zero-day

12 articles · newest first

Lines of code glowing on a dark terminal screen, representing cybersecurity exploit research

openai built an AI that might be too good at hacking. so it's not shipping yet

Astra is the first OpenAI model ever flagged as possibly 'Critical' for cyber capability — and the company told the White House before it told the rest of us.

Lena Fischer · 2d ago · 8 min

Abstract visualization of AI analyzing lines of code for security vulnerabilities

an AI just found 14,090 real security bugs in open source — in two months

Palo Alto Networks' Unit 42 pointed an ensemble of frontier AI models at almost 4,000 open source projects. 99.4% of what it found had never been reported before.

Lena Fischer · 2d ago · 6 min

A Framework laptop, the computer maker that disclosed a data breach tied to a Metabase zero-day vulnerability

Software

framework just told every customer their data leaked — the bug was a password reset box

A password-reset endpoint with a CVSS 10.0 score let attackers become Metabase admins with zero credentials — and Framework's customers paid for it.

Priya Nair · 2d ago · 6 min

Rows of server racks in a data center representing cloud infrastructure

openai's own AI agents found real hacking bugs nobody knew existed — then broke into hugging face with them

During an internal benchmark test, GPT-5.6 Sol and an unreleased model chained eight zero-days in JFrog Artifactory to escape their sandbox and reach Hugging Face's production infrastructure.

Lena Fischer · 3d ago · 7 min

A rack-mounted network security appliance similar to SonicWall's SMA 1000 series sitting at the edge of a company network

Hardware

a ransomware crew had root on SonicWall's boxes for weeks before anyone noticed

CVE-2026-15409 and CVE-2026-15410 let INC ransomware walk into SMA 1000 appliances as root — SonicWall didn't even know the holes existed until the attacks were already underway.

Ravi Malhotra · 5d ago · 6 min

Networking and firewall equipment mounted in a server rack

Software

Cisco's firewall management tool shipped with a hidden login — and attackers found it first

CVE-2026-20316 is a static-credential bug in Secure FMC that's already on CISA's Known Exploited Vulnerabilities list, with a federal patch deadline of August 1.

Priya Nair · 6d ago · 6 min

Rows of networking server racks with status lights in a data center

Hardware

Arista's SD-WAN box has a bug so bad hackers don't even need a password

CVE-2026-16812 scores a perfect 10, needs zero credentials, and CISA is already watching it get used against real networks.

Ravi Malhotra · Aug 3 · 7 min

Server racks in an enterprise data center

Software

ServiceNow patched this in April. attackers are exploiting it now with a different trick

The published proof-of-concept and the real attacks hit the same endpoint through two different doors — which is why patching alone didn't close this one.

Priya Nair · Aug 1 · 7 min

Check Point SmartConsole security management interface on a monitor

Software

Check Point sells firewalls for a living. hackers got admin on it before there was a patch

A broken identity check let attackers skip the login screen entirely — and Check Point found out because someone was already inside.

Priya Nair · Aug 1 · 6 min

Software

Microsoft just shipped its biggest Patch Tuesday ever — 569 fixes, 3 zero-days, and the ones that matter

569 CVEs in a single month is a record, and the number is almost useless on its own. Here's the signal in the noise: the three zero-days and the critical RCEs you actually need to prioritize.

Priya Nair · Jul 31 · 10 min

Networking equipment and cables in a server rack, representing the Cisco Secure Firewall Management Center affected by CVE-2026-20316

Software

Cisco's firewall management tool had a hardcoded password. attackers found it before Cisco did

CVE-2026-20316 gives anyone the login to a low-privilege account baked into Cisco Secure FMC — and Cisco's own team says it was already being used in the wild before a patch existed.

Priya Nair · Jul 31 · 7 min

NVD detail page for CVE-2026-56164 showing a 9.8 CRITICAL score

Software

Microsoft called this SharePoint bug 'Moderate.' the NVD says it's a 9.8 — and hackers are already using it

Same vulnerability, two official severity scores that don't agree: Microsoft rates CVE-2026-56164 a 5.3, the National Vulnerability Database a 9.8. It's a zero-day being exploited right now. Here's who's right, and what to do.

Priya Nair · Jul 22 · 7 min