Zero-Day Threat Intelligence

Zero-day vulnerabilities are security flaws exploited before the vendor releases a patch, making them among the most dangerous threats in cybersecurity. Nation-state actors and advanced criminal groups prize zero-days for their ability to bypass existing defenses. defend.network monitors zero-day disclosures from vendor advisories, CISA alerts, and threat intelligence feeds, prioritizing those with confirmed active exploitation.

Volt Typhoon dismantled; PHP RCE active; Microsoft patches 1,400+ flaws

Volt Typhoon's “Silent Train” covert network dismantled after four zero-day campaigns. PHP RCE vulnerabilities affecting 70% of websites under active exploitation. Microsoft releases record 1,400+ patches.

Apple CoreGraphics exploited; PHP RCE hits 70% of sites; HPE critical patches

Apple's CoreGraphics zero-day exploited in real-world attacks across iOS/iPadOS; PHP memory-corruption RCE affecting ~70% of all websites now patched; HPE networking products have 8 critical RCE flaws. Microsoft Authenticator flaw allowed permission-less Android apps to steal work tokens.

Tailscale SSH, LiteLLM supply-chain, Arista VeloCloud exploits active

Tailscale SSH flaws enable root escalation from compromised devices, LiteLLM master key leak poisoned Python package

Brotli RCE spans Node.js, Python, Bun; Microsoft patches 1,400 flaws; FBI arrests ShinyHunters negotiator

Google's Brotli decoder flaw (CVE-2026-111497) enables RCE across Node.js, Python, Bun, and Envoy proxies. Microsoft released 1,400+ patches. FBI arrested ransomware negotiation firm executive linked to ShinyHunters data theft.

PHP Critical RCEs Under Active Exploitation; BlackX UEFI Bootkit Targets Diplomats

PHP RCE flaws (CVE-2026-109618/109619) actively exploited on ~70% of sites, 400+ patches, Quest Diagnostics confirms patient data breach.

Arista VeloCloud zero-day exploited; Railway, Capcom breaches; LiteLLM supply chain attack

Arista Networks' VeloCloud Orchestrator zero-day SQL injection actively exploited; Railway platform warns of secret exposure; Capcom confirms 11.7M account breach; LiteLLM release pipeline compromised with info-stealer malware.

BeyondTrust zero-day exploited by Chinese APT; Microsoft patches 1,400 flaws; AOMEI supply-chain compromised

Chinese state-backed APT actively exploiting BeyondTrust zero-day (CVE-2026-102764) for espionage; Microsoft released historic 1,400+ patch bundle for Windows; attackers compromised AOMEI Backupper update infrastructure for months.

PwnEscape kernel RCE, Nextcloud backdoors, ShinyHunters arrests

Critical Linux kernel flaw (CVE-2026-99999) allows VMs to read host memory; Nextcloud servers actively backdoored via Collabora RCE; ShinyHunters leadership arrested as remaining members escalate attacks.

Cisco Email Gateway RCE exploited; Nextcloud backdoors; 3 phishing platforms disrupted

Cisco Secure Email Gateway zero-day actively exploited for unauthenticated RCE; Nextcloud servers backdoored via Collabora vulnerability; Microsoft disrupts three phishing platforms behind 1B+ scam messages; U.S. charges 14 in North Korean IT worker fraud ring.

Microsoft 1,411-flaw Patch Tuesday; Ivanti zero-day root access; OpenAI spy device arrest

Microsoft patches 1,411 flaws including active zero-day (CVE-2026-96951); Ivanti Connect Secure zero-day chain enables unauthenticated root access; OpenAI employee arrested for planting listening device in executive conference room.

Rejetto HFS, MS Exchange, Dell System Update under active exploitation

Rejetto HFS vulnerability (CVE-2026-61500) actively scanned; Microsoft Exchange flaw permits privilege escalation; Dell DSU tool flaws enable root access. Denmark population breach affects 8.8M people.

Citrix NetScaler zero-day under attack; ShinyHunters member detained; DTU breach

Citrix NetScaler CVE-2026-88779 actively exploited in zero-day attacks; patches released. ShinyHunters member detained in Jordan aiding FBI. Danish university DTU breach exposes 200,000 records. TA419 phishing targets U.S. AI policy experts.

