All news with #zero day exploitation tag

📱 Researchers at security firm Calif created a worm that hijacks WeChat accounts via an incoming call and demonstrated it spreading across three test phones without user interaction. The attacker must already be one of the victim's WeChat contacts, and Calif says Tencent blocked the exploit on its servers after being notified in July. Calif withheld technical details pending a conference presentation and reported using AI to help locate the flaw and build the initial exploit.

🛡️ Adobe has released emergency patches addressing a maximum-severity zero-day, CVE-2026-75650, actively exploited in Adobe Commerce and Magento Open Source. Sansec dubbed the flaw "StyleSmuggler" after detecting exploitation beginning September 4, 2026. The vulnerability enables PHP code injection via Magento's template system to generate a malicious email and achieve remote code execution. A VULN-39341 hotfix and encryption key rotation are required to remediate affected versions.

🛡️ This week’s recap highlights active zero-days, credential‑stealing supply‑chain code, and novel attack vectors that bypass simple user precautions. Notable incidents include an actively exploited Chrome V8 zero-day, MikroTik RouterOS exploit chains dubbed "MikroTrick," and a Magento/Adobe Commerce zero-day called StyleSmuggler used to backdoor storefronts. The briefing summarizes patches, observed exploitation activity, and trending CVEs to prioritize.

🛡️ A security researcher known as “Nightmare Eclipse” published a GitHub proof-of-concept on September 3 for a zero-day privilege escalation called FalconFlank that targets CrowdStrike Falcon Sensor. The exploit abuses the Microsoft Office file malicious macro remediation feature and reportedly works on fully updated Windows 11 25H2 and Windows Server 2025 when specific CrowdStrike settings are enabled. CrowdStrike advised customers to disable the Microsoft Office File Suspicious Macro Removal policy while it investigates and referenced a customer-only tech alert. No CVE has been assigned yet, and the researcher has also published other vendor zero-days previously.

🛡️ An anonymous researcher called "Nightmare Eclipse" released a zero-day named FalconFlank that escalates privileges on fully patched Windows 11 and Windows Server systems by abusing CrowdStrike Falcon's Office malicious macros remediation. Successful exploitation spawns a command prompt with SYSTEM privileges, and CrowdStrike is investigating while advising customers to disable the Microsoft Office File Suspicious Macro Removal policy. The advisory is available to customers via the CrowdStrike support portal only.

🔒 Google released an urgent Chrome update to fix an actively exploited high-severity zero-day (CVE-2026-85046) in the V8 JavaScript engine along with 11 other vulnerabilities across Windows, macOS, and Linux. The type confusion bug, reported by researcher Salvatore Gulizia (“Serotav”), can be triggered by crafted web content and may lead to remote code execution within Chrome’s sandboxed renderer. Google withheld technical exploit details while rolling out Chrome 152.0.7977.82/.83 to give users time to update; a restart is required once the update downloads.

🔒 Google released security updates fixing 12 Chrome vulnerabilities, including an actively exploited high-severity V8 type confusion bug (CVE-2026-85046) with a CVSS of 8.8. Researcher Salvatore Gulizia (Serotav) reported the flaw on August 4, 2026, and received a $1,000 bounty. Google confirmed exploits exist in the wild and urges users to update Chrome to 152.0.7977.82/.83 on supported platforms. Other Chromium-based browser users should apply vendor fixes when available.

🛡️ A forensic investigation by Citizen Lab and the SHARE Foundation found high-confidence indicators that a member of Serbia's student protest movement was infected with NSO Group's Pegasus spyware via an iMessage zero-click exploit. The infection indicators spanned December 2025 and January 2026, and the attack method is believed to have been patched in iOS 18.4.1. The case is part of broader documented targeting of Serbia's civil society ahead of key 2026 elections, with recommendations that notification recipients seek expert assistance and enable protective measures.

🛡️ A decade-old vulnerability in PostgreSQL’s logical replication can let low-privilege REPLICATION accounts load and execute arbitrary code, potentially escalating to superuser and full server compromise. Cyera Research named the issue PostGREShell and reported it to the PostgreSQL Security Team; patches were issued in August for supported releases including 18.6, 17.11, 16.15, 15.19, and 14.24. Windows systems are especially exposed due to UNC/SMB loading vectors. Administrators are urged to patch, audit replication accounts, and restrict outbound SMB/NFS access.

🔍 The Citizen Lab and SHARE Foundation found that an iPhone linked to Serbia's student protest movement was infected via an iMessage zero-click exploit delivering NSO Group's Pegasus spyware. Analysis showed high-confidence indicators of infection between December 2025 and January 2026, and Apple addressed the exploited vulnerability in iOS 18.4.1. Multiple activists, politicians and students in Serbia have been targeted with advanced spyware amid the 2026 election period.

