All news with #zero day exploitation tag

🔒 Mandiant and Google Threat Intelligence Group warn that a suspected PRC-linked actor, ARMORY CASTLE, exploited a critical BeyondTrust Remote Support zero-day to gain root control, access credential vaults, and establish persistence. The flaw, CVE-2026-102764 (CVSS 9.3), affected versions up to 26.2.3 and was patched by BeyondTrust on Oct. 8; self-hosted appliances reachable from the internet during the exploitation window should be treated as potentially compromised. BeyondTrust urges immediate patching, snapshotting of suspect appliances before reboot, and credential rotation only after remediation.

🛡️ Palo Alto Unit 42 uncovered a suspected advanced threat actor exploiting a Fortinet FortiOS path traversal flaw (CVE-2025-61624) to deploy a previously unseen memory-resident ARM64 malware dubbed PEERSTITCH. The implant leaves no disk binaries or listening ports, instead using injected hooks in FortiOS daemons to create a covert inter-process communication channel and evade detection. The activity was observed following a broader intrusion that began with a FortiManager compromise, which exposed configurations, cryptographic keys, and credentials for over 500 FortiGate devices.

🛡️ Researchers at The Citizen Lab uncovered a campaign called “AdFection,” where actors like Discover‑Tech used the online ad ecosystem to profile, fingerprint, and selectively infect devices without user interaction. The company’s ads ran across hundreds of thousands of websites and apps, leveraged major networks, and even exploited GDPR consent flows. After disclosure, Google, IAB Europe and others cut Discover‑Tech’s access, but the incident highlights systemic flaws in real‑time bidding and vendor vetting.

🛡️ Palo Alto Networks released security updates for a high-severity PAN-OS RCE zero-day (CVE-2026-0322) that has been observed in limited exploitation. The flaw impacts the PAN-OS management interface and allows authenticated attackers with network access to execute code as root on PA-Series, VM-Series, Panorama virtual, and M-Series devices. Palo Alto recommends restricting management interface access to trusted IPs, upgrading affected PAN-OS versions, and notes limited protection via Threat Prevention signatures.

🔒 Cisco patched a critical zero-day (CVE-2026-76519) in its Secure Email Gateway involving a relative path traversal in the AMP File Reputation feature that allows remote unauthenticated actors to write files and execute commands as root. Affected devices have Content Scanner Tools prior to 25.3.0.5525 with File Reputation enabled; admins should check versions via contentscannerstatus and verify AMP settings in mail policies. Cisco provided IOCs, has deployed cloud mitigations, and urged customers to inspect logs, restore compromised devices, rotate credentials, and restrict appliance access.

🔒 Microsoft’s October Patch Tuesday addresses a record 1,414 vulnerabilities and introduces grouped risk cohorts to help organizations rapidly assess exposure. Of these, 1,102 affect Windows, with many leading to privilege escalation and remote code execution. A single actively exploited zero-day (CVE-2026-96951) in Windows Shell was patched, and several high-impact flaws across Microsoft, Adobe, and SAP warrant immediate attention. Vendors continue to see surge in discoveries, some attributed to neural networks.

🔒 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned administrators to immediately patch an authentication bypass in Ivanti Connect Secure tracked as CVE-2026-104935, which has been exploited in the wild since at least October 1. Ivanti released multiple updated versions to address the issue and urged customers to act immediately due to limited exploitation. CISA added the flaw to its actively exploited vulnerabilities list and instructed agencies and organizations to update, check for compromise, and perform forensic checks.

🔒 A security team at XBOW chained three previously unknown Google Chrome bugs into a full exploit that runs code on Windows simply by loading a web page. The researchers directed OpenAI's public GPT-5.6 Sol model to assist, building the chain in six days during Black Hat/DEF CON; Google confirmed and patched all three bugs and awarded XBOW the $250,000 maximum reward. Users should relaunch Chrome to ensure they are on version 152.0.7977.82 or later.

🔒 Microsoft released an unprecedented 1,411 CVE fixes on October Patch Tuesday, surpassing its entire 2025 total and setting a new high. The surge is attributed to the vendor's use of AI and MDASH scanning to identify vulnerabilities. The update batch includes one actively exploited zero day and two publicly disclosed zero days, plus 70 critical flaws — mostly RCEs — increasing pressure on security teams to patch quickly.

🛡️ A vhost subsystem bug, tracked as CVE-2026-74580 and named Vghost, lets a local user or an untrusted VM read and write arbitrary kernel memory and escalate to root across many Linux kernel versions. Tencent Zhuque Lab disclosed a fix on August 3 and published a detailed write-up with demos on October 12; there are no public exploitation reports. The vulnerability stems from a stale-translation cache in vhost that can be abused when ring addresses are updated while the queue is live. Vendors have shipped patches for many distributions; until patched, administrators should restrict access to /dev/vhost-* nodes and limit group membership to trusted services.