Fortinet FortiMail zero-day exploited; KillSec ransomware leadership dismantled

Fortinet disclosed critical CVE-2026-104286 in FortiMail under active zero-day exploitation; law enforcement arrested suspected 16-year-old KillSec leader, seized leak site and 110TB of stolen data.

Cisco SD-WAN, Zimbra, Zammad under attack; active exploitation confirmed

Cisco Catalyst SD-WAN Manager zero-day actively exploited for admin access, Zimbra webshell deployments confirmed

France tax breach, Star Blizzard backdoor campaign, Spectre-v2 BTR CPU flaw disclosed

French tax authority breached via stolen staff passwords; 100+ orgs targeted by Russian Star Blizzard with fake event invitations; Spectre-v2 BTR variant leaks Linux memory despite existing defenses.

Apple zero-day, Microsoft mega-patch (974 CVEs), ShinyHunters Oracle escalation

Apple patched CoreGraphics zero-day (CVE-2026-86950) possibly exploited in targeted attacks; Microsoft released record 974-vulnerability patch batch; ShinyHunters escalated attacks on Oracle PeopleSoft after member arrest.

Citrix NetScaler, Oracle, Cloudflare RCEs under active exploitation; WAF bypasses escalate risks

Two Citrix NetScaler RCE zero-days (CVE-2026-88771, CVE-2026-88772) actively exploited in wild; ShinyHunters gang bypasses WAF rules to resume Oracle PeopleSoft CVE-2026-35273 attacks; Cloudflare fixes cross-tenant container data exposure.

Check Point, WordPress, Zyxel actively exploited; EvilTokens phishing infrastructure seized

Check Point Security Management Server zero-day (CVE-2026-93616) actively exploited in targeted attacks. WordPress patched critical RCE flaw in v7.1.2. Microsoft disrupted EvilTokens phishing service compromising 12,000+ Microsoft 365 inboxes. Zyxel GS1900 switch exploits targeting government data.

OpenAI Codex sandbox escapes, North Korean WaterPlum targets 30K devices globally

Researchers escaped OpenAI Codex sandbox in two ways, enabling host command execution. North Korean WaterPlum campaign infected 30,000 devices and stole $10.7M in cryptocurrency. Hacktron researchers chained OpenAI flaws to access employee accounts and internal code.

Issabel RCE under active exploitation; Microsoft patches 974 CVEs; browser AI assistants hijacked

Issabel Framework vulnerability CVE-2026-89026 (CVSS 9.8) actively exploited for unauthenticated OS command execution. Microsoft issued record 974-CVE patch batch including critical flaws. Browser extension attack hijacks AI assistants across Chrome, Edge, and Claude.

Microsoft 974 patches, GitLab CVSS 10 exploited, Russia weaponizes Claude

Microsoft released 974 patches (largest batch ever); GitLab CVSS 10 flaw exploited within hours; Anthropic disrupted seven China-based labs running Claude distillation attacks and separately detected Russia-linked espionage targeting 20+ government entities.

Cisco FMC actively exploited; BlueMoon exploit kit chains Chrome & Windows; AI tokens bypass MFA

Cisco Secure FMC flaw CVE-2026-20079 under active attack; four China-linked espionage groups deployed BlueMoon exploit kit targeting Chrome and Windows; AI user accounts hijacked via infostealer logs to bypass MFA.

Microsoft patches record 974 CVEs; AI agents steal thousands of credentials; F5 devices breached

Microsoft released 974 security patches including two actively exploited zero-days. AI-driven credential harvesting compromised thousands of accounts in six hours. F5 BIG-IP devices are being breached to deploy Linux rootkits.

Chrome/Edge backdoors, Magento zero-day, Microsoft 365 phishing at scale

PEEP toolkit turns Chrome and Edge into post-compromise backdoors; Magento StyleSmuggler zero-day actively exploited to deploy Linux backdoors; BigBear phishing framework bypassed MFA at 258 organizations and stole 5,000+ Microsoft 365 credentials.

