Tag: zero day
535 articles
Federal Cyber Defense Shifts to Offense-Driven Mindset
The conventional cyber defense approach is no match for modern threats, as attackers often exploit valid credentials, misconfigurations, and low-severity weaknesses to bypass months of patching efforts. A new offense-driven mindset, like CISA's BOD 26-04, is shifting the focus from patch lists to exploitability to better address real-time risk.
Microsoft patches 974 vulnerabilities, including two actively exploited zero-days
Microsoft just dropped a massive Patch Tuesday update, fixing a whopping 974 vulnerabilities across its product lineup - including two zero-day flaws that hackers were actively exploiting before the fixes were even released. The update tackles critical issues, including privilege escalation bugs that could let attackers gain a foothold in your system.
Microsoft Delivers Record 974 Patches, Warns of Zero-Day Exploits
Microsoft just dropped a record 974 patches, including fixes for two vulnerabilities already being exploited as zero-days, forcing companies to scramble to keep up. This massive update is a stark reminder to stay vigilant, with experts warning of a vulnerability apocalypse.
Microsoft Patch Tuesday Disables Record 966 Flaws, Zero-Day Exploits
Microsoft just dropped a massive Patch Tuesday update, fixing a record-shattering 966 vulnerabilities, including two zero-day exploits that hackers are actively using to cause trouble. This September 2026 update is a big deal, with the most flaws patched in a single update ever.
OpenAI GPT-6 Astra Exposes Zero-Day Flaws, Tests Monitoring Limits
OpenAI's GPT-6 Astra has reached a critical milestone, showcasing advanced cyber capabilities that can identify and develop zero-day exploits without human intervention. This marks a significant leap forward in AI-powered cybersecurity threats.
WeChat Zero-Click Flaw Exploited to Hijack Accounts via Incoming Calls
A security firm, Calif, has successfully demonstrated a zero-click worm that can hijack WeChat accounts on both iPhone and Android devices with just an incoming call, and fortunately, the exploit has been blocked for all users. This alarming vulnerability was responsibly disclosed to Tencent in July, putting an end to the threat.
Adobe patches exploited Magento zero-day used to backdoor servers
Adobe has rushed out an emergency patch to fix a critical Magento zero-day vulnerability, known as StyleSmuggler, that's been exploited by hackers to plant backdoors on servers since early September. This max-severity flaw could allow attackers to execute arbitrary code, making it a must-fix for Magento and Adobe Commerce users.
Adobe Patches Zero-Day Flaw Exploited to Deploy Rust Backdoor
Adobe just patched a critical zero-day flaw, CVE-2026-75650, that's been exploited to deploy a Rust backdoor, known as StyleSmuggler, targeting Adobe Commerce merchants - and it's crucial you update ASAP to avoid arbitrary code execution. This severe vulnerability has a CVSS score of 10.0, so don't wait to secure your site.
Magento Zero-Day Exploited to Install Linux Backdoor
A newly discovered zero-day vulnerability, dubbed "StyleSmuggler," is being exploited in the wild to install a stealthy Linux backdoor on over 160,000 Magento and Adobe Commerce sites, including 14,000 of the top 1 million sites. This alarming attack has already hit a target running the latest security updates, leaving many sites vulnerable.
Google Discloses Chrome 0-Day Under Active Exploitation
Google just revealed a high-severity Chrome zero-day vulnerability, CVE-2026-85046, that's being actively exploited by hackers, allowing them to execute malicious code inside the browser's sandbox. This type confusion bug in Chrome's V8 engine was reported by researcher Salvatore Gulizia on August 4, 2026.
Security Researcher Exposes CrowdStrike Zero-Day Flaw
A security researcher known as Nightmare Eclipse has uncovered a zero-day flaw in CrowdStrike's Falcon Sensor, dubbed FalconFlank, which can be exploited to escalate privileges by manipulating Office malicious macros remediation. The researcher has even shared a public proof-of-concept on GitHub, highlighting the vulnerability's potential impact.
Magento Zero-Day Exploited to Install Persistent Backdoors
A critical Magento zero-day vulnerability, dubbed StyleSmuggler, is being actively exploited to install persistent backdoors on e-commerce stores, with attacks detected as early as September 4. All current versions of Magento Open Source and Adobe Commerce are affected, leaving stores vulnerable until a patch is released.
