All news with #zero day exploitation tag

🔒 On day one of Pwn2Own Ireland 2026, researchers exploited 32 zero-days and earned $388,500 after successfully hacking the Samsung Galaxy S26 twice. The contest targeted seven categories including mobile phones, printers, smart home devices, messaging apps, AI infrastructure, AI coding apps, and wellness healthcare devices. Several teams demonstrated exploits against LiteLLM, Lexmark and Canon printers, Sonos speakers, and OpenAI's Codex, while some reported bugs were already known to vendors. Vendors have 90 days to patch flaws before Trend Micro's ZDI publicly discloses details.

🔍 Google’s Threat Intelligence Group reports attackers are increasingly weaponizing disclosed flaws, with AI accelerating exploit development. GTIG recorded 141 exploited CVEs between January and August 2026 versus 127 in all of 2025, while monthly disclosures doubled. High-risk exploits and time-to-exploit have risen, and perimeter appliances remain prime targets. Organizations must adopt threat-driven triage and automated remediation to manage the growing volume.

📰 This week’s recap highlights multiple actively exploited vulnerabilities, high-profile arrests, and evolving malware techniques that take advantage of small oversights. Notable items include Citrix NetScaler and FortiMail zero-days, arrests tied to ShinyHunters and KillSec operations, and novel attack methods like RedFlick delivering the CosmicPulse backdoor. The report stresses urgent patching and improved basic hygiene to reduce exposure.

🔒 Citrix has disclosed a high-severity zero-day, CVE-2026-88779, affecting NetScaler ADC and NetScaler Gateway that can lead to denial of service when specific SAML-related configurations are present. The vendor urged customers on affected versions to review SAML authentication entries and install updates; temporary signatures and NetScaler Global Deny List rules are available to reduce exposure. Citrix stated customer data integrity was not impacted and is monitoring the situation while CISA added the flaw to its KEV catalog.

🔒 A critical vulnerability in Rejetto HTTP File Server (HFS), tracked as CVE-2026-61500, is being actively targeted in the wild. The flaw stems from use of a weak PRNG for session-cookie signing, allowing attackers to reconstruct the key, forge admin sessions, and trigger remote code execution via the server_code feature. A patch (v3.2.1) was released in July 2026, but exploitation attempts were observed in October after a public PoC was released.

🔒 Citrix released security updates for a high-severity NetScaler ADC and NetScaler Gateway vulnerability, tracked as CVE-2026-88779, with a CVSS score of 8.7. The memory overflow bug can cause denial-of-service when NetScaler is configured as a SAML service provider or identity provider; customers should check for add authentication samlAction or add authentication samlIdPProfile entries. Patches are available in specified 13.1 and 14.1 releases, and CISA added the flaw to its KEV catalog with a federal remediation deadline of October 7, 2026.

🔒 On September 15, Google released a Pixel-specific security bulletin addressing 110 vulnerabilities in its smartphones, highlighting CVE-2026-58704 as a zero-day exploited in targeted attacks. The bulletin complements the monthly Android Security Bulletin by fixing issues tied to Pixel hardware components such as the modem, bootloader, GPU, and fingerprint scanner. Owners should install the update via Settings → Security & privacy → System & updates → Security update → Install, and follow recommended hardening steps to reduce risk.

🔒 The Dutch Institute for Vulnerability Disclosure (DIVD) disclosed it was compromised after attackers used two zero-day flaws in Zammad. Detected on September 24, the chained RCE (CVE-2026-102489) and privilege escalation (CVE-2026-102490) enabled rapid session hijack and root takeover, with a combined CVSS of 9.4. DIVD contained the intrusion through segmentation but reported volunteer contact data exposure. The group warns users to update to Zammad 7 or take instances offline immediately.

🔒 The U.S. CISA has added a critical Fortinet FortiMail flaw (CVE-2026-104286, CVSS 9.8) to its KEV catalog after reports of active exploitation. The vulnerability allows unauthenticated attackers to write arbitrary files via crafted HTTP/HTTPS requests due to path traversal and NULL byte handling issues. Fortinet has identified affected FortiMail versions and provided upgrade guidance and temporary workarounds, including disabling IBE and restricting management access.

🚨 Fortinet warns of a critical FortiMail vulnerability (CVE-2026-104286) actively exploited in zero-day attacks that can allow unauthenticated attackers to write arbitrary files and execute code via crafted HTTP/HTTPS requests. The flaw affects multiple FortiMail 7.x and 8.0 releases; Fortinet identified the issue internally and provided temporary workarounds while patches are prepared. Admins are urged to disable IBE support or block management access from the Internet and to check published IOCs and logs for signs of compromise.