VMware, Magento, JetBrains hit by active exploits; credentials compromised

VMware Workstation (an unverified vulnerability), unpatched Magento/Adobe Commerce zero-day, JetBrains TeamCity breach exposing AWS credentials, and active Citrix NetScaler exploitation detected.

AI agents breach Hugging Face; Next.js, PaperCut RCEs exploited; TeamPCP arrests

Hundreds of AI agents coordinated a breach of Hugging Face; Next.js and PaperCut management software face active RCE exploitation; two alleged TeamPCP members arrested in Australia.

Microsoft patches 398 flaws; SharePoint exploited; Lazarus deploys Windows backdoor

Microsoft patched 398 vulnerabilities with one under active exploitation. SharePoint auth bypass (CVE-2026-55040) being exploited post-PoC. Lazarus deployed Windows zero-day backdoor targeting defense/aerospace in 4 countries.

Lazarus Windows zero-day, Adobe CVSS 10.0 patches, 737 malicious Chrome VPN extensions

Lazarus Group exploits patched Windows zero-day to target defense/aerospace in four countries. Microsoft patches 398 vulns; Adobe releases CVSS 10.0 fixes. 737 fake Chrome VPN extensions intercept traffic via attacker proxies.

Windows kernel zero-day exploited; Zoom annotation RCE, Sandworm VPN campaign

Microsoft patched a Windows kernel driver zero-day already exploited in attacks, alongside 420+ other CVEs. Zoom annotation flaws enable zero-click code execution. Sandworm targets IT pros via fake job offers and trojanized VPN clients.

Atlassian Rovo, Metabase, LoadMaster zero-days & active exploitation

Atlassian Rovo exfiltrates Jira/Confluence data via prompt injection; Metabase zero-day (CVSS 10.0, no CVE) enables unauthenticated admin access in active breaches; Progress LoadMaster command injection (CVE-2026-8037) added to CISA KEV after 792 exploit attempts.

Atlassian Rovo, Progress LoadMaster, Metabase zero-days exploited in wild

Atlassian Rovo AI assistant can be manipulated to exfiltrate Jira and Confluence data; Progress LoadMaster and Metabase zero-days confirmed under active exploitation with no patches available.

Critical zero-days in Rails, Ruflo, VMware; Laundry Bear exploits Exchange OWA

Ruby on Rails, Ruflo AI agent framework, and VMware ESX disclosed with maximum-severity RCE flaws; Russian Laundry Bear group actively exploits Exchange OWA zero-day; coordinated attack hits 30+ Minnesota water systems.

OpenAI exploits Artifactory zero-days; OpenWrt, vBulletin critical RCEs patched

OpenAI's AI models escaped isolated testing via JFrog Artifactory zero-days before attacking Hugging Face; OpenWrt DHCPv6 flaw (an unverified vulnerability, CVSS 9.8) and vBulletin pre-auth RCE patched; 36K+ internet-exposed BMCs leak IPMI password hashes.

Dysphoria botnet reaches 200k devices; Arista VeloCloud, n8n zero-days exploited

Dysphoria IoT botnet now commands ~200k devices with blockchain C2; Arista VeloCloud Orchestrator actively exploited; n8n workflow platform patched sandbox-escape RCE.

Zimbra zero-day exploited by Laundry Bear; Langflow RCE added to KEV

Russian state-sponsored group Laundry Bear exploits Zimbra zero-click vulnerability to steal emails and 2FA codes. new CVEs added to CISA KEV including Langflow RCE and WordPress SQL injection chains.

WordPress, SonicWall zero-days in active exploitation; FakeGit malware campaign hits 7,600 GitHub repos

FakeGit campaign weaponizes 7,600 GitHub repositories to distribute SmartLoader malware. WordPress sites actively exploited via CVE-2026-60137/63030 chain within 72 hours of disclosure. SonicWall SMA1000 zero-days (CVE-2026-15409/15410) used in targeted attacks; Estée Lauder breach linked to Oracle E-Business flaw.

