CVEs, zero-days, PoCs, patch advisories
RSS feed for this categoryResearchers at Xbow USA utilized AI compute time costing $40,000 to discover a chain of vulnerabilities in Google Chrome. These flaws allowed them to escape Chrome's sandbox environments and launch a Windows application from a malicious webpage. Google has since fixed these vulnerabilities.
This article highlights several cybersecurity incidents and developments, including an ICS-Sniper attack, the hacking of XWorm malware operators, and a $250,000 Chrome exploit. It also briefly mentions other stories like Bank of America hiring patching contractors, a RAT named KGB RAT that combines data theft with jump scares, and an attack on a Langflow flaw.
A significant vulnerability dubbed PwnEscape (CVE-2026-99999) was discovered in the Linux kernel's networking stack, allowing attackers within a virtual machine to achieve guest-to-host escapes. The flaw, found during Vercel's Sandbox security challenge, could lead to host-level code execution. The issue has since been resolved with multiple stable-branch Linux kernel fixes.
A Chinese Advanced Persistent Threat (APT) group, identified as Armory Castle, has exploited a zero-day vulnerability in BeyondTrust's Privilege Manager. This exploitation was used for initial access, after which the group deployed custom tools and attempted to cover their tracks by deleting logs and artifacts.
A critical zero-day vulnerability, CVE-2026-102764, in BeyondTrust Remote Support has been exploited by a suspected Chinese espionage group, ARMORY CASTLE. The vulnerability allows unauthenticated attackers to gain root control and access credential vaults on self-hosted appliances. BeyondTrust has released a patch, urging immediate application by affected organizations.
F5 and Juniper Networks have released patches for critical vulnerabilities affecting their network devices. Successful exploitation of these flaws could allow attackers to achieve remote code execution and gain full control over compromised devices.
Microsoft has released patches for two dozen critical Remote Code Execution (RCE) vulnerabilities in its Office suite. The updates also address multiple information disclosure bugs and a security bypass flaw.
A China-linked hacking group, Armory Castle, exploited a zero-day vulnerability in BeyondTrust Remote Support in late August 2026. The vulnerability, CVE-2026-102764, with a CVSS score of 9.3, allowed attackers to take control of remote support servers.
BeyondTrust has released a patch for a critical zero-day vulnerability in its Remote Support (RS) software. This vulnerability has been actively exploited in attacks since August. Customers are urged to update their systems immediately to mitigate the risk.
A new memory-resident ARM64 malware called PEERSTITCH is being deployed by exploiting a path traversal vulnerability (CVE-2025-61624) in Fortinet's FortiOS. This vulnerability allows attackers to bypass security checks on tagged VPN sessions, granting them unauthorized access.
A security report from HiddenLayer argues that TypeSafe's new Jev model, categorized as 'System One' rather than a traditional LLM, is more susceptible to certain attacks like adversarial text and prompt injection. While TypeSafe claims Jev offers advantages in speed and efficiency for machine-to-machine interactions, researchers suggest its streamlined approach lacks the inherent safeguards found in LLMs, making it vulnerable to exploits that current LLMs would typically detect.
Threat actors are exploiting a critical remote command execution vulnerability, CVE-2026-110447, in the Collabora Online app for Nextcloud. This allows attackers to backdoor Nextcloud servers, potentially leading to further compromise.
A critical vulnerability, dubbed PwnEscape (CVE-2026-99999), has been discovered in the Linux kernel that allows code running within a virtual machine to read memory from the host system. A researcher successfully demonstrated this exploit against Vercel's cloud sandboxes, and the company has confirmed the issue.
This article highlights various cybersecurity threats, including a self-healing backdoor designed to scare victims, a tool that steals data, and vulnerabilities in Adobe products, DNS, and NVIDIA containers. It also touches upon the risks associated with seemingly minor permission issues and trusted logins being compromised.
A threat actor has uploaded malicious packages to the Arch User Repository (AUR), impersonating popular Arch Linux helper tools like `yay` and `paru`. These fake packages, when installed, have been observed pushing malware with root privileges, posing a significant risk to users.
NGINX has released updates (versions 1.30.6 and 1.31.7) to address five vulnerabilities. Among these are three memory bugs that could lead to worker process crashes or potential remote code execution, and a TLS bug that might bypass client certificate checks.
