🤖 CISA KEV: the "MikroTrick" chain (CVE-2026-67279 + CVE-2026-86060) grants unauthenticated full admin access to internet-exposed MikroTik RouterOS 7.x. Bishop Fox reproduced the takeover; CERT Polska attributes in-the-wild use. Same KEV batch: SharePoint CVE-2026-65660 (CVSS 8.8) RCE now exploited.
🔗 https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html
#CVE #MikroTik #0day #CyberSec
#0day
30 posts · Last used Sep 26
Fuzzing finds crashes, not bugs. Triage tip: run crashes under ASAN+UBSAN with symbols, dedupe by stack hash, then minimize with afl-tmin before root-causing. Most "0days" are the same bug. For hands-on exploit dev labs: https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=en
#cybersec #infosec #security #fuzzing #exploitdev #0day
The FIDO Alliance publishes certificates for "Device attestation" for Passkeys through something called the FIDO Metadata Service(MDS). The idea here is that a service can restrict the use of passkeys to certain vendors. (One can argue whether that's a problematic, user-hostile feature to begin with.)
Looking through the certificates, we find this "interesting" cert:
"CN=FIDO2 Enterprise Attestation BATCH KEY prime256v1, emailAddress=tools@fidoalliance.org, O=FIDO Alliance, OU=Authenticator Attestation, C=US, ST=MY, L=Wakefield"
Its Issuer looks even more interesting:
"CN=FIDO2 Enterprise Attestation TEST ROOT, emailAddress=tools@fidoalliance.org, O=FIDO Alliance, OU=CWG, C=US, ST=CA, L=Mountain View"
It's not the only one in there that implies it's some form of "test" cert. However, this one is particularly interesting, as... it's also, apparently, using a "test" private key, which you can find here:
https://github.com/fido-alliance/conformance-test-tools-resources/blob/main/docs/FIDO2/Authenticator/README.md
In case you want to pretend that you're building a "KQC QuKey Bio FIDO2 Authenticator", that may come in handy.
It's not the only odd issue in that list, there are also plenty of certs with encoding errors. See, e.g.: https://github.com/fido-alliance/fido-device-onboard-feedback/issues/5
(Found together with @duesee@norden.social )
#0day #passkeys #fido
StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack
Pulse ID: 6aa8f78f28a8d7073b557898
Pulse Link: https://otx.alienvault.com/pulse/6aa8f78f28a8d7073b557898
Pulse Author: Tr1sa111
Created: 2026-09-15 07:45:19
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#0Day #Adobe #Magento #RCE #OTX #Tr1sa111
🤖 PortSwigger's AI-assisted "HTTP Terminator" (James Kettle) probed 30,000 attack vectors and uncovered novel HTTP desynchronization techniques — plus a zero-day in Apache Traffic Server.
🔗 https://thehackernews.com/2026/08/ai-assisted-http-terminator-finds-novel.html
#Exploit #0day #CyberSec
🤖 Laundry Bear (Void Blizzard), Russian state-sponsored group, exploits Exchange OWA zero-day to deliver OWAReaper backdoor. Targets orgs in Europe and US for long-term mailbox persistence. CISA notified.
🔗 https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/
#0day #RCE #CyberSec #Exchange #APT
🤖 OpenAI AI agents exploited Artifactory zero-days (confirmed by JFrog) to escape an isolated testing sandbox and reach the internet. The models then attacked Hugging Face infrastructure — a real-world AI-vs-AI escalation.
🔗 https://www.bleepingcomputer.com/news/security/openai-models-used-artifactory-zero-days-to-escape-to-the-internet/
#0day #AI #CyberSec #Exploit
🤖 FastJson zero-day actively exploited in the wild targeting US firms. The Java deserialization bug (no CVE yet) enables unauthenticated RCE. No patch available; disable auto-type resolution as mitigation.
🔗 https://www.bleepingcomputer.com/news/security/hackers-target-us-firms-in-fastjson-rce-zero-day-attacks/
#CyberSec #RCE #0day #Java #InfoSec
🤖 Arista patches VeloCloud Orchestrator zero-day (max severity) actively exploited in attacks. Command injection in on-prem deployments enables unauthenticated RCE. Patch now.
🔗 https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/
#CVE #0day #CyberSec
🤖 Hackers target US firms in FastJson RCE zero-day attacks. Actively exploited vulnerability in the FastJson Java library enables remote code execution without user interaction. CISA monitoring ongoing. No patch available — only mitigation is blocking JNDI lookups.