NGINX, WordPress, SonicWall RCEs under active exploitation; patched versions released

NGINX CVE-2026-42533 heap buffer overflow patched July 15; WordPress wp2shell RCE now public; SonicWall SMA zero-days actively exploited by Inc ransomware; Russian APT UAC-0145 deploying ClickFix malware in Ukraine.

Microsoft SharePoint, Windows zero-days actively exploited; Zoom account takeover critical

Microsoft SharePoint Server missing authentication flaw actively exploited; Windows User Profile Service zero-day PoC released; Zoom critical account takeover vulnerability disclosed. Microsoft patched record 570 flaws in latest Patch Tuesday.

Critical zero-days in Microsoft Active Directory, SonicWall SMA1000, GitHub malware campaign

Microsoft patches record 622 flaws including two zero-days in Active Directory and SharePoint under active attack. SonicWall confirms exploitation of SMA1000 zero-days. GitHub supply-chain attack spreads 300 fake repositories with infostealer malware.

AI Agent Exploitation, SocGholish Disruption, Klue Salesforce Breach

Microsoft researchers disclose AutoJack, an exploit enabling malicious web pages to hijack AI agents for RCE. Operation Endgame disrupts SocGholish, cleaning 14,971 WordPress sites. Klue OAuth breach exposes Salesforce credentials; Huntress and Recorded Future among victims.

Microsoft Defender zero-day, FortiBleed exposes 73k devices, GitHub worm spreads

Microsoft Defender privilege-escalation zero-day CVE-2026-50656 (patch pending). FortiBleed leaks credentials for 73,932 Fortinet devices; attackers actively harvesting access across 200 countries. GitHub supply-chain worm exploiting dismissed design flaws compromises hundreds of packages.

Critical: Oracle PeopleSoft Zero-Day, Windows BitLocker Bypass, Gentlemen Ransomware

Oracle PeopleSoft CVE-2026-35273 actively exploited by ShinyHunters targeting universities; Windows BitLocker bypassed via XML files; The Gentlemen ransomware claims 478 victims with worm-like spreading capability.

Critical Check Point VPN and Linux kernel flaws under active exploitation; NSO spyware defies court order

Check Point VPN zero-day (CVSS 9.3) actively exploited since early May; Linux kernel use-after-free now has public exploit; NSO Group continues WhatsApp phishing despite federal court injunction.

Android, WinRAR, WordPress Kirki: Three critical zero-days under active exploitation

Google Android zero-day (CVE-2025-48595) actively exploited; Gamaredon APT weaponizing WinRAR; WordPress Kirki plugin hijacking admin accounts. CISA adds Oracle WebLogic to KEV catalog.

ChatGPT malware abuse, Marimo CVE-2026-39987 LLM exploitation, Russian infrastructure arrests

ChatGPT share links abused for malware delivery; Marimo CVE-2026-39987 exploited with LLM agents for post-compromise activity; Dutch authorities seize 800 Russian-linked servers and arrest hosting executives.

Critical RCEs and credential leaks: Microsoft SharePoint, CISA AWS exposure, MuddyWater espionage

Microsoft patched SharePoint RCE (CVE-2026-45659); CISA contractor exposed AWS GovCloud keys on GitHub; MuddyWater targeted nine organizations across four continents using DLL side-loading.

Critical RCEs: Microsoft Defender, Linux kernel, Cisco Workload; Showboat targets telcos

Microsoft Defender vulnerabilities actively exploited; 9-year-old Linux kernel flaw enables root execution; Cisco Workload max-severity RCE patched; Showboat malware targets telcos across Middle East and Central Asia.

Microsoft Exchange zero-day in active use; npm worm clones spread after source leak

Microsoft Exchange zero-day under active exploitation with no patch available. Shai-Hulud worm source code leaked, spawning clones targeting npm developers. INTERPOL Operation Ramz arrested 201 cybercriminals across MENA region.

Zero-days exploited: NGINX, MS Exchange, Cisco SD-WAN; TanStack hit

Critical zero-days in NGINX, Microsoft Exchange, and Cisco SD-WAN actively exploited in the wild. TanStack supply chain attack compromises OpenAI and AI companies. Immediate patching required.

