Tag: zero-day
-
New GitHub Zero-Day Exposed Developer Tokens to Attackers
A github.dev flaw could let attackers steal GitHub OAuth tokens through a one-click attack, exposing private repositories and codebases. The post New GitHub Zero-Day Exposed Developer Tokens to Attackers appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-github-dev-vscode-webview-oauth-token-vulnerability/
-
Comodo Internet Security 0-Day Flaw Triggers Windows System Crashes
A remotely exploitable zero-day vulnerability in Comodo Internet Security’s kernel-level firewall driver allows attackers to crash Windows systems with a single IPv6 packet, and the vendor has yet to respond. Security researcher Marcus Hutchins publicly disclosed a critical zero-day vulnerability in Comodo Internet Security on June 3, 2026, after multiple attempts to reach the vendor…
-
Researcher Drops a New VS Code Zero-Day After Losing Trust in Microsoft’s Disclosure Process
A researcher publicly released a VS Code exploit within hours, citing past disputes with Microsoft over bug handling. The security researcher Ammar Askar found a new serious zero-day in Visual Studio Code, told a contact at GitHub about it, and published a working exploit one hour later. >>Just by clicking a link, it’s possible for…
-
Acer Confirms Patch in Progress for Wave 7 Router 0-Day Flaw
Acer has confirmed that it is actively developing a firmware patch to address critical zero-day vulnerabilities affecting its Wave 7 routers, following responsible disclosure by an independent security researcher. According to an official advisory published on June 2, 2026, the vulnerabilities impact Acer Wave 7 devices running firmware version T7c_GBL_1.01.000055 or earlier. The flaws expose…
-
Acer addresses critical zero-day vulnerabilities in Wave 7 routers
First seen on scworld.com Jump to article: www.scworld.com/brief/acer-addresses-critical-zero-day-vulnerabilities-in-wave-7-routers
-
Apple’s 2026 Security Events: iPhone Exploits, Zero-Days Put Millions at Risk
Apple’s 2026 security year includes zero-days, iPhone exploit kits, WebKit fixes, and background patches that users and IT teams need to track. The post Apple’s 2026 Security Events: iPhone Exploits, Zero-Days Put Millions at Risk appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-apple-security-roundup-june-2026/
-
Acer working to patch max severity zero-days in Wave 7 routers
Acer is working to address two maximum-severity zero-day vulnerabilities affecting its Wave 7 mesh routers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/acer-warns-of-max-severity-zero-days-affecting-wave-7-routers/
-
Beyond the Zero-Day: See Your Network Like an Attacker | Webinar with HD Moore
Assume the breach. Zero-days keep shipping, AI is writing exploits faster than anyone patches, and “patch everything in time” stopped working years ago. Stop betting the org on winning that race. You don’t control which bug lands. You control what it can reach once it does.That is a question about the shape of your network,…
-
Kein Bock auf Microsoft: Forscher leakt Zero-Day-Exploit für Github-Datenklau
Microsoft hat neben Chaotic Eclipse offenbar noch einen weiteren Forscher verärgert. Der hat nun einen gefährlichen Github-Exploit veröffentlicht. First seen on golem.de Jump to article: www.golem.de/news/kein-bock-auf-microsoft-forscher-leakt-zero-day-exploit-fuer-github-datenklau-2606-209348.html
-
VS Code zero-day lets hackers steal GitHub tokens in one click
A security researcher has released exploit code for a Visual Studio Code (VS Code) zero-day vulnerability that allows attackers to steal GitHub authentication tokens by tricking users into clicking a link. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/vs-code-zero-day-lets-hackers-steal-github-tokens-in-one-click/
-
Google releases June Android security patches addressing 124 vulnerabilities, including 1 zero-day
First seen on scworld.com Jump to article: www.scworld.com/brief/google-releases-june-android-security-patches-addressing-124-vulnerabilities-including-one-zero-day
-
Google Patches Android Zero-Day Vulnerability in June 2026 Security Update
Google’s June 2026 Android update fixes dozens of flaws, including a potentially exploited Framework vulnerability and critical system bugs. The post Google Patches Android Zero-Day Vulnerability in June 2026 Security Update appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-google-june-2026-android-security-update/
-
Google Patches Android Zero-Day Under Active Exploitation
Google has patched CVE-2025-48595, an actively exploited Android zero-day that enables privilege escalation on affected devices. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/google-patches-android-zero-day-under-active-exploitation/
-
Google fixes one actively exploited Android zero-day, 124 flaws
Google has released the June 2026 Android security patches to address 124 vulnerabilities, including one zero-day flaw exploited in targeted attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-fixes-one-actively-exploited-android-zero-day-124-flaws/
-
Android Zero-Day Vulnerability Actively Exploited in Device Takeover Attacks
Google has disclosed a critical Android zero-day vulnerability that is reportedly being actively exploited in targeted attacks, raising serious concerns about the risk of large-scale device compromise. The issue, tracked as CVE-2025-48595, was highlighted in the Android Security Bulletin for June 2026, released on June 1. Android Zero-Day Vulnerability According to Google, the vulnerability resides…
-
Microsoft’s Zero-Day Legal Threats Spark Backlash
