Tag: zero-day
-
D-Link warns of multiple zero-days in DGS-3130 Series switches
D-Link shared mitigation measures for multiple unpatched security flaws affecting DGS-3130 series managed Gigabit stackable switches. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/d-link-warns-of-multiple-zero-days-in-dgs-3130-series-switches/
-
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
Zyxel GS1900 network switches that received the vendor’s earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found.The exploit lets anyone who can reach a switch’s web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that…
-
Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability to Compromise Nearly 1,000 Network Switches
Tags: authentication, cyber, exploit, hacker, network, remote-code-execution, vulnerability, zero-day, zyxelAttackers used a pre-authentication remote code execution exploit against Zyxel GS1900 switches. They compromised nearly 1,000 devices before Zyxel patched the flaw. Binarly researchers found that the exploit abused a previously unknown bug, not the one Zyxel fixed in June. GreyNoise reported that around August 17, an actor exploited 996 GS1900 switches across 48 countries.…
-
Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability to Compromise Nearly 1,000 Network Switches
Tags: authentication, cyber, exploit, hacker, network, remote-code-execution, vulnerability, zero-day, zyxelAttackers used a pre-authentication remote code execution exploit against Zyxel GS1900 switches. They compromised nearly 1,000 devices before Zyxel patched the flaw. Binarly researchers found that the exploit abused a previously unknown bug, not the one Zyxel fixed in June. GreyNoise reported that around August 17, an actor exploited 996 GS1900 switches across 48 countries.…
-
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/
-
Ivanti patches two more Connect Secure zero-days chained in attacks
Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ivanti-patches-two-more-connect-secure-zero-days-chained-in-attacks/
-
Hackers Exploit Ivanti Connect Secure Zero-Day Vulnerabilities to Gain Root Access and Steal Credentials
Hackers exploited a chain of zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances, allowing them to execute commands with root access, steal credentials, and probe internal networks. Volexity has identified the unknown attacker as UTA0576 and traced the exploitation back to October 3, 2026, targeting an appliance that was fully patched at the time.…
-
Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls
China-nexus threat actors have exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the >>Fragnesia<< Linux kernel bug to root … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/29/php2shell-fragnesia-vmware-esx-zero-day/
-
Chinese Hackers Exploit VMware ESXi Zero-Day to Target Law Firms in Cyber Espionage Attacks
Chinese state-linked hackers have exploited a zero-day vulnerability in VMware ESXi during espionage operations aimed at U.S. law firms, according to CrowdStrike’s latest assessment of threats affecting the legal sector. The activity is attributed to WARP PANDA, a China-nexus adversary that deployed malware in victims’ VMware vCenter environments. This series of intrusions, which continued into…
-
New Cisco firewall zero-day exploited to crash SSL VPN devices
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/
-
Volt Typhoon Used Silent Train to Hide Zero-Day Attacks
Volt Typhoon used disposable relay chains to hide zero-day attacks on critical systems. Lumen linked Silent Train to at least four zero-days. Lumen’s Black Lotus Labs has spent three years tracking a covert network it calls Silent Train, which it ties to Volt Typhoon, the China-linked APT group. The cybersecurity firm says the network hid…
-
Volt Typhoon Hackers Exploit Multiple Zero-Days to Breach U.S. Critical Infrastructure Networks
Tags: access, breach, china, cyber, data-breach, exploit, framework, group, hacker, hacking, infrastructure, network, vulnerability, zero-dayChinese state-sponsored hacking group Volt Typhoon has exploited multiple previously unknown vulnerabilities in enterprise management platforms to penetrate strategically significant organizations. Its investigation exposed Silent Train, a covert access framework built from rapidly rotating chains of compromised devices. Over three years, Black Lotus Labs issued hundreds of victim notifications, helping investigations uncover four confirmed zero-day…
-
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