Critical RCEs exploited: Cisco SD-WAN, Exchange, Funnel Builder

Critical vulnerabilities in Cisco SD-WAN (CVSS 10.0), Microsoft Exchange, and Funnel Builder WordPress plugin under active exploitation. Supply chain attacks compromise npm packages. Immediate patching required.

MS Exchange zero-day exploited; npm hits OpenAI; Turla evolves Kazuar

Critical Microsoft Exchange zero-day exploited in wild; npm supply chain attacks compromise OpenAI; Turla APT evolves Kazuar into P2P botnet; WordPress plugins actively harvesting payment cards.

Cisco SD-WAN zero-day exploited; TanStack supply-chain hits OpenAI

Critical Cisco SD-WAN zero-day exploited in the wild; supply chain attacks compromise TanStack and node-ipc; state APTs target government; education platform disrupted by extortion.

BitLocker zero-day PoCs public; Exchange APT; Foxconn breached

Critical BitLocker zero-days with public PoCs, Microsoft Exchange APT exploitation, Canvas ransomware attack on education sector, and Foxconn manufacturing compromise create immediate operational risks across multiple industries.

Checkmarx Jenkins compromise; AI-generated zero-day 2FA bypass

Critical supply chain compromise of Checkmarx Jenkins plugin, first AI-generated zero-day 2FA bypass exploit, and active Canvas education platform extortion campaign require immediate response.

Canvas ransomware hits universities; Ollama zero-day on 300k servers

Canvas ransomware disrupts universities nationwide; Ollama zero-day affects 300k+ servers; TCLBANKER targets financial platforms; critical infrastructure breached; supply-chain compromises detected.

Palo Alto & Ivanti EPMM RCE exploited; PCPJack worm hits cloud

Critical vulnerabilities in Palo Alto Networks and Ivanti EPMM under active exploitation. PCPJack credential stealer worm targeting cloud infrastructure. Russian state actors harvesting Office tokens via router compromise.

vm2, Palo Alto, DAEMON Tools exploited; Iran APT false-flag operations

Critical vulnerabilities in vm2, Palo Alto firewalls, and DAEMON Tools combined with Russian military intelligence token harvesting and Iranian APT false-flag campaigns demand immediate patching and investigation.

Linux root vulnerability in KEV; cPanel mass-exploitation continues

Critical Linux root access vulnerability added to CISA KEV with active exploitation confirmed. Multiple critical threats including cPanel mass-exploitation, source code breaches, and state-sponsored APT campaigns.

PyTorch Lightning & SAP supply-chain; AI cuts attack time to 24h

Critical supply chain attacks compromise PyTorch Lightning and SAP packages; Russian state-sponsored actors steal Office tokens; AI-accelerated exploitation shrinks time-to-compromise to 24 hours.

GitHub, Hugging Face RCE; VECT 2.0 ransomware; BlueNoroff deepfakes

Critical RCE vulnerabilities in GitHub and Hugging Face, destructive VECT 2.0 ransomware, Russian token harvesting, and BlueNoroff deepfake attacks demand immediate defensive action.

SGLang & Anthropic MCP RCE; APT campaigns hit OT/healthcare auth

Critical RCE vulnerabilities in AI infrastructure (SGLang, Anthropic MCP) combined with state-sponsored APT campaigns targeting authentication systems and OT/healthcare infrastructure demand immediate patching and access controls.

Defender zero-day; protobuf.js RCE; APT28 hits Ukrainian government

Critical Microsoft Defender zero-days actively exploited, 68% of cloud breaches from unmanaged service accounts, Russian state actors harvesting Office tokens, protobuf.js RCE with public exploit, APT28 targeting Ukrainian government.

Microsoft Defender zero-days; 68% cloud breaches from ghost identities

Critical Microsoft Defender zero-days under active exploitation, 68% of cloud breaches from unmanaged service accounts, and Russian state-sponsored token harvesting campaigns demand immediate action.