Trezor Breach Exposes 67,000 US Customers' Data
A data breach at Trezor's shipping provider has compromised the personal info of 67,000 US customers, including names, emails, phone numbers, addresses, and order numbers. The breach, linked to a zero-day SQL injection vulnerability, has raised concerns about customer data security, but Trezor assures that its hardware wallets remain secure.
Citrix NetScaler Flaw Exploited in Targeted Attacks
Citrix is urging customers to act fast to protect their NetScaler deployments from a critical flaw, known as CVE-2026-19490, that lets hackers bypass authentication and gain unauthorized access. To stay safe, review the security bulletin, check if your setup is vulnerable, and upgrade to the recommended build ASAP.
Passkey Security Compromised by 39 New Attack Methods
The promise of passkey security has been cracked: 39 new attack methods have been uncovered, threatening the layers of protection surrounding modern passkey systems. From phishing to credential theft, these vulnerabilities expose the weaknesses in what was thought to be a foolproof solution.
CrowdStrike Zero-Day Exploit Grants SYSTEM Privileges on Windows Systems
A new zero-day exploit, dubbed FalconFlank, can grant attackers SYSTEM-level access to fully patched Windows machines protected by CrowdStrike Falcon, allowing them to spawn a command prompt with elevated privileges. This alarming vulnerability leverages CrowdStrike's own Office malicious macros remediation feature to perform a devastating privilege escalation.
Google Patches Actively Exploited Chrome V8 Zero-Day Flaw
Google just patched a high-severity Chrome zero-day flaw that's being actively exploited - a type confusion vulnerability in V8 that could let hackers run malicious code inside the browser's sandbox. This critical update brings Chrome's version up to 152.0.7977.82, so make sure you've got the latest version installed!
Plex Issues Urgent Patch for Multiple Undisclosed Flaws
Plex has just released a critical security update to patch multiple undisclosed flaws, urging users to upgrade to Plex Media Server 1.43.3 and Plex Desktop 1.115.0 ASAP to safeguard their devices. With over 360,000 devices exposed to the internet, swift action is crucial.
Attackers Exploit Zero-Days in SonicWall SMA 1000 Appliances
SonicWall's SMA 1000 appliances are under attack, thanks to two newly disclosed zero-day vulnerabilities - CVE-2026-83548 and CVE-2026-83549 - that can be chained together for a complete network compromise. Attackers are already exploiting these flaws in the wild, prompting urgent patching advice from the vendor and cybersecurity authorities.
Security Researcher Exploits CrowdStrike Falcon with New Zero-Day Bug
A security researcher known as Nightmare Eclipse has made a stunning discovery, exploiting a zero-day bug in CrowdStrike's Falcon software and prompting the company to urge customers to disable a key Windows policy setting. This latest finding is part of a string of proof-of-concept exploits released by the researcher, targeting major cybersecurity products.
AI Agents Expose Vulnerabilities in Online Identity Verification Systems
In a surprising experiment, an autonomous AI agent called Tenner tested online identity verification systems and found them surprisingly vulnerable, breezing past defenses not once in 20 hours. With just $4.75 to its name, Tenner cleverly navigated the digital landscape, all while operating under strict rules to avoid detection.
Pegasus Spyware Targets Serbian Student Activist's iPhone
A Serbian student activist's iPhone was hacked with NSO Group's notorious Pegasus spyware through a clever zero-click exploit targeting Apple iMessage, according to a joint investigation by Citizen Lab and SHARE Foundation. This sneaky attack allowed the spyware to infect the device without the user even clicking on a link.
Researcher Exposes Privilege Escalation Flaw in CrowdStrike Falcon
A security researcher, known as Chaotic Eclipse, has uncovered a zero-day privilege escalation flaw in CrowdStrike Falcon, dubbed FalconFlank, which exploits the office malicious macros remediation feature. This vulnerability allows for a potentially devastating escalation of privileges, and a public proof-of-concept has been released.
AI Agents Automate Ransomware Attack, Leaving 80-Page Security Audit
In a chilling display of efficiency, AI-powered agents automated a ransomware attack on an enterprise network in under 10 hours - a process that would typically take human operators two weeks to complete. This lightning-fast breach was made possible by frontier AI models and agentic frameworks that executed each step of the intrusion with alarming precision.