical vulnerability in the LiteSpeed cPanel plugin, known as CVE-2026-48172, is being actively exploited by remote attackers, allowing them to execute arbitrary scripts with root privileges. CISA has issued an emergency patch, giving affected users just four days to update and protect themselves.
Hackers Exploit KnowledgeDeliver Flaw to Install Web Shells
Hackers have exploited a critical flaw in KnowledgeDeliver, using it as a zero-day to sneakily install a powerful .NET web shell called Godzilla on vulnerable servers. This sneaky attack was made possible by a deserialization vulnerability, CVE-2026-5426, that allowed threat actors to execute code at the operating-system level.
CISA Mandates Patching of Exploited Drupal Vulnerability
The US Cybersecurity and Infrastructure Security Agency has issued a directive requiring federal agencies to patch a critical Drupal vulnerability, known as CVE-2026-9082, by May 27 to prevent devastating SQL injection attacks. This highly critical flaw allows hackers to exploit PostgreSQL-powered Drupal sites and gain unauthorized access to sensitive information.
Trend Micro Discloses Apex One Zero-Day Exploited in Attacks
A critical zero-day vulnerability, CVE-2026-34926, has been discovered in Trend Micro's Apex One on-premises server, allowing pre-authenticated local attackers to inject malicious code - and it's being actively exploited in attacks. Federal agencies have been ordered to patch affected systems ASAP, with a deadline of June 4, 2026.
Google Exposes Unfixed Chromium Flaw Details
A security researcher just blew the whistle on a glaring Chromium flaw that Google thought was fixed - but still works, putting tens of thousands of users at risk of a botnet attack. The exploit, first reported in 2022, allows malicious websites to remotely execute JavaScript on unsuspecting devices.
Cisco Secure Workload Flaw Exposes Site Admin Privileges
A critical vulnerability in Cisco Secure Workload, known as CVE-2026-20223, allows hackers to gain Site Admin privileges without authentication, putting sensitive information and configuration changes at risk. Cisco has warned of this maximum-severity flaw and advised on remediation steps.