Tag: zero-day
-
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs
-
Prolific Chinese espionage group exploits BeyondTrust zero-day
Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers. First seen on cyberscoop.com Jump to article: cyberscoop.com/china-espionage-attacks-beyondtrust-zero-day-armory-castle/
-
China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign
Researchers say the hacker is harvesting credentials and stealing sensitive information. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/china-espionage-beyondtrust-zero-day-hacker/833240/
-
Zero-Day in BeyondTrust Remote Support Appliances Exploited
‘Patch ASAP’ Before Fix Gets Reverse-Engineered by Other Attackers, Expert Warns. All self-hosted BeyondTrust Remote Support appliance users are being urged to immediately patch a bug that an advanced persistent threat group tied to China, which specializes in hacking edge devices. Its been exploiting since late August as a zero-day vulnerability to steal credentials and…
-
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
An alleged Chinese state-backed group is using a new zero-day affecting BeyondTrust IT support software to conduct espionage attacks. First seen on therecord.media Jump to article: therecord.media/beyond-trust-cyberattack-china
-
Warnung des BSI: Angriffe auf Zero-Day-Lücke in Cisco Secure Email Gateway
Der Malware-Scanner von Ciscos Secure Email Gateway reagiert fehlerhaft auf speziell gestaltete E-Mails. Hacker erhalten so Root-Rechte. First seen on golem.de Jump to article: www.golem.de/news/warnung-des-bsi-angriffe-auf-zero-day-luecke-in-cisco-secure-email-gateway-2610-214183.html
-
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
A suspected China-nexus espionage group exploited a critical zero-day in BeyondTrust Remote Support, tracked as CVE-2026-102764. It then deleted logs to hide its activity. BeyondTrust patched the flaw in advisory BT26-05 and disclosed it on October 15, 2026, alongside a Mandiant analysis. BeyondTrust zero-day According to research published by BeyondTrust, the actor exploited the vulnerability…
-
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be…
-
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/
-
Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access
A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability as a zero-day in late August 2026 weeks before BeyondTrust disclosed it on October 15. Mandiant, which investigated the incident, found the attackers used the flaw to upload a file, then built a path from an unprivileged web service account to root access,…
-
Palo Alto Warns of PAN-OS 0-day Flaw Actively Exploited in Attacks
Palo Alto Networks has warned that attackers are exploiting a high-severity remote code execution flaw in the PAN-OS management interface. Tracked as CVE-2026-0322, the bug lets an authenticated attacker with network access run arbitrary code with root privileges on the firewall. PAN-OS zero-day vulnerability The flaw is a code injection weakness (CWE-94, CAPEC-242) in the…
-
Cisco Warns of Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks
Cisco has warned that attackers are actively exploiting a zero-day flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. An unauthenticated remote attacker can use it to write arbitrary files and run commands as root on the underlying operating system. The advisory, cisco-sa-esa-afw-zqYJkjxp, says Cisco PSIRT learned of active exploitation in…
-
Unsichtbare Angriffe, neue Abwehrstrategien – Zero Day und LOTL: Warum Telkos jetzt umdenken müssen
First seen on security-insider.de Jump to article: www.security-insider.de/zero-day-exploits-lotl-angriffe-ki-telekommunikationssicherheit-a-9e220ad87a70f9b653a0c8df34a8204a/
-
Unsichere Firewall: Palo Alto Networks warnt vor Angriffen auf Zero-Day-Lücke
Betroffen sind Firewalls der Serien PA und VM. Ein Angreifer kann Code mit Root-Rechten ausführen. First seen on golem.de Jump to article: www.golem.de/news/unsichere-firewall-palo-alto-networks-warnt-vor-angriffen-auf-zero-day-luecke-2610-214137.html
-
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/
-
Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles
Tags: attack, authentication, cve, ivanti, rce, remote-code-execution, threat, update, vulnerability, zero-dayCVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/ivanti-ics-zero-day-attacks-vendor-patching
-
Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities
In its October Patch Tuesday, the tech giant addressed more defects in one month than any annual total on record. Nearly 4 in 5 vulnerabilities affect Windows. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-patch-tuesday-october-2026/
-
Cisco patches new Secure Email Gateway zero-day exploited in attacks
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/
-
Microsoft Patch Tuesday Fixes 1,413 Flaws: Windows Zero-Day Already Under Attack
Microsoft’s October 2026 Patch Tuesday fixes 1,413 vulnerabilities, including an exploited Windows zero-day and critical Outlook security flaws. The post Microsoft Patch Tuesday Fixes 1,413 Flaws: Windows Zero-Day Already Under Attack appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-october-2026-patch-tuesday/
