Collecting Cyber-News from over 60 sources

Tag: zero-day

CVE-2026-20127: Cisco Catalyst SD-WAN Controller/Manager Zero-Day Authentication Bypass Vulnerability Exploited in the Wild

Feb 25, 2026 10:37 PM

Tags: access, advisory, attack, authentication, cisa, cisco, cve, cyber, cybersecurity, exploit, flaw, government, infrastructure, intelligence, mitigation, network, risk, software, threat, update, vulnerability, zero-day

Exploitation of a maximum severity authentication bypass zero-day vulnerability affecting Cisco Catalyst SD-WAN Controller and Manager has been reported. Immediate patching is recommended to thwart ongoing attacks. Key takeaways: CVE-2026-20127 is an Authentication Bypass Vulnerability affecting Cisco Catalyst SD-WAN Controller and Manager. Patches have been released and no workarounds are currently available. Exploitation in the…
Treasury Sanctions Russian Exploit Brokerage

Feb 25, 2026 9:37 PM

Tags: breach, exploit, russia, zero-day

The U.S. sanctioned Russia-linked Operation Zero for trafficking stolen zero-day exploits tied to national security risks. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/treasury-sanctions-russian-exploit-brokerage/
Critical Cisco SD-WAN bug exploited in zero-day attacks since 2023

Feb 25, 2026 7:37 PM

Tags: attack, authentication, cisco, cve, exploit, malicious, vulnerability, zero-day

Cisco is warning that a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN, tracked as CVE-2026-20127, was actively exploited in zero-day attacks that allowed remote attackers to compromise controllers and add malicious rogue peers to targeted networks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-cisco-sd-wan-bug-exploited-in-zero-day-attacks-since-2023/
Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127)

Feb 25, 2026 6:36 PM

Tags: authentication, cisco, cyber, exploit, threat, vulnerability, zero-day

A >>highly sophisticated<< cyber threat actor has been exploiting a zero-day authentication bypass vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/25/cisco-sd-wan-zero-day-cve-2026-20127/
Former U.S. Defense contractor executive sentenced for selling zero-day exploits to Russian broker Operation Zero

Feb 25, 2026 12:37 PM

Tags: defense, exploit, russia, zero-day

A former employee at U.S. defense contractor L3Harris got over 7 years in prison for selling eight zero-days to a Russian broker. Peter Williams, a 39-year-old Australian former L3Harris employee, received a prison sentence of just over seven years for selling eight zero-day exploits to the Russian broker Operation Zero for millions. Williams pleaded guilty…
US sanctions Russian broker for buying stolen zero-day exploits

Feb 25, 2026 12:37 PM

Tags: breach, defense, exploit, hacking, russia, tool, zero-day

The U.S. Treasury Department has sanctioned a Russian exploit broker who bought stolen hacking tools from a former executive of a U.S. defense contractor. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/us-sanctions-russian-exploit-broker-for-buying-stolen-zero-days/
Former Defense Contractor Boss Gets 7+ Years for Selling Zero Days

Feb 25, 2026 12:37 PM

Tags: defense, russia, zero-day

A former general manager of a US defense contractor has been sentenced after selling zero days to Russia First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/defense-contractor-boss-7-years/
Ex-L3Harris exec jailed for selling zero-days to Russian exploit broker

Feb 25, 2026 10:37 AM

Tags: defense, exploit, russia, zero-day

The former head of Trenchant, a specialized U.S. defense contractor unit, was sentenced Tuesday to more than seven years in federal prison for stealing and selling zero-day exploits to a Russian exploit broker whose clients include the Russian government. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ex-l3harris-exec-jailed-for-selling-zero-days-to-russian-exploit-broker/
Defense Contractor Employee Jailed for Selling 8 Zero-Days to Russian Broker

Feb 25, 2026 10:37 AM

Tags: defense, exploit, russia, theft, zero-day

A 39-year-old Australian national who was previously employed at U.S. defense contractor L3Harris has been sentenced to a little over seven years in prison for selling eight zero-day exploits to Russian exploit broker Operation Zero in exchange for millions of dollars.Peter Williams pleaded guilty to two counts of theft of trade secrets in October 2025.…
Treasury sanctions Russian zero-day broker accused of buying exploits stolen from U.S. defense contractor

Feb 24, 2026 9:02 PM

Tags: breach, defense, exploit, russia, threat, zero-day

The U.S. Treasury announced it was imposing sanctions against a Russian broker of zero-day exploits, its founder and two affiliates, citing a threat to U.S. national security. Another affiliated zero-day broker in the United Arab Emirates was also sanctioned. First seen on techcrunch.com Jump to article: techcrunch.com/2026/02/24/treasury-sanctions-russian-zero-day-broker-accused-of-buying-exploits-stolen-from-u-s-defense-contractor/
CrowdStrike Analysis Paints Worsening Cybersecurity Picture

