Tag: zero day
368 articles
State-sponsored hackers exploit Palo Alto Networks firewall zero-day
Palo Alto Networks has issued a warning about a critical zero-day vulnerability, CVE-2026-0300, that allows state-sponsored hackers to exploit its firewalls and execute arbitrary code with root privileges. The company is tracking limited exploitation attempts, linked to a cluster of likely state-sponsored threat activity.
Palo Alto Networks Discloses Zero-Day Flaw in PAN-OS Software
Palo Alto Networks has issued a warning about a zero-day flaw in its PAN-OS software, tracked as CVE-2026-0300, which allows unauthenticated remote code execution with root privileges. This buffer overflow vulnerability in the User-ID Authentication Portal poses a high risk to PA-Series and VM-Series firewalls.
Palo Alto Networks Zero-Day Exploited in Wild, Firm Warns
Palo Alto Networks has warned of a critical zero-day vulnerability, CVE-2026-0300, being exploited in the wild, allowing unauthenticated attackers to execute code with root privileges on certain firewalls. This flaw affects a limited number of customers with exposed User-ID Authentication Portals.
US Cyber Officials Tighten Patching Deadlines Amid AI-Driven Threats
US cyber officials are considering a drastic reduction in patching deadlines, from two weeks to just three days, as AI-driven threats rapidly escalate and attackers gain unprecedented speed in discovering and exploiting vulnerabilities. This proposed shift reflects a urgent response to the evolving threat landscape, where AI-powered tools are revolutionizing the speed and efficiency of cyber attacks.
Palo Alto Networks Firewalls Targeted in Zero-Day Exploits
Palo Alto Networks firewalls are under attack by zero-day exploits targeting a vulnerability in the User-ID Authentication Portal, allowing hackers to execute malicious code with root privileges. This buffer overflow flaw, tracked as CVE-2026-0300, poses a significant risk to organizations with Internet-exposed firewalls.
Palo Alto Networks Flaw Exploited for Remote Code Execution
A critical vulnerability in Palo Alto Networks' PAN-OS software has been exploited, allowing hackers to execute malicious code with root privileges on firewalls - and all it takes is a few specially crafted packets. This buffer overflow flaw, tracked as CVE-2026-0300, puts PA-Series and VM-Series firewalls at risk of remote code execution attacks.
DarkSword Malware Targets iOS with Sophisticated Exploit Chain
Meet DarkSword, a sneaky malware that's been targeting iOS devices with a sophisticated exploit chain, leveraging six different vulnerabilities to deploy its final-stage payloads across iOS versions 18.4 through 18.7. Google Threat Intelligence Group has tracked its use back to November 2025, with multiple actors - from commercial vendors to suspected state-sponsored operators - employing it to compromise devices.
Google Boosts Bounty Payouts for Elusive Android Exploits
Google just supercharged its bounty program, offering up to $1.5 million for the most elusive Android exploits that require top-notch technical skills to pull off. The biggest prizes go to zero-click, full-chain exploits with persistence, highlighting Google's focus on tackling the toughest security challenges.
Nation-State Hackers Target Small Defense Firms' Network Gaps
Small defense firms are leaving themselves exposed to nation-state hackers, who exploited over 14 zero-day vulnerabilities in edge devices like routers and firewalls in 2025 to gain a foothold in the US defense industrial base. These stealthy cyber espionage groups are investing heavily in reconnaissance and pre-positioning operations to infiltrate and linger in their targets' networks.
CISA Warns of Active Linux Exploit
A newly discovered Linux kernel bug, dubbed "Copy Fail," allows unprivileged users to gain root privileges on unpatched systems, prompting urgent warnings from CISA and researchers. If your Linux system was built between 2017 and the recent patch, you're at risk - and need to act fast to protect yourself.
cPanel flaw fuels mass Sorry ransomware attacks
A critical flaw in cPanel, tracked as CVE-2026-41940, has been exploited in a massive ransomware campaign, compromising at least 44,000 IP addresses. This alarming attack has already been used in the wild as a zero-day, with threat actors accessing control panels and wreaking havoc on web hosting systems.
