zero-day
9 posts
Volt Typhoon exploited four zero-days through router relays
Volt Typhoon's Silent Train framework routes zero-day attacks through chains of compromised relay devices that operators strip within hours of each operation.
A SUID flip rooted the BeyondTrust appliance
BeyondTrust patched CVE-2026-102764, an auth bypass in Remote Support exploited by Armory Castle since late August to gain root on appliances.
A patched Ivanti appliance on 22.8R2.4 fell to three zero-days
An attacker chained three Ivanti Connect Secure zero-days to root on a fully patched appliance. Two are fixed, one still pending, and the ICT misses it.
Ivanti VPN bypass, actively exploited
Ivanti is patching an actively exploited Connect Secure authentication bypass, but the attack chain reaches root on fully patched devices.
Attackers drained $387.5M through Bitget's own security appliances
Bitget confirms a third-party zero-day let attackers reach its wallet job server and drain $387.5M; SlowMist and Mandiant trace the two-stage path.
Citrix patches second NetScaler SAML bug in days
Citrix patched NetScaler zero-day CVE-2026-88779, a SAML memory overflow under active attack that causes denial-of-service and may allow code execution.
iOS CoreGraphics PoC published two days after the patch
Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics triggered by a malicious PDF font and used in targeted attacks on iOS before 27.
Two Zammad zero-days let an AI agent reach root
DIVD says two Zammad zero-days let an AI agent hijack a session, reach root, and exfiltrate data in seconds; network segmentation limited the breach.
FortiMail flaw under attack; fixed builds out since 5 October
Fortinet warns of CVE-2026-104286, a critical FortiMail flaw under active exploitation that lets unauthenticated attackers write arbitrary files.