Cisco has issued a warning about a critical vulnerability in its Secure Email Gateway product, tracked as CVE-2026-76519. The flaw allows attackers to write arbitrary files to the underlying operating system and execute commands with root privileges, and is actively being exploited in the wild. Cisco has released software updates to address the issue, but no workarounds are available.
Next.js has released an out-of-band security update to address two critical remote code execution (RCE) vulnerabilities. One flaw exists in React Server Components, and the other is in the librsvg library used for SVG image processing.
Drupal has released patches for a critical Remote Code Execution (RCE) vulnerability in its Field UI module. The flaw, which can be exploited by an attacker without requiring login credentials through certain contributed modules, allows for arbitrary code execution on the server.
CISA has added a new vulnerability, CVE-2026-21589 affecting Atlassian products, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This addition emphasizes the importance of timely patching for federal agencies under Binding Operational Directive (BOD) 26-04, which mandates prioritization of vulnerabilities listed in the KEV Catalog.
Thermo Fisher Torrent Suite Software versions less than or equal to 5.18 are affected by a path traversal vulnerability. Successful exploitation allows an authenticated attacker to read arbitrary files on the Torrent Server.
Multiple vulnerabilities have been identified in Guangzhou Juan IoT Technology's EseeCloud App and Firmware, specifically versions <=4.9.6 and <=4.9.86.0, respectively. Successful exploitation of these vulnerabilities, including the use of hard-coded credentials, could allow an attacker to gain control over affected IP cameras.
Multiple vulnerabilities have been identified in J4Care dcm4chee-arc-light versions prior to 5.35.2, potentially allowing attackers to delete medical images, expose patient data, and inject forged studies. Successful exploitation could lead to significant data compromise and service disruption within healthcare systems worldwide. J4Care has released version 5.35.2 to address these security flaws.
CISA has issued an alert regarding multiple vulnerabilities in Eclipse Foundation's Eclipse Milo software, specifically versions 0.6.0 through 1.1.4. Successful exploitation could lead to data deletion, credential theft, or denial-of-service conditions.
CISA has identified multiple vulnerabilities in CISA Malcolm, specifically affecting versions prior to v26.08.0. These vulnerabilities include authentication bypass, SSRF, and CSRF, which could allow unauthenticated attackers to access sensitive data or execute unauthorized actions. A patch is available in Malcolm Version v26.08.0.
Attackers are actively exploiting a critical vulnerability (CVE-2026-0322) in Palo Alto Networks' PAN-OS software, allowing for arbitrary code execution with root privileges. The US Cybersecurity and Infrastructure Security Agency (CISA) has added this flaw to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch it by October 17, with requirements for forensic triage to detect prior compromise.
A critical authenticated Remote Code Execution (RCE) vulnerability, CVE-2026-105740, has been identified in Langflow, an open-source AI application development platform. Threat actors have already attempted to exploit this flaw in over 1,400 honeypot instances.
Hundreds of European grocery stores experienced significant financial losses due to unpatched firmware in their refrigeration systems. These outdated Operational Technology (OT) systems were managed by third-party providers, highlighting a critical security oversight.
Palo Alto Networks has released a patch for a zero-day vulnerability in its PAN-OS software that was being actively exploited by attackers. The vulnerability allows for remote code execution on customer firewalls, and the company has provided indicators of compromise (IoCs) to help customers detect exploitation.
Ahsay Backup has released updated security patches for two critical vulnerabilities (CVE-2026-105133 and CVE-2026-105134) in its AhsayCBS software. These flaws were exploited by attackers to deploy web shells and XMRig cryptocurrency miners, allowing for arbitrary command execution after bypassing authentication.
Cisco has issued a warning about a vulnerability in its Secure Email Gateway that is being actively exploited by attackers. Unauthenticated, remote attackers can exploit this flaw to write arbitrary files to the operating system and execute commands with root privileges.
Palo Alto Networks has released security updates for a critical remote code execution (RCE) vulnerability in its PAN-OS software. The flaw, identified as CVE-2026-0322, has a CVSS score of 8.6 and is actively being exploited by attackers. The vulnerability allows for code execution through the management interface.