AI Uncovers Nine-Year-Old Linux Kernel Zero-Day Flaw
A shocking nine-year-old flaw in the Linux kernel, dubbed "Copy Fail," allows unprivileged users to secretly alter readable files and potentially gain root access to affected systems. This vulnerability, tracked as CVE-2026-31431, has been lurking in Linux kernels since 2017, putting countless machines at risk.
cPanel Bug Exploited in Wild as Zero-Day Before Patch Release
A cPanel bug, tracked as CVE-2026-41940, was exploited in the wild as a zero-day vulnerability before a patch was released, with attackers making execution attempts as early as February 23, 2026. The flaw forced vendors and hosting providers into emergency mitigation, with cPanel finally releasing a fix on April 28, 2026.
Google Fixes Critical Gemini CLI Flaw Enabling Remote Code Execution
Google patched a critical flaw in Gemini CLI that allowed hackers to inject malicious code and take control of host systems, thanks to a report from Novee Security. The vulnerability, scoring a perfect 10.0 on the CVSS scale, has been fixed in recent updates to the @google/gemini-cli and google-github-actions/run-gemini-cli packages.
Firefox Exposed: AI Model Uncovers 271 Zero-Day Vulnerabilities
Meet the AI model that just supercharged Firefox security, uncovering a whopping 271 zero-day vulnerabilities that have now been squashed in the latest update to Firefox 150. This game-changing collaboration between Firefox and Anthropic's cutting-edge tools has made the browser safer than ever.
CISA Orders Federal Agencies to Patch Exploited Windows Flaw
Federal agencies are on high alert: a critical Windows vulnerability, CVE-2026-32202, must be patched by May 12 to prevent zero-click credential theft via malicious LNK files. CISA has ordered all Federal Civilian Executive Branch agencies to secure their Windows endpoints and servers within two weeks.
Healthcare Sector Grapples with Rising Medical Device Cyberattacks
A staggering one in four healthcare organizations have fallen victim to cyberattacks that compromised their medical devices in the past year, posing a significant threat to patient care. This alarming trend highlights a pressing need for robust medical device cybersecurity measures to prevent delayed treatments and critical care interruptions.
Anthropic's AI Model Exposes New Vulnerability Risks
Anthropic's new AI model, Claude Mythos Preview, has sent shockwaves through the internet security community by autonomously discovering and exploiting software vulnerabilities that even thousands of expert developers missed. This powerful tool is being cautiously released to a select few, leaving many to wonder about the implications of its capabilities.
Researchers Uncover 38 Flaws in OpenEMR Software
A security firm just uncovered 38 vulnerabilities in widely-used OpenEMR software, including two critical zero-day flaws that could have put sensitive healthcare data at risk - but thankfully, they've already been patched. The flaws were discovered using AI-driven analysis and have been fixed, safeguarding the data of around 100,000 healthcare providers worldwide.
Unpatched Flaw Exposes Hugging Face LeRobot to Remote Code Execution
A critical, unpatched vulnerability in Hugging Face's LeRobot platform, rated CVSS 9.3, allows hackers to remotely execute code by exploiting Python's insecure pickle format, putting users at risk of devastating attacks. This flaw enables unauthenticated attackers to gain control by deserializing malicious data sent over unsecured channels.
AI Accelerates Exploits, Forces New Breach Playbooks
The game-changing capabilities of AI models like Anthropic's Claude Mythos have drastically shrunk the exploit window, allowing them to uncover vulnerabilities in minutes that would take human experts weeks or even hours to detect. This seismic shift is forcing organizations to rethink their approach to vulnerability management and incident response.
Microsoft Confirms Active Exploitation of Windows Shell Flaw
Microsoft warns of a high-severity Windows Shell flaw that's being actively exploited by attackers, allowing them to spoof victims over a network by simply sending a malicious file to be executed. The vulnerability, patched in April's Patch Tuesday update, poses a significant threat to users if left unprotected.
Microsoft Fixes Entra ID Flaw That Enabled Service Principal Takeovers
Microsoft has patched a vulnerability in Entra ID that allowed hackers to hijack service principals, potentially leading to full takeover of sensitive systems. A security researcher discovered the flaw, which stemmed from overly broad permissions in the Agent ID Administrator role.
AI-Powered Vulnerability Discovery Outpaces Remediation
The AI-powered Mythos model discovered a staggering number of vulnerabilities, including a 27-year-old bug in OpenBSD and a four-bug exploit chain that bypassed browser and OS defenses, with fewer than 1% of these vulnerabilities patched. This led Anthropic to delay a public release and share the findings with tech giants like Apple and Microsoft to prioritize patching.