After a disgruntled security researcher published several zero-day exploits in recent weeks, Microsoft seemingly indicated criminal charges were in order. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/microsoft-zero-day-legal-threats-backlash
-
Microsoft says it will not pursue security researchers after zero-day backlash
Microsoft said it is taking the feedback seriously, adding: “To be clear about our approach to legal matters, we have no intention to pursue action against individuals conducting or publishing their security research.” First seen on therecord.media Jump to article: therecord.media/microsoft-says-it-will-not-pursue-security-researchers-disclosure
-
KnowledgeDeliver flaw exploited as a zero-day to install web shells
Hackers exploited a critical zero-day vulnerability in a server running the KnowledgeDeliver learning management system (LMS) to deploy the Godzilla web shell. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/knowledgedeliver-flaw-exploited-as-a-zero-day-to-install-web-shells/
-
Actively exploited Trend Micro Apex One flaw gets CISA warning (CVE-2026-34926)
A relative directory path traversal vulnerability (CVE-2026-34926) in Trend Micro’s Apex One platform has been exploited in zero-day attacks, the company confirmed. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/26/actively-exploited-trend-micro-apex-one-flaw-cve-2026-34926/
-
Kinetische Angriffe auf Cloud-Infrastrukturen Die physische Dimension digitaler Resilienz
Wenn wir an Bedrohungen für digitale Infrastrukturen denken, denken wir an Ransomware, an Zero-Day-Exploits, an kompromittierte Lieferketten. Woran wir seltener denken: Sabotageakte, durchtrennte Seekabel oder in Krisengebieten sogar Drohnen und Raketen. Doch genau diese physischen Bedrohungen rücken zunehmend ins Zentrum und zwingen zu einer unbequemen Erkenntnis: Die Cloud ist kein abstrakter Raum. Sie besteht aus…
-
Github-Konto gesperrt: Streit zwischen Microsoft und Chaotic Eclipse eskaliert
Der Sicherheitsforscher Chaotic Eclipse veröffentlicht laufend neue Zero-Day-Exploits für Windows. Jetzt hat Microsoft ihn wohl richtig sauer gemacht. First seen on golem.de Jump to article: www.golem.de/news/github-konto-gesperrt-streit-zwischen-microsoft-und-chaotic-eclipse-eskaliert-2605-209024.html
-
KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike
A now-patched high-severity security flaw affecting Digital Knowledge KnowledgeDeliver, a Learning Management System (LMS) popular in Japan, was exploited as a zero-day to deliver the Godzilla web shell and ultimately facilitate the deployment of Cobalt Strike Beacon.The vulnerability, tracked as CVE-2026-5426 (CVSS score: 7.5), stems from the use of hard-coded ASP.NET machine keys, leading to…
-
KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike
A now-patched high-severity security flaw affecting Digital Knowledge KnowledgeDeliver, a Learning Management System (LMS) popular in Japan, was exploited as a zero-day to deliver the Godzilla web shell and ultimately facilitate the deployment of Cobalt Strike Beacon.The vulnerability, tracked as CVE-2026-5426 (CVSS score: 7.5), stems from the use of hard-coded ASP.NET machine keys, leading to…
-
âš¡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos
Monday recap. Same mess, new week.A sketchy dev tool got people pwned, old bugs came back from the dead, and security products somehow needed protecting from themselves. A bunch of companies spent the week checking old boxes and forgotten servers they should’ve patched years ago. Good times.Phishing crews are getting smarter too – less obvious…
-
LiteSpeed cPanel Plugin 0-Day Exploited for Server Root Access
A critical zero-day privilege escalation vulnerability in the LiteSpeed User-End cPanel plugin is being actively exploited in the wild, enabling any authenticated cPanel user to execute arbitrary scripts as root and gain full server control. Tracked as CVE-2026-48172 with a maximum CVSS score of 10.0, the flaw has been patched as of May 21, 2026. The root cause is a logic…
-
Claude Mythos Preview Discovers 10,000+ 0-Days in Glasswing
Anthropic has published an update on Project Glasswing, its collaborative AI-powered vulnerability discovery initiative launched last month, revealing that Claude Mythos, the company’s most capable and tightly restricted model, has already surfaced more than 10,000 high- or critical-severity zero-day vulnerabilities across the world’s most systemically important software. The findings represent one of the most significant…
-
Microsoft Warns: Windows Zero-Day ‘YellowKey’ Can Bypass BitLocker
Microsoft has released a temporary mitigation for YellowKey, a Windows zero-day that can reportedly bypass BitLocker protections. The post Microsoft Warns: Windows Zero-Day ‘YellowKey’ Can Bypass BitLocker appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-yellowkey-bitlocker-bypass-mitigation/
-
Huawei zero-day flaw reportedly caused Luxembourg telecom outage
First seen on scworld.com Jump to article: www.scworld.com/brief/huawei-zero-day-flaw-reportedly-caused-luxembourg-telecom-outage
-
$20 per zero-day is already the WordPress plugin reality
Vulnerability researchers have spent the past year arguing about whether AI agents can find real bugs at scale or whether they mostly generate noise. A pipeline built in three … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/22/ai-wordpress-plugin-vulnerabilities/
-
Trend Micro warns of Apex One zero-day exploited in the wild
Japanese cybersecurity software company Trend Micro has addressed an Apex One zero-day vulnerability exploited in attacks targeting Windows systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/trend-micro-warns-of-apex-one-zero-day-exploited-in-attacks/