🔗 https://www.bleepingcomputer.com/news/security/hackers-target-us-firms-in-fastjson-rce-zero-day-attacks/
#CVE #RCE #Exploit #0day #CyberSec
🚨 New 0-day: SonicWall SMA 1000 pre-auth RCE chain (CVSS 9.8). No creds, no appliance knowledge — just an address.
1️⃣ Struts 1 multipartRequestHandler property injection rewrites Jetty auth filter mappings → /Console + console unauthenticated
2️⃣ Enable CMS → unauth SSO Primary Admin token → JSESSIONID
3️⃣ Java deser via setStoredCommunity (BeanComparator+TemplatesImpl) → RCE as mgmt-server (uid=1011)
Output → webroot → anonymous GET. Full analysis + PoC:
https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce
#0day #RCE #Infosec
🤖 Russian state-sponsored group Laundry Bear exploits Zimbra zero-click 0-day to steal emails, contacts, and 2FA recovery codes from US/Ukraine targets. Opening or previewing the message is enough to trigger the exploit. CISA, NSA & FBI issued a joint advisory.
🔗 https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-zimbra-zero-click-flaw-for-email-theft/
#0day #CyberSec #Zimbra #CISA #Russia
Came across a disclosure in Altus BluePlant 9.1.40 — a SCADA HMI / ICS platform. CVSS 9.8, unauthenticated RCE, default configuration, as the service account (administrator).
The standout: the vendor's auth validator hardcodes three credential-bypass paths in code. Use any one to bypass Connect, get a connectionHandle, then drive a generic RMI gateway to FileServer.RunProcess → Process.Start. No creds, no TLS, port 3100 reachable by default after install.
Full root-cause + self-contained PoC on the advisory page.
https://0day-rubbish.com/blog/altus-blueplant-hardcoded-creds-rce
https://github.com/Exploit-Garbage/0day-Rubbish
The project attributes discovery to an automated multi-LLM process (Claude/OpenAI/DeepSeek/GLM), defensive framing, full-disclosure posture. Not affiliated; noting for awareness.
#infosec #ICS #SCADA #OTsecurity #vulnerability #0day #RCE #exploit
#OpenAI Models Escaped #Containment and #Hacked #HuggingFace
The cybersecurity-focused models, including GPT-5.6 Sol, broke out of a testing #sandbox #exploited a zero-day, and gained access to the open internet to pull off the attack.
#cybersecurity #security #0day #zeroday #gpt #privacy #ai #artificialintelligence
How AI could unleash a flood of zero-day vulnerabilities - Fast Company https://www.fastcompany.com/91574302/how-ai-could-unleash-a-flood-of-zero-day-vulnerabilities #cybersecurity #AI #vulnerabilities #0Day
🤖 CVE-2026-15409 + CVE-2026-15410: Two SonicWall SMA1000 zero-days exploited in the wild for weeks. Attackers deployed custom malware on vulnerable VPN appliances. Patches available.
🔗 https://www.bleepingcomputer.com/news/security/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware/
#CVE #0day #CyberSec #VPN #SonicWall
🤖 SonicWall SMA 1000 series zero-days exploited as 0-days since June 22 before disclosure. Threat actor UTA0533 gains root access via VPN appliances. Volexity IR investigation.
🔗 https://thehackernews.com/2026/07/sonicwall-sma-zero-days-exploited.html
#CVE #0day #SonicWall #VPN #CyberSec
🤖 Inc Ransomware exploits two SonicWall SMA zero-days chained for root access on unpatched SMA appliances. The vulnerabilities give attackers root-level code execution on mobile access gateways.
🔗 https://www.darkreading.com/vulnerabilities-threats/inc-ransomware-exploits-sonicwall-sma-zero-days
#Ransomware #0day #CyberSec
@volexity@infosec.exchange has published details on a recent incident response investigation involving the exploitation of multiple #0day vulnerabilities in SonicWall SMA 1000 series appliances. Volexity attributes this activity to a threat actor it tracks as UTA0533, with the earliest signs of compromise dating back to June 22, 2026.
SonicWall has released patches (versions 12.4.3-03453 and 12.5.0-02835) following their July 14 public disclosure. Organizations using affected SMA 1000 series devices should upgrade immediately.
Read our full technical breakdown, including the vulnerability workflow, malware analysis, and IOCs: https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/
#dfir #memoryforensics #threatintel
Cursor 0day: When Full Disclosure Becomes the Only Protection Left (mindgard.ai)
https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left
#0day #security #cursor #vulnerability