Topic

Zero-Day: news, advisories and analysis

27 articlesUpdated 22 Oct 2026

CyberSecureToday covers Zero-Day across 27 articles published between 9 Sep 2026 and 22 Oct 2026. The coverage includes 22 vulnerability advisories, 2 incident or breach reports and 3 analysis or guidance pieces. 21 advisories are rated critical or high severity, and 12 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on Zero-Day most often intersect with Active Exploitation, CVSS 9.8 and Remote Code Execution, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Critical 'PHP2Shell' Core Runtime Flaws Trigger Unauthenticated RCE Across Millions of Web Servers”, was published 22 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

CISA KEV advisory hub: severity, KEV status and fixes in one table

Latest coverage

ThreatsCloud & SaaS
Critical 'PHP2Shell' Core Runtime Flaws Trigger Unauthenticated RCE Across Millions of Web Servers
Emergency updates in PHP 8.5, 8.4, 8.3, and 8.2 fix the 'PHP2Shell' dual memory corruption flaws (CVE-2026-109618 and CVE-2026-109619), exposing servers to pre-execution code execution.
CST Editorial Desk22 Oct 202613 min read
Cyber AttackCloud & SaaS
Operation Cyber Guardian: CSA and IMDA Expose UNC3886 Stealth Espionage Campaign Targeting Singapore Telcos
Singapore's CSA and IMDA disclose Operation Cyber Guardian, evicting APT group UNC3886 after a coordinated cyber-espionage infiltration targeting national telco backbones.
Daniel Okafor21 Oct 202614 min read
ResearchCloud & SaaS
Google GTIG: AI-Found Bugs Skew Toward Code Execution as Exploited Vulnerabilities Outpace All of 2025
GTIG's AI-era report: CVE disclosures doubled in 2026, 141 bugs exploited by August vs 127 in 2025, and 50% of AI-discovered flaws lead to RCE, per Google.
Priya Raman3 Oct 20267 min read
$Citrix NetScaler ADC perimeter gateway appliance with fractured glowing binary memory buffers under cybernetic attack$
ThreatsCloud & SaaSCritical
Citrix NetScaler ADC Memory Buffer Flaws Exploited to Breach Perimeter Gateways
Threat actors are actively weaponizing memory buffer overflow and command injection flaws in Citrix NetScaler ADC to breach enterprise perimeter gateways.
Priya Raman2 Oct 20269 min read
ThreatsCloud & SaaSCritical
Fortinet FortiMail Path Traversal Flaw Exploited for Unauthenticated Remote Code Execution
A critical zero-day flaw in Fortinet FortiMail secure email gateways allows unauthenticated remote attackers to write arbitrary files and execute code as root.
Priya Raman2 Oct 20269 min read
ThreatsCloud & SaaSCritical
Apple Patches CoreGraphics In-The-Wild Zero-Day Memory Corruption Across iOS and macOS (CVE-2026-86950)
Apple resolves a critical out-of-bounds write zero-day in CoreGraphics (CVE-2026-86950) exploited in targeted cyber-espionage attacks against iOS and macOS.
CST Editorial Desk29 Sep 20268 min read
ThreatsCloud & SaaSCritical
WSO2 API Manager Path Traversal Flaw Weaponized to Extract Gateway Credentials
WSO2 patches critical path traversal flaw CVE-2026-5430 across API Manager and Gateway platforms, preventing unauthenticated remote extraction of master credentials.
Daniel Okafor25 Sep 202617 min read
ThreatsCloud & SaaSCritical
Check Point Security Management Server Path Traversal Exploited to Gain Root Access
Check Point and CISA confirm active in-the-wild exploitation of CVSS 9.8 flaw CVE-2026-93616 allowing unauthenticated attackers to write arbitrary files as root.
CST Editorial Desk23 Sep 202616 min read
ThreatsCloud & SaaSCritical
Arista VeloCloud Orchestrator Zero-Day Exploited to Hijack SD-WAN Edge Gateways
Arista confirms active in-the-wild exploitation of CVSS 10.0 CVE-2026-93952, allowing unauthenticated attackers to hijack on-prem VeloCloud Orchestrators.
CST Editorial Desk23 Sep 202617 min read
ThreatsCloud & SaaSCritical
F5 BIG-IP APM Heap Overflow Weaponized to Hijack Gateway Data Planes
F5 confirms active zero-day exploitation of CVE-2026-94127, a critical heap buffer overflow in BIG-IP APM OAuth gateways allowing unauthenticated remote code execution.
CST Editorial Desk23 Sep 202617 min read
ThreatsCloud & SaaSCritical
Cisco Secure Firewall Flaw Weaponized to Compromise Perimeter Gateways
Cisco issues emergency software hardening release for Secure Firewall ASA, FTD, and FMC addressing actively exploited critical vulnerability CVE-2026-20329.