Feb 24, 2026 10:01 AM

Tags: crowdstrike, cyberattack, cybersecurity, exploit, vulnerability, zero-day

A report published by CrowdStrike today finds the average breakout time for a cyberattack in 2025 has been reduced to 29 minutes, representing a 65% year-over-year reduction. At the same time, CrowdStrike is also reporting there was a 42% increase in the number of zero-day vulnerabilities being exploited prior to public disclosure. Additionally, 82% of..…
The rise of the evasive adversary

Feb 24, 2026 8:01 AM

Tags: access, ai, attack, authentication, breach, china, cloud, credentials, crime, crowdstrike, crypto, data, defense, endpoint, exploit, finance, firewall, group, identity, infrastructure, intelligence, korea, lazarus, leak, mail, malicious, malware, microsoft, monitoring, network, north-korea, open-source, phishing, ransomware, remote-code-execution, russia, saas, service, software, strategy, supply-chain, tactics, theft, threat, tool, update, vpn, vulnerability, windows, zero-day

Big game hunters tighten their grip: CrowdStrike’s research highlights how big game hunting (BGH) ransomware actors have remained the dominant force in the eCrime landscape.Punk Spider, a group responsible for developing and maintaining Russian-language Akira ransomware, and its associated Akira dedicated leak site, conducted 198 intrusions in 2025, a 134% increase year over year. Victim-shaming operations…
Anthropic’s Claude Code Security rollout is an industry wakeup call

Feb 24, 2026 8:01 AM

Tags: ai, attack, backdoor, ceo, ciso, cloud, control, cyber, cybersecurity, detection, exploit, group, LLM, open-source, risk, saas, service, soc, tool, update, vulnerability, zero-day, zero-trust

Anchors security posture to the model: However, those assurances didn’t make all concerns evaporate. “The moment those vibe coders plug a foundation model into their CI pipeline, their entire security posture is no longer anchored only to the company’s code,” I-Gentic AI CEO Zahra Timsah pointed out.”It is anchored to the current behavior of that model.…
Multiple Zero-Day Flaws in PDF Platforms Enable XSS and One-Click Attacks

Feb 23, 2026 7:01 PM

Tags: ai, attack, flaw, xss, zero-day

16 zero-day security flaws found in Foxit and Apryse PDF platforms could lead to account takeover and RCE. Learn how AI identified these risks. First seen on hackread.com Jump to article: hackread.com/zero-day-flaws-pdf-platforms-xss-one-click-attacks/
Ransomware, Zero-Days, and Data Breaches Shape This Week’s Cybersecurity Landscape

Feb 23, 2026 4:00 PM

Tags: breach, cybersecurity, data, ransomware, zero-day

Weekly summary of Cybersecurity Insider newsletters First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/weekly-roundup/ransomware-zero-days-and-data-breaches-shape-this-weeks-cybersecurity-landscape/
Attackers exploit Ivanti EPMM zero-days to seize control of MDM servers

Feb 23, 2026 1:01 PM

Tags: advisory, apt, backup, china, control, credentials, cve, exploit, flaw, government, group, ivanti, mobile, network, password, service, software, threat, update, vpn, vulnerability, zero-day

Patch, but verify first: Unit 42 directed organizations to Ivanti’s security advisory for remediation guidance, which recommends applying version-specific RPM patches for EPMM 12.x branches that require no appliance downtime. Ivanti cautioned, however, that the patch does not survive a version upgrade and must be reinstalled if the software is updated. “The permanent fix for…
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
Week in review: Firmware-level Android backdoor found on tablets, Dell zero-day exploited since 2024

Feb 22, 2026 11:02 AM

Tags: ai, android, backdoor, ciso, exploit, firmware, WeeklyReview, zero-day

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Security at AI speed: The new CISO reality The CISO role has changed … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/22/week-in-review-firmware-level-android-backdoor-found-on-tablets-dell-zero-day-exploited-since-2024/
News brief: 6 Microsoft zero days and a warning from CISA

Feb 20, 2026 8:02 PM

Tags: cisa, microsoft, zero-day

Check out the latest security news from the Informa TechTarget team. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366639010/News-brief-6-Microsoft-zero-days-and-a-warning-from-CISA
Chrome Zero-Day CVE-2026-2441: The CSS Trap Blog – Menlo Security

Feb 20, 2026 11:01 AM

Tags: browser, chrome, cloud, cve, endpoint, update, zero-day

Discover why the latest Chrome zero-day (CVE-2026-2441) proves patching isn’t enough. Learn how cloud isolation secures endpoints against CSS memory exploits. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/chrome-zero-day-cve-2026-2441-the-css-trap-blog-menlo-security/
CVE-2026-20700 – Apple behebt Zero Day in allen Betriebssystemen

