Zero-Day

9 articles

ThreatsTechnology, Cloud & SaaSBreaking
Citrix NetScaler CVSS 9.3 authentication bypass CVE-2026-19490 under active in-the-wild exploitation
CISA and threat researchers warn that CVE-2026-19490 in Citrix NetScaler ADC and Gateway is under active exploitation, granting unauthenticated access to perimeter gateways.
Daniel Okafor14 Sept 20266 min read
$3D technical illustration of fractured Microsoft Defender security shield and race condition threads exposing NT AUTHORITY SYSTEM core access$
ResearchTechnology, Cloud & SaaSHigh
'ShieldCrash' exploit bypasses Microsoft Defender patch, enabling local SYSTEM file access
A zero-day exploit dubbed ShieldCrash bypasses Microsoft Defender’s latest patches, weaponizing a TOCTOU race condition in the engine to read files as SYSTEM.
Mei-Lin Chen14 Sept 20267 min read
ThreatsRetail & E-commerceBreaking
Adobe warns of exploited Commerce and Magento RCE — patch CVE-2026-75650 now
Adobe says attackers are exploiting a critical, unauthenticated Commerce and Magento flaw. Merchants should apply the vendor hotfix and rotate exposed secrets.
Priya Raman13 Sept 20266 min read
ThreatsTechnology, Cloud & SaaSBreaking
Cisco Secure FMC authentication bypass CVE-2026-20079 exploited by Qilin ransomware affiliates
Threat actors and Qilin ransomware affiliates are actively weaponizing CVE-2026-20079 in Cisco Secure FMC to bypass web authentication and achieve root command execution.
Daniel Okafor12 Sept 20266 min read
ThreatsTelecom & MediaCritical
Chinese state-aligned group UNC3569 exploited zero-day flaw in Sogou Input Method to drop GRAYRABBIT backdoor
A zero-day flaw in Sogou Input Method—used by 455M people monthly—allowed Chinese threat actor UNC3569 to execute arbitrary code and install the GRAYRABBIT backdoor.
Mei-Lin Chen12 Sept 20266 min read
ThreatsTechnology, Cloud & SaaSBreaking
GitLab fixes maximum-severity CVSS 10.0 file-read flaw as in-the-wild exploitation begins
GitLab pushed emergency patches for CVE-2026-85706, an unauthenticated CVSS 10.0 path traversal flaw in the repository commits API that allows remote file extraction.
Priya Raman12 Sept 20266 min read
ThreatsIndustrial, OT & IoTBreaking
SonicWall SMA1000 Zero-Day Chain Hit CISA KEV in Three Days. Patching Is the Easy Part
SonicWall disclosed two actively exploited SMA1000 flaws on 1 September; CISA set a 5 September federal deadline. The harder problem is proving an appliance you cannot instrument is clean.
Daniel Okafor11 Sept 20265 min read
ThreatsTechnology, Cloud & SaaSBreaking
Microsoft ships 973 fixes in September Patch Tuesday, two flaws already exploited
Microsoft’s September 2026 rollup addresses 973 CVEs, including two elevation-of-privilege bugs — in the Windows Update Stack and ALPC — confirmed under active attack.
Priya Raman9 Sept 20267 min read
ResearchTechnology, Cloud & SaaSCritical
BlueMoon Exploit Kit: Chrome V8 Zero-Day Chained with Windows Kernel Escalation
Proofpoint disclosed the BlueMoon exploit kit weaponizing Google Chrome V8 flaws (CVE-2026-87491) alongside Windows kernel privilege escalation in state-aligned espionage attacks.
Mei-Lin Chen9 Sept 20266 min read