Priya Raman19 Sep 202613 min read
ThreatsCloud & SaaSCritical
Ivanti Sentry Critical OS Command Injection Flaw Exploited in Perimeter Infiltration Attacks
CISA adds Ivanti Sentry vulnerability CVE-2026-10520 (CVSS 9.8) to KEV catalog following active zero-day exploitation against corporate mobile gateways.
CST Editorial Desk18 Sep 202611 min read
ThreatsCloud & SaaSCritical
Google Pixel Cellular Modem Zero-Day Flaw Exploited in Targeted Mobile Attacks
CISA adds Google Pixel baseband modem flaw CVE-2026-58704 to its KEV catalog following active zero-day exploitation against high-value target devices.
Priya Raman16 Sep 202610 min read
ThreatsCloud & SaaSCritical
VMware vCenter Server Critical Path Traversal Flaw Exploited in Virtualization Attacks
CISA mandates urgent federal remediation as attackers weaponize CVE-2026-59310, an unauthenticated path traversal flaw granting root code execution on VMware vCenter appliances.
Priya Raman15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Microsoft Windows IKE Protocol Double-Free RCE Flaw Exploited in Active Network Attacks
CISA confirms active in-the-wild exploitation of CVE-2026-33824, an unauthenticated double-free memory corruption flaw in Windows IKE enabling remote root code execution over UDP 500.
Mei-Lin Chen15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Oracle WebLogic Server & Proxy Plug-in Flaw Exploited to Bypass Access Controls
CISA adds CVE-2026-21962 to its KEV catalog, warning of active remote exploitation bypassing Oracle HTTP Server reverse proxy rules to seize WebLogic clusters.
Aisha Noor15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Zimbra Collaboration Suite Command Injection Flaw Exploited in the Wild
Federal agencies face strict remediation deadlines as CISA confirms active exploitation of CVE-2026-73570, allowing unauthenticated adversaries to execute root shell commands on Zimbra mail servers.
Priya Raman15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Cisco Secure Email Gateway Critical SQL Injection Flaw Weaponized in Active Attacks
CISA mandates urgent federal remediation after confirming active exploitation of CVE-2026-76461, an unauthenticated SQL injection flaw granting root shell access on Cisco SEG appliances.
Mei-Lin Chen15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Citrix NetScaler CVSS 9.3 authentication bypass CVE-2026-19490 under active in-the-wild exploitation
CISA and threat researchers warn that CVE-2026-19490 in Citrix NetScaler ADC and Gateway is under active exploitation, granting unauthenticated access to perimeter gateways.
Daniel Okafor14 Sep 20266 min read
$3D technical illustration of fractured Microsoft Defender security shield and race condition threads exposing NT AUTHORITY SYSTEM core access$
ResearchCloud & SaaS
'ShieldCrash' exploit bypasses Microsoft Defender patch, enabling local SYSTEM file access
A zero-day exploit dubbed ShieldCrash bypasses Microsoft Defender’s latest patches, weaponizing a TOCTOU race condition in the engine to read files as SYSTEM.
Mei-Lin Chen14 Sep 20267 min read
ThreatsRetail & E-commerceCritical
Adobe warns of exploited Commerce and Magento RCE — patch CVE-2026-75650 now
Adobe says attackers are exploiting a critical, unauthenticated Commerce and Magento flaw. Merchants should apply the vendor hotfix and rotate exposed secrets.
Priya Raman13 Sep 20266 min read
Cyber AttackCloud & SaaS
Cisco Secure FMC authentication bypass CVE-2026-20079 exploited by Qilin ransomware affiliates
Threat actors and Qilin ransomware affiliates are actively weaponizing CVE-2026-20079 in Cisco Secure FMC to bypass web authentication and achieve root command execution.
Daniel Okafor13 Sep 20266 min read
ThreatsTelecom & MediaCritical
Chinese state-aligned group UNC3569 exploited zero-day flaw in Sogou Input Method to drop GRAYRABBIT backdoor
A zero-day flaw in Sogou Input Method—used by 455M people monthly—allowed Chinese threat actor UNC3569 to execute arbitrary code and install the GRAYRABBIT backdoor.
Mei-Lin Chen12 Sep 20266 min read
ThreatsCloud & SaaSCritical
GitLab fixes maximum-severity CVSS 10.0 file-read flaw as in-the-wild exploitation begins
GitLab pushed emergency patches for CVE-2026-85706, an unauthenticated CVSS 10.0 path traversal flaw in the repository commits API that allows remote file extraction.
Priya Raman12 Sep 20266 min read