-
Microsoft Patch Tuesday Sets New Record with 1,415 CVEs in October 2026 Updates
Microsoft Patch Tuesday security updates for October 2026 address a record 1,415 vulnerabilities. Prioritize the exploited zero-day, critical bugs and potentially wormable vulnerabilities. Microsoft just shattered every patch record in the book. October 2026 brought us a staggering 1,415 new CVEs from Microsoft alone. >>Well, it’s a new record release from Microsoft, again. This is…
-
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-day/
-
Patchday Oktober 2026: Microsoft und Adobe sprengen alle Rekorde
Microsoft Patchday Oktober 2026: 1.415 CVEs, 174 Adobe-Schwachstellen und eine aktive Zero-Day-Lücke. Die wichtigsten Risiken und Updates. Dustin Childs, Head of Threat Awareness, analysiert die veröffentlichten Security Updates First seen on infopoint-security.de Jump to article: www.infopoint-security.de/patchday-oktober-2026-microsoft-und-adobe-sprengen-alle-rekorde/a46749/
-
Patchday Oktober 2026: Microsoft und Adobe sprengen alle Rekorde
Microsoft Patchday Oktober 2026: 1.415 CVEs, 174 Adobe-Schwachstellen und eine aktive Zero-Day-Lücke. Die wichtigsten Risiken und Updates. Dustin Childs, Head of Threat Awareness, analysiert die veröffentlichten Security Updates First seen on infopoint-security.de Jump to article: www.infopoint-security.de/patchday-oktober-2026-microsoft-und-adobe-sprengen-alle-rekorde/a46749/
-
Patchday Oktober 2026: Microsoft und Adobe sprengen alle Rekorde
Microsoft Patchday Oktober 2026: 1.415 CVEs, 174 Adobe-Schwachstellen und eine aktive Zero-Day-Lücke. Die wichtigsten Risiken und Updates. Dustin Childs, Head of Threat Awareness, analysiert die veröffentlichten Security Updates First seen on infopoint-security.de Jump to article: www.infopoint-security.de/patchday-oktober-2026-microsoft-und-adobe-sprengen-alle-rekorde/a46749/
-
Hackers Chain 3 Ivanti VPN Zero-Days to Gain Root Access Without Authentication
Tags: access, authentication, credentials, cyber, exploit, hacker, ivanti, network, threat, vpn, vulnerability, zero-dayAttackers chained three zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances to execute commands as root without authentication, then searched the affected network for credentials and sensitive Active Directory data. Volexity attributed the activity to an unknown threat actor it tracks as UTA0576, which repeatedly exploited an appliance running version 22.8R2.4, Build 19097 the…
-
Hackers Chain 3 Ivanti VPN Zero-Days to Gain Root Access Without Authentication
Tags: access, authentication, credentials, cyber, exploit, hacker, ivanti, network, threat, vpn, vulnerability, zero-dayAttackers chained three zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances to execute commands as root without authentication, then searched the affected network for credentials and sensitive Active Directory data. Volexity attributed the activity to an unknown threat actor it tracks as UTA0576, which repeatedly exploited an appliance running version 22.8R2.4, Build 19097 the…
-
Hackers Chain 3 Ivanti VPN Zero-Days to Gain Root Access Without Authentication
Tags: access, authentication, credentials, cyber, exploit, hacker, ivanti, network, threat, vpn, vulnerability, zero-dayAttackers chained three zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances to execute commands as root without authentication, then searched the affected network for credentials and sensitive Active Directory data. Volexity attributed the activity to an unknown threat actor it tracks as UTA0576, which repeatedly exploited an appliance running version 22.8R2.4, Build 19097 the…
-
Erneuter Rekord-Patchday mit 1.415 Microsoft-CVEs und 174 AdobeDays
Der Patchday im Oktober 2026 bricht erneut alle Rekorde: Microsoft liefert erstmals Patches für eine vierstellige Zahl an Schwachstellen aus, während Adobe 174 Sicherheitslücken in elf Bulletins schließt. Microsoft Patches für Oktober 2026 Microsoft veröffentlicht im Oktober ein Rekordvolumen: 1.415 neue CVEs erstmals eine vierstellige Zahl und damit mehr als in jedem… First seen on…
-
Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities
Tags: access, attack, credentials, detection, ivanti, monitoring, network, vpn, vulnerability, zero-dayIvanti VPN zero-days let attackers gain root access, steal credentials, evade detection, and prepare for wider network compromise. On October 5, Volexity started investigating suspicious activity at one of its monitoring customers and traced everything back to an Ivanti Connect Secure VPN appliance running version 22.8R2.4, the latest build available at the time. Three chained…
-
Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances
A threat actor has been using an exploit chain combining three vulnerabilities in Ivanti’s Connect Secure (ICS) appliances to breach organizations, collect credentials, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/14/ivanti-zero-days-gain-root-patched-vpn-appliances/