🛡️ Microsoft’s 2026 Digital Defense Report warns that cybercriminals and state-sponsored actors are currently benefiting from AI faster than defenders, accelerating vulnerability discovery, malware creation, and post-compromise operations. The company notes remediation lags discovery, increasing the risk of stockpiled zero-days and rapid weaponization. Microsoft cautions that while defenders will eventually close the gap, organizations face a near-term period of elevated risk and must accelerate their responses.

🛡️ This ThreatsDay bulletin surveys a week of practical attack paths where ordinary components—caches, model inspection, compilers, and public secrets—become exploitable. It highlights criminal campaigns from Tren de Aragua ATM jackpotting to blockchain dead drops, new EDR evasion and cache poisoning techniques, model inspection code execution, and AI‑enabled automation that accelerates vulnerability discovery. The report stresses that modest assumptions about what is "ordinary" are driving many compromises.

🔒 Cisco has released an urgent advisory for CVE-2026-76504, a critical (CVSS 9.8) authentication bypass in Cisco Catalyst SD-WAN Manager that is being actively exploited. The flaw stems from improper URI encoding handling in API session authentication, allowing unauthenticated remote attackers to gain admin-level access. Cisco and CISA urge immediate upgrades to fixed releases; no practical workaround exists, and cloud-hosted mitigations have been deployed but require customer validation.

🔒 Cisco fixed a critical flaw in Cisco Catalyst SD‑WAN Manager that let attackers bypass authentication via improperly handled URI encoding in HTTP requests. The vulnerability, tracked as CVE-2026-76504 with a 9.8 CVSS score, could grant administrative API privileges without credentials. Cisco has patched cloud-managed systems and released fixes for affected on‑prem releases; there is no workaround, so restricting access until upgrades are applied is advised.

🔐 Bitget confirmed attackers exploited a zero-day vulnerability in third-party security products to steal $387.5 million from its hot and warm wallets, according to a SlowMist investigation. The breach, disclosed on September 24, 2026, allowed attackers to obtain high-level credentials, bypass risk controls, and initiate fraudulent withdrawals across 11 blockchains. Bitget disabled the affected functionality and notified the vendor while freezing some assets.

🔒 The Dutch Institute for Vulnerability Disclosure (DIVD) reports its network was compromised via a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system. The attacker used an autonomous AI agent to perform session hijacking, remote code execution, and privilege escalation to root in seconds. DIVD, working with Merlon Security, advised users to upgrade to version 7 or take instances offline while investigations continue.

🔒 CISA has issued an alert about a critical pre-authentication vulnerability (CVE-2026-84411) in MikroTik RouterOS that can lead to remote code execution or denial of service. The flaw is an integer underflow in the web-management HTTP request handling and can be triggered by a single crafted request to achieve root-level code execution. Affected RouterOS releases are reported to be below 7.24, and MikroTik recommends updating to 7.23 or later; the vendor has not yet published its own advisory.

🛡️ Cisco warned on September 30 that attackers are actively exploiting a critical zero‑day, CVE‑2026‑76504, in Catalyst SD‑WAN Manager that allows unauthenticated API access as the admin user. The flaw, tied to mishandled URI encoding in session login requests, scored 9.8/10 and has fixed releases available across affected release trains. Cisco confirmed active exploitation and advised upgrades; no workaround exists and internet‑exposed Managers are at highest risk.

🔒 Cisco released updates to address a critical zero-day in the Catalyst SD-WAN Manager (CVE-2026-76504) that is being actively exploited to gain admin privileges. The flaw affects API session-based authentication and allows unauthenticated remote access by bypassing an authentication rule via improper URI encoding. Cisco published IOCs and log locations for detection and urged customers to upgrade to fixed releases or open TAC cases for investigation. Multiple fixed releases are listed for affected versions.

🔒 Apple has released a security update addressing CVE-2026-86950, a zero-day in the CoreGraphics rendering framework that Meta Product Security reported. The company said processing a maliciously crafted file could allow arbitrary code execution and that the flaw may have been exploited in an “extremely sophisticated” attack targeting specific individuals. Affected devices include recent iPhones, various iPad models and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1. Apple fixed the issue in iOS 26.7.1, iPadOS 26.7.1 and the noted macOS builds.