Atlassian products, including Bitbucket, Confluence, and Jira, are affected by a vulnerability that allows unauthenticated attackers to access specific files within the web application root directory. This flaw could expose sensitive information to external parties.
Palo Alto Networks has issued a warning about a critical zero-day vulnerability in their PAN-OS software, identified as CVE-2026-0322. This remote code execution (RCE) flaw is being actively exploited in attacks against their firewalls.
Cisco is facing an actively exploited zero-day vulnerability in its email software. The bug, dubbed 'make-me-root', allows attackers to gain root access to affected systems. Both Cisco and CISA have issued warnings about the ongoing exploitation.
A security vulnerability in refrigerators has led to significant financial losses and sparked fires across 700 supermarkets. The incident was caused by outdated devices that were improperly exposed to the internet.
A zero-day vulnerability, CVE-2026-104935, in Ivanti products allowed for authentication bypass and remote code execution. Threat actors exploited this vulnerability, which was only partially patched in July, highlighting challenges in vendor patching processes for industrial control systems (ICS).
A vulnerability in Anthropic's Claude Code Desktop allows attackers to steal developer credentials, including SSH private keys, AWS credentials, and Claude 0Auth tokens, through a silent zero-click exploit. This flaw leverages the preview pane functionality to exfiltrate sensitive information without user interaction.
Security researchers, operating under the alias Xbow, successfully discovered and exploited a vulnerability in Google Chrome that affected over one billion users. This significant finding resulted in the researchers receiving a substantial bug bounty of $250,000.
Cisco has issued a warning about active attacks exploiting a critical vulnerability in their Secure Email Gateway. This flaw allows an unauthenticated attacker to write files to the appliance's operating system by sending a crafted email attachment. Successful exploitation could enable attackers to execute commands with root privileges.
Attackers have exploited a critical vulnerability in the Collabora Online - Built-in CODE Server app, an optional component for Nextcloud, to gain unauthorized access and install web shells on affected servers. The first reported attack occurred on September 10th, and the vulnerability allows attackers to execute commands with the privileges of the web server account.
Cisco has released a patch for a critical zero-day vulnerability in its Secure Email Gateway (SEG). This flaw allows unauthenticated remote attackers to execute commands with root privileges on vulnerable systems.
Ivanti has released a patch for a zero-day vulnerability in its Connect Secure product, which had been confirmed to be exploited in the wild. The company also stated that a fix for a separate privilege-escalation flaw will be available in the coming weeks.
Siemens has released 17 new security advisories as part of its latest ICS Patch Tuesday updates. Additionally, Rockwell has issued a fix for a critical vulnerability affecting its ArmorBlock devices that could allow for unauthorized takeover.
Researchers at Noma Security have discovered a vulnerability in Anthropic's Claude Code Desktop app called SneakPeek. This flaw allows malicious JavaScript embedded in HTML files to execute automatically, potentially exposing sensitive developer information such as cloud credentials and secrets to attackers.
CISA has issued a warning to administrators, urging them to immediately patch a vulnerability in Ivanti Connect Secure (ICS). This flaw has been actively exploited in zero-day attacks since at least October 1st.
CISA has issued an urgent directive for organizations to update their Ivanti Connect Secure appliances due to an actively exploited authentication bypass vulnerability. The flaw, identified as CVE-2026-104935 with a CVSS score of 8.6, has already been observed in 105 exploit attempts logged by honeypots.
A critical vulnerability in curl's HTTP/2 upload handling allows a malicious server to corrupt the client's memory, potentially leading to client-side code execution. The curl project has released a patch for this flaw in version 8.23.0, although exploiting it requires precise knowledge of the client's build and memory layout, with exploits typically resulting in a crash.
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. These vulnerabilities include code injection and command injection flaws in Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS. The additions underscore the importance of CISA's Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize the remediation of high-risk, exploited vulnerabilities.
Attackers are exploiting an authentication bypass vulnerability (CVE-2026-104935) in Ivanti Connect Secure appliances, allowing them to gain access without legitimate accounts. The flaw enables arbitrary command execution on compromised devices, and CISA has added it to its Known Exploited Vulnerabilities catalog.
