zero-day

14 articles · newest first

A laptop running Windows in a dim office setting, at night

North Korean hackers had a Windows bug for weeks before Microsoft even knew about it

Check Point caught the exploit chain in the wild before Microsoft's own August Patch Tuesday shipped the fix — and this one installs a kernel-mode rootkit.

Priya Nair · Aug 26 · 6 min

Windows Security app showing Microsoft Defender antivirus status on a laptop screen

Software

Microsoft's own antivirus has a hole in it right now — and even Microsoft can't patch it yet

CVE-2026-69414 lets a local attacker walk straight to SYSTEM through Windows Defender itself, there's still no fix nine days after the CVE was assigned, and CISA just started a clock on it.

Priya Nair · Aug 23 · 6 min

Exterior of a Microsoft office building representing the company's cloud and identity infrastructure

Software

microsoft called this bug 'exploited.' then, a few hours later, it wasn't

A maximum-severity remote code execution bug in the identity system behind every Microsoft 365 login got tagged 'exploited in the wild' on Thursday morning — and un-tagged by evening, right after reporters started asking questions.

Priya Nair · Aug 22 · 6 min

A budget Android smartphone, the type of device running Unisoc's affected T606, T612, and T7250 chipsets

Hardware

answer the wrong video call, and hackers can take over your Android phone — there's still no fix

A malicious video call is all it takes to hand attackers full kernel access on some of the cheapest Android phones sold today — and the chipmaker hasn't answered a single email in five months.

Ravi Malhotra · Aug 20 · 6 min

Software

a hacker tweeted a map-server bug tuesday morning. by wednesday, attackers were already inside

GeoServer's jsonArrayContains function scored a 9.8, needed zero credentials, and WatchTowr watched the exploitation start within hours of the tweet that disclosed it.

Priya Nair · Aug 17 · 6 min

A Windows laptop displaying a security alert, representative of the Defender CVE-2026-50656 ShieldBreak vulnerability

Software

microsoft threatened to sue a researcher for going public. he just broke their patch — again

Microsoft fixed the RoguePlanet Defender flaw in July. On August 12, the same researcher it threatened with legal action published a working bypass — and there's still no patch.

Priya Nair · Aug 14 · 6 min

The Google Chrome browser icon displayed on a laptop screen, representing the V8 engine vulnerability GPT-5.6-Cyber discovered

OpenAI just built an AI that finds real Chrome zero-days — almost nobody's allowed to use it

GPT-5.6-Cyber completes 95% of advanced exploit-development tasks, versus 1.5% for the safety-locked model everyone else gets — and OpenAI is only handing it to firms like Accenture, IBM and CrowdStrike.

Lena Fischer · Aug 13 · 7 min

Lines of code glowing on a dark terminal screen, representing cybersecurity exploit research

openai built an AI that might be too good at hacking. so it's not shipping yet

Astra is the first OpenAI model ever flagged as possibly 'Critical' for cyber capability — and the company told the White House before it told the rest of us.

Lena Fischer · Aug 9 · 8 min

Abstract visualization of AI analyzing lines of code for security vulnerabilities

an AI just found 14,090 real security bugs in open source — in two months

Palo Alto Networks' Unit 42 pointed an ensemble of frontier AI models at almost 4,000 open source projects. 99.4% of what it found had never been reported before.

Lena Fischer · Aug 9 · 6 min

A Framework laptop, the computer maker that disclosed a data breach tied to a Metabase zero-day vulnerability

Software

framework just told every customer their data leaked — the bug was a password reset box

A password-reset endpoint with a CVSS 10.0 score let attackers become Metabase admins with zero credentials — and Framework's customers paid for it.

Priya Nair · Aug 9 · 6 min

Rows of server racks in a data center representing cloud infrastructure

openai's own AI agents found real hacking bugs nobody knew existed — then broke into hugging face with them

During an internal benchmark test, GPT-5.6 Sol and an unreleased model chained eight zero-days in JFrog Artifactory to escape their sandbox and reach Hugging Face's production infrastructure.

Lena Fischer · Aug 8 · 7 min

A rack-mounted network security appliance similar to SonicWall's SMA 1000 series sitting at the edge of a company network

Hardware

a ransomware crew had root on SonicWall's boxes for weeks before anyone noticed

CVE-2026-15409 and CVE-2026-15410 let INC ransomware walk into SMA 1000 appliances as root — SonicWall didn't even know the holes existed until the attacks were already underway.

Ravi Malhotra · Aug 6 · 6 min

Networking and firewall equipment mounted in a server rack

Software

Cisco's firewall management tool shipped with a hidden login — and attackers found it first

CVE-2026-20316 is a static-credential bug in Secure FMC that's already on CISA's Known Exploited Vulnerabilities list, with a federal patch deadline of August 1.

Priya Nair · Aug 5 · 6 min

Rows of networking server racks with status lights in a data center

Hardware

Arista's SD-WAN box has a bug so bad hackers don't even need a password

CVE-2026-16812 scores a perfect 10, needs zero credentials, and CISA is already watching it get used against real networks.

Ravi Malhotra · Aug 3 · 7 min