Tags: attack, china, crowdstrike, cve, cybersecurity, exploit, flaw, hacker, infrastructure, kev, threat, vmware, vulnerability, zero-dayThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Warp Panda in attacks targeting the U.S. legal sector.The vulnerability in question is CVE-2026-41709 (CVSS…
-
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
Tags: attack, china, crowdstrike, cve, cybersecurity, exploit, flaw, hacker, infrastructure, kev, threat, vmware, vulnerability, zero-dayThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Warp Panda in attacks targeting the U.S. legal sector.The vulnerability in question is CVE-2026-41709 (CVSS…
-
Security Researchers Demonstrate Chrome Sandbox Escapes, Telegram Zero-Click Attacks and iOS Zero-Day Research
Security researchers at OffensiveCon Japan 2026 explored topics including Chrome sandbox escapes, zero-click attack surfaces in Telegram, and newly discovered iOS zero-day vulnerabilities. This two-day program took place on October 2728. The published agenda also covered hypervisor exploitation, Windows privilege escalation, Linux kernel techniques, and AI-assisted security research. However, session titles alone do not indicate…
-
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access.”First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure,” Lumen Technologies Black Lotus Labs said…
-
Volt Typhoon hides zero-day attacks using ‘Silent Train’ framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/
-
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week.Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its…
-
Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in “extremely sophisticated” targeted attacks on iOS devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/apple/apple-backports-coregraphics-zero-day-patches-to-older-iphones/
-
OpenAI AI Agents Exploit Zero-Day Vulnerabilities to Escape Sandboxes and Access Host Systems
OpenAI disclosed that its AI agents escaped hardened virtual machines, bypassed network restrictions, and exchanged information across isolated environments during an internal red-teaming campaign. Published October 23, the findings describe weaknesses in frontier-model research infrastructure, not demonstrated compromises of customer-facing products. The company said it patched discovered vulnerabilities and strengthened containment before resuming frontier training.…
-
Critical Unpatched Linux Kernel Vulnerabilities Accidentally Disclosed, Including Two Remote Code Execution Flaws
In October, several unpatched Linux vulnerabilities were disclosed on public mailing lists, revealing technical details before fixes were widely available. These disclosures included two critical flaws in KSMBD that could let remote attackers execute code, along with reports of privilege escalation and information disclosure. Trend Micro’s Zero Day Initiative (ZDI) submitted the reports, prompting Linux…
-
Authentication Bypass – Spionageakteur nutzt Zero Day in Beyondtrust Remote Support aus
First seen on security-insider.de Jump to article: www.security-insider.de/beyondtrust-remote-support-zero-day-cve-2026-102764-patch-a-f94ff585b332b8ae53bd55ab13024859/
-
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over…
-
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Linux servers running KSMBD, the kernel’s built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro’s Zero Day Initiative, with no fix yet in the mainline kernel.One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an…
-
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/
-
Mögliche Zero Days – Zwei kritische PHP-Schwachstellen bedrohen Millionen Webseiten
First seen on security-insider.de Jump to article: www.security-insider.de/kritische-php-schwachstellen-behoerden-offline-a-607c4678fa935b333a4c48f8efaca22e/
-
Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP
Tags: authentication, control, data-breach, exploit, flaw, Internet, update, vulnerability, zero-dayInternet-Facing Systems Now Under Attack; PHP Team Promises Imminent Patch Release. Attackers are exploiting one or more zero-day vulnerabilities in PHP after details of the bugs leaked in advance of patches being released. The flaws can be remotely exploited without authentication to take control of servers that run PHP, which is widely used across numerous…
-
âš¡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
The worst problems don’t always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done.This week had plenty of that. Trusted connections became a problem. Hardware wasn’t as safe as…
-
Mark of the Web umgangen – Angreifer nutzen Zero Day in der Windows Shell aus
First seen on security-insider.de Jump to article: www.security-insider.de/windows-shell-luecke-motw-bypass-cve-2026-96951-a-e33cac40af2607992b72360e31b81ba4/