🔒 A security researcher known as Chaotic Eclipse released a zero-day PoC called FalconFlank that enables local privilege escalation by abusing CrowdStrike Falcon's office malicious macros remediation. The researcher says the exploit works on fully updated Windows 11 25H2 and Windows Server 2025 systems with Falcon installed, and cautions defenders may need to add exclusions or obfuscate detection to test it. This release follows recent PoCs targeting Kaspersky and Microsoft Defender, with the researcher criticizing vendor engagement.

🔒 SonicWall released hotfixes for two critical vulnerabilities in its Secure Mobile Access (SMA) 1000 series appliances after confirming active exploitation. The flaws — a pre-authentication SSRF (CVE-2026-83548) and a post-authentication command injection (CVE-2026-83549) — affect SMA 6210, 7210, and 8200v on older platform-hotfix builds. SonicWall recommends upgrading to the latest fixes, searching for IoCs, and re-imaging or resetting credentials if compromises are detected.

🛡️ SonicWall has disclosed two zero-day vulnerabilities affecting SMA1000 appliances (models 6210, 7210 and 8200v), with impacted firmware versions 12.4.3-03453 and 12.5.0-02835 (platform-hotfix) and older. The more severe issue, CVE-2026-83548, is a pre-authentication SSRF in the Appliance Work Place interface with a CVSS score of 10.0, while CVE-2026-83549 is a post-authentication RCE in the Management Console (CVSS 7.8). SonicWall advises upgrading to the latest hotfix, contacting Technical Support to hunt for IoCs, and re-imaging or redeploying appliances and resetting credentials if compromises are found.

🛡️ SonicWall warned customers that attackers are chaining two newly discovered SMA1000 zero-day vulnerabilities to achieve remote code execution. The first is a critical command injection flaw (CVE-2026-83548) tied to an SSRF issue in the Appliance WorkPlace, while the second (CVE-2026-83549) affects the Management Console and requires admin privileges. Affected models include SMA1000 6210, 7210, and 8200v; SonicWall urges immediate hotfix upgrades and recommends re-imaging and credential resets if compromise is suspected.

🛡️ Two recently patched vulnerabilities in PaperCut NG and MF print management software, tracked as CVE-2026-81578 and CVE-2026-82078, are being abused in live data theft campaigns. PaperCut issued emergency patches and IOCs after confirming exploitation, while defenders report attackers dumping Derby database tables rather than pursuing public RCE paths. Shadowserver currently tracks over 800 exposed servers, and the vendor has not yet attributed the intrusions.

🚨 PaperCut warned customers that attackers are actively exploiting a zero-day affecting all versions of PaperCut NG and PaperCut MF. The vendor issued emergency patches for v25 and v26 and confirmed known customer incidents while an investigation continues. Indicators include suspicious post-exploitation activity by "pc-app.exe," missing or truncated server.log files, and specific error entries such as ERROR No suitable driver found for jdbc:no:x. Users with internet-exposed PaperCut servers are urged to immediately restrict access to trusted IPs and apply network controls.

🛡️A chain of six vulnerabilities in the Avada WordPress theme and Fusion Builder plugin allows an unauthenticated attacker to execute arbitrary PHP code via a zero-click exploit. Tracked as CVE-2026-18431 with a 9.8 score, the attack requires a precise sequence of authorization, input-validation, trust-boundary, and file-handling failures. ThemeFusion released patches in Avada 7.16.1 and Fusion Builder 3.16.1 after disclosure by Wordfence, which withheld full details to allow administrators time to update.

🛡️ A vulnerability in Nvidia's NemoClaw can let a malicious website trick a browser into reaching a locally running Ollama model server via DNS rebinding, giving unauthenticated API access. Cyera researchers showed an attacker could modify a model's chat template to inject persistent, hidden instructions that survive future sessions. Nvidia has patched macOS and Linux builds in NemoClaw 0.0.35, while Windows/WSL remains unpatched.

🔒 CISA has added a maximum-severity vulnerability affecting Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in (CVE-2026-21962, CVSS 10.0) to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The flaw allows unauthenticated HTTP access to create, modify, or delete critical data and potentially gain full access to affected instances. Oracle released patches in January, but reports from GreyNoise and CloudSEK indicate ongoing exploitation activity. Federal agencies must remediate under BOD 26-04 by August 27, 2026.

🛡️ CERT Polska warns that attackers are actively exploiting a critical Zimbra Collaboration Suite vulnerability (CVE-2026-73570). The flaw, patched in Zimbra 10.1.20 on July 20, enables unauthenticated remote code execution via command injection in the SNMP notification processing when SNMP notifications are enabled. Shadowserver reports over 12,100 Zimbra servers exposed online, and administrators are urged to check logs and specific directories for signs of compromise. Zimbra has been a frequent target of APT groups in past campaigns.