zero day
16 posts
Chromium executes attacker code across every version
A zero-day sandbox RCE hits all Chromium versions under active exploitation, with no confirmed fixed build and a single containment control shown ineffective.
Patching would not have stopped this breach
A Metabase zero-day converted an analytics application's standing data access into attacker access, leaving reach and scope as the only controls in play.
Nginx patched. Assume breach.
NGINX issued the nginx-poolslip patch. Operator analysis of what is confirmed, what is not, and what must change at the proxy boundary.
The zero-day wasn't the failure.
Luxembourg's national telecoms network collapsed from one Huawei zero-day. The failure was architectural, not vendor-specific. Concentration was the control gap.
The IIS virtual directory that won't stop bleeding
Technical analysis of the Exchange Server zero-day, the frontend-to-backend trust boundary it abuses, and what fires in EDR and IIS telemetry.
LLM agent shipped first attributed zero-day
Technical breakdown of the first AI-discovered zero-day 2FA bypass: state-confusion in IdP step-three cookie issuance, exploit path, and detection gaps.
Microsoft's patch cadence is not the problem
The Exchange zero-day is the fifth in the same pattern since 2021. Why patching faster is not the fix, and what actually reduces blast radius.
AI just broke 2FA at scale
AI was used to develop a zero-day 2FA bypass deployed at mass scale. The control's economic assumption has been falsified in the wild.
Attackers weaponized AI to bypass 2FA at scale
A reported AI-developed zero-day 2FA bypass in mass use removes the assumption that 2FA terminates the account takeover chain.
Four Windows 11 zero-days on one desk
One researcher controls the release cadence on four Windows 11 zero-days, including BitLocker bypass yellowkey and LPE greenplasma.
Patch status is not your risk variable
Operator brief on yellowkey and greenplasma, two public Windows 11 zero-days from the bluehammer and redsun researcher. What failed. What must now be true.
Dirty Frag roots every kernel
Technical analysis of CVE-2026-3490 'Dirty Frag' - a page_frag refcount UAF in the Linux kernel enabling local root on stock 5.15-6.8 kernels.