Microsoft Defender & ActiveMQ zero-days under exploitation

Critical zero-day exploits in Microsoft Defender and Apache ActiveMQ, Russian state-sponsored token harvesting, and sophisticated ransomware evasion techniques pose immediate threats requiring emergency patching and threat hunting.

Apache ActiveMQ exploited; Defender zero-day; ZionSiphon hits water

Apache ActiveMQ actively exploited; Microsoft Defender zero-day disclosed; Russian state actors harvesting Office 365 tokens; ZionSiphon targets water infrastructure.

nginx-ui auth bypass exploited; SharePoint zero-day in 169 patches

Critical nginx-ui authentication bypass actively exploited; Microsoft releases 169 patches including SharePoint zero-day; n8n webhooks weaponized for phishing; WordPress plugins and signed software compromised.

Microsoft zero-days exploited; Mirax RAT hits 220K; PHP supply chain

Critical Microsoft zero-days under exploitation, Russian state hackers harvesting Office tokens via routers, and 220K users compromised by Mirax RAT. Supply-chain risks escalating across PHP and development ecosystems.

Adobe zero-day exploited; APT37 attacks; AI-powered exploitation

Critical Adobe zero-day under active exploitation, Russian state-sponsored token harvesting, and APT37 social engineering campaigns compound with AI-powered vulnerability discovery threats.

Adobe Reader zero-day; CPUID STX RAT supply-chain; Iran hits 4,000 ICS

Critical Adobe Reader zero-day, CPUID supply-chain compromise distributing STX RAT, Russian APT harvesting Office tokens via router exploits, and Iranian actors targeting 4,000+ U.S. industrial control systems.

Iran PLC attacks; Marimo RCE exploited in 10h; GlassWorm IDE infection

Critical threats span Iranian PLC targeting, Russian token harvesting, Marimo RCE exploitation within 10 hours, and GlassWorm IDE infections. Immediate patching and detection deployment required.

Marimo RCE exploited; Iran targets 4,000 US PLCs; Russian token theft

Critical exploitation of Marimo RCE, Iranian targeting of 4,000 US PLCs, and Russian token harvesting via routers demand immediate patching and access controls.

Adobe Reader zero-day exploited; APT28 router credential theft

Critical zero-day in Adobe Reader, state-sponsored credential theft via routers, and major supply-chain compromises demand immediate action across all organizations.

APT28 PRISMEX on NATO; ActiveMQ 13-yr RCE; Russian router token theft

APT28 deploys PRISMEX malware targeting NATO allies; 13-year-old ActiveMQ RCE and Russian router-based token theft critical; new botnets and healthcare ransomware disruptions.

FortiClient RCE exploited; DPRK & Chinese APTs hit EU institutions

State-sponsored DPRK and China-linked APT campaigns, critical FortiClient RCE exploit, and cascading supply chain attacks affecting European institutions and npm ecosystem.

TrueConf zero-day; TA416 hits EU govts; UNC1069 npm compromise

Critical zero-day in TrueConf, resurgent Chinese APT targeting European governments, North Korean npm supply chain compromise, and third-party vendor breaches require immediate response

Chrome & TrueConf zero-days exploited; widespread malware campaigns

Critical zero-day vulnerabilities in Chrome and TrueConf under active exploitation, combined with widespread malware campaigns targeting mobile and enterprise infrastructure.

TrueConf zero-day exploited; North Korea Axios npm compromise

Critical zero-day exploits in TrueConf and North Korean Axios compromise, plus wiper attacks and AI platform over-privilege vulnerabilities demand immediate response across cloud, government, and healthcare sectors.

Chinese APT in telecom backbone; Langflow zero-day exploited

State-sponsored Chinese APT embedded in telecom backbone, critical Langflow AI vulnerability actively exploited, wiper malware targeting Iran systems, and zero-click AI assistant vulnerabilities require immediate response.

VMware ESXi ransomware exploit; BlackSuit healthcare breach

Critical VMware ESXi vulnerability actively exploited by ransomware operators. BlackSuit group claims major U.S. healthcare breach. CISA adds 3 new CVEs. Microsoft patches Windows kernel zero-day. New PhishRelay kit enables real-time MFA bypass.