🛡️ Microsoft issued an unprecedented October Patch Tuesday with 1,407 CVEs, including three zero-days and one actively exploited flaw. The release was delayed by hours due to the volume, prompting urgent action from administrators. Key fixes affect Windows Shell, SharePoint, .NET, Exchange, and on-premises Atlassian and GitLab instances. Vendors including IBM, SAP, and Adobe also released critical updates that require immediate attention.

🔒 Microsoft issued a massive update addressing more than 1,400 vulnerabilities across Windows and other products, far exceeding previous monthly totals. One patched issue is a tracked zero-day (CVE-2026-96951) affecting Windows Shell on Windows 10, 11 and some Server editions. At least 78 flaws are rated critical, many enabling remote code execution, while some disclosures were public before the patch release. Security professionals warn this scale of fixes strains corporate patch management and urge prioritization of exploited or high-risk CVEs.

🛡️ Ghostscript contains a critical heap buffer overflow (CVE-2026-39919) that can enable remote code execution via specially crafted PDF files. Discovered by Wordfence's Argus AI on August 23, the issue affects Ghostscript versions 9.21 through 10.07.1 and can be triggered during PDF thumbnail or rendering operations. Administrators should upgrade to Ghostscript 10.08.0 or apply backported fixes, or otherwise block PDF uploads or disable PDF rendering to mitigate exploitation risks.

🔔 Ivanti urged customers to immediately patch an actively exploited zero-day in the Ivanti Connect Secure (ICS) SSL VPN, tracked as CVE-2026-104935. The high-severity authentication bypass affects multiple ICS versions and allows unauthenticated remote actors to execute arbitrary commands without user interaction. Ivanti reports limited exploitation in the wild and recommends upgrading to fixed versions and running the Integrity Checker Tool.

🔒 GitLab has released patches addressing a maximum-severity vulnerability that could permit unauthenticated arbitrary code execution via a crafted regular expression in CI/CD configurations, due to insufficient validation. The flaw, tracked as CVE-2026-97229 and rated CVSS 10.0, affects multiple 19.2–19.4 releases and is remediated in 19.4.2, 19.3.5, and 19.2.8. The advisory also fixes three high-severity issues impacting XSS, improper authorization in downstream pipeline creation, and a permissive regex allowing cache poisoning and exposure of protected variables.

📣 iVerify and Censys researchers detailed a new P7 variant of the DarkSword iOS exploit kit that reduces on-device footprint, adds on-device keychain and crypto-wallet theft, and implements two-way C2 communication. The toolkit, which chains multiple iOS vulnerabilities to escape the browser sandbox and inject into SpringBoard, has been used in campaigns since late 2025 against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine. P7 extracts keychain data to JSON prior to exfiltration, polls for commands frequently, and supports numerous remote actions including file exfiltration, command execution, and wallet extraction. Analysts also linked open directories and C2 infrastructure to multiple actors and uncovered two previously undocumented CVEs used by the kit.

📰 The US State Department has offered up to US $10 million for information on Zhang Yu, a 44-year-old alleged member of the Chinese state-linked hacker group Hafnium. Zhang is accused of directing intrusions that exploited zero-day flaws in Microsoft Exchange Server and of stealing data, including COVID-19 research, from US institutions. He is charged alongside Xu Zewei, who was arrested in Italy and extradited to the US; Zhang is believed to be in China and unlikely to be extradited. The bounty aims to pressure his movements and encourage tips despite diplomatic and legal complications.

🔒 The Pwn2Own Ireland 2026 contest concluded with security researchers earning $1,262,000 after demonstrating 98 zero-day vulnerabilities across seven product categories. Ikotas Labs topped the event with $361,000 and 42.5 Master of Pwn points after successful exploits against the Samsung Galaxy S26, OpenAI Codex, and Oracle Autonomous AI Database. Vendors are required to patch disclosed flaws within 90 days per Trend Micro's Zero Day Initiative rules.

🔒 On day two of Pwn2Own Ireland 2026, researchers earned $232,500 after exploiting 45 distinct zero-day vulnerabilities. The Samsung Galaxy S26 was compromised three times by teams including KAIST Hacking Lab, PetoWorks, and Mobile Hacking Lab. Other notable wins included a rapid Sonos Era 300 exploit and a $40,000 award for breaching Dynamo in the AI Infrastructure category. ZDI enforces vendor 90-day patch windows after disclosure.

🔍 On day one of Zero Day Initiative’s Pwn2Own Ireland 2026, ethical hacking teams discovered 32 zero-day vulnerabilities across smartphones, smart home devices, printers and AI tools, earning over $368,000 in prizes. Notable successes included exploits against Sonos Era 300, LiteLLM, Philips Hue Bridge Pro, Lexmark CX532adwe, Oracle Autonomous AI Database, OpenAI Codex and Garmin Index BPM. Findings will be responsibly disclosed to vendors with a 90-day patch window as the contest continues.