Feb 20, 2026 8:01 AM

Tags: apple, cve, zero-day

First seen on security-insider.de Jump to article: www.security-insider.de/zero-day-sicherheitsluecke-apple-betriebssysteme-a-97a952c6d6af5bc4e9297d177111889e/
ThreatsDay Bulletin: OpenSSL RCE, Foxit 0-Days, Copilot Leak, AI Password Flaws & 20+ Stories

Feb 19, 2026 4:01 PM

Tags: ai, cyber, flaw, leak, password, rce, remote-code-execution, risk, tactics, threat, tool, zero-day

The cyber threat space doesn’t pause, and this week makes that clear. New risks, new tactics, and new security gaps are showing up across platforms, tools, and industries, often all at the same time.Some developments are headline-level. Others sit in the background but carry long-term impact. Together, they shape how defenders need to think about…
Chinese hackers exploited zero-day Dell RecoverPoint flaw for 1.5 years

Feb 19, 2026 12:00 AM

Tags: access, backdoor, china, credentials, detection, endpoint, exploit, firewall, flaw, hacker, linkedin, linux, malware, mandiant, network, service, vmware, zero-day

Pivot techniques: In addition to the payloads themselves, the investigation also revealed new techniques. For example, the legitimate shell script convert_hosts.sh that exists on these appliances has been modified to include the path of the backdoors to achieve persistence.The SLAYSTYLE web shell, which is designed to receive commands over HTTP and execute them on the…
Zero-Day in Dell RecoverPoint Enables GRIMBOLT Backdoor

Feb 18, 2026 10:01 PM

Tags: exploit, malware, vmware, zero-day

A Dell RecoverPoint zero-day has been exploited to deploy GRIMBOLT malware and pivot into VMware environments. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/zero-day-in-dell-recoverpoint-enables-grimbolt-backdoor/
China-linked hackers exploited Dell zero-day since 2024 (CVE-2026-22769)

Feb 18, 2026 4:58 PM

Tags: china, cyberespionage, exploit, flaw, group, hacker, software, zero-day

A suspected China-linked cyberespionage group has been covertly exploiting a critical zero-day flaw (CVE-2026-22769) in Dell’s RecoverPoint for Virtual Machines software since … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/18/exploited-dell-zero-day-cve-2026-22769-brickstorm-grimbolt/
AI Found Twelve New Vulnerabilities in OpenSSL

Feb 18, 2026 2:58 PM

Tags: ai, cve, vulnerability, zero-day

The title of the post is”What AI Security Research Looks Like When It Works,” and I agree: In the latest OpenSSL security release> on January 27, 2026, twelve new zero-day vulnerabilities (meaning unknown to the maintainers at time of disclosure) were announced. Our AI system is responsible for the original discovery of all twelve, each…
AI Found Twelve New Vulnerabilities in OpenSSL

Feb 18, 2026 2:58 PM

Tags: ai, cve, vulnerability, zero-day

The title of the post is”What AI Security Research Looks Like When It Works,” and I agree: In the latest OpenSSL security release> on January 27, 2026, twelve new zero-day vulnerabilities (meaning unknown to the maintainers at time of disclosure) were announced. Our AI system is responsible for the original discovery of all twelve, each…
China-linked APT weaponized Dell RecoverPoint zero-day since 2024

Feb 18, 2026 1:58 PM

Tags: apt, attack, china, exploit, flaw, google, group, intelligence, mandiant, threat, zero-day

A suspected Chinese state-linked group exploited a critical Dell RecoverPoint flaw (CVE-2026-22769) in zero-day attacks starting mid-2024. Mandiant and Google’s Threat Intelligence Group (GTIG) reported that a suspected China-linked APT group quietly exploited a critical zero-day flaw in Dell RecoverPoint for Virtual Machines starting in mid-2024. >>Mandiant and Google Threat Intelligence Group (GTIG) have identified…
Critical Ivanti EPMM Zero-Day Vulnerabilities Exploited in the Wild, Targeting Corporate Networks

Feb 18, 2026 1:58 PM

Tags: control, corporate, cve, cyber, data-breach, endpoint, exploit, ivanti, mobile, network, remote-code-execution, vulnerability, zero-day

Two critical zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-1281 and CVE-2026-1340, are being actively exploited to compromise enterprise mobile fleets and corporate networks. Both are remote code execution (RCE) vulnerabilities that allow unauthenticated attackers to run arbitrary commands on exposed EPMM servers, effectively giving them full control of the mobile device…