search
zero-day vulnerabilities
Trends
- 1Apple patches actively exploited flaw CVE-2024-27834▼⚠️ FAILLE CRITIQUE CVE-2024-27834 activement exploitée : authentification incorrecte sur plusieurs produits Apple 🔗 http
A critical security vulnerability, CVE-2024-27834, involving incorrect authentication handling, is being actively exploited across several Apple products. The flaw has drawn attention from security authorities, including CISA, which tracks actively exploited vulnerabilities in the wild. Apple users are urged to update their devices promptly, as the bug could let attackers bypass authentication protections. Security specialists are warning organizations to check their systems and apply fixes without delay.
- 2Two unpatched zero-days enable full NTE account takeover▼Two unpatched zero-day vulnerabilities in NTE allow for full account takeover
Security researchers at Hunio have disclosed two unpatched zero-day vulnerabilities in NTE that together allow a complete takeover of a user's account. Because both flaws remain unfixed, any affected account can reportedly be compromised until a patch is released. The disclosure highlights ongoing concerns about how quickly vendors respond to critical security reports.
- 3Chinese Hackers Exploit VMware ESXi Zero-Day to Cover Tracks●Chinese Hackers Exploit VMware ESXi 0-Day to Hide Malicious Activity on Compromised Servers Details: https:// cybersecur
Hackers linked to China have exploited a previously unknown vulnerability in VMware ESXi to conceal malicious activity on compromised servers. The zero-day, reported in the ESXi logging component, allowed attackers to tamper with logs and avoid detection after gaining access. Security researchers say organisations running virtualisation infrastructure should patch promptly and audit logs, as the flaw is being actively used in intrusions.
- 4Zyxel switch zero-day exploited across 48 countries●🤖 Zyxel GS1900 switches: CVE-2026-107441 (out-of-bounds write in the web admin interface) exploited as a 0-day to compro
A zero-day vulnerability in Zyxel GS1900 switches, tracked as CVE-2026-107441, has been used to compromise 996 devices in 48 countries. The flaw is an out-of-bounds write in the web admin interface that let unauthenticated attackers execute OS commands via crafted HTTP requests, steal device configurations, and grab hashed root credentials. Security commentators are urging administrators to patch and restrict management interfaces.
- 5Ubuntu criticised for ignoring zero-day vulnerability for weeks●Ubuntu ignora una vulnerabilità zero-day da quasi tre settimane. Questa inerzia è inaccettabile. La sicurezza degli uten
Ubuntu is facing criticism over a zero-day vulnerability that has reportedly gone unaddressed for nearly three weeks. Commenters call the delay unacceptable, arguing user security must take priority even if it requires rapid, frequent releases, and are asking whether this handling of security issues is acceptable.
- 628 Zero-Day Vulnerabilities Found in Under Two Days▼28 Zero-Day Findings in Less Than Two Days: What AI-Speed Discovery Means for Robotics
Researchers reported uncovering 28 zero-day vulnerabilities in less than two days, crediting AI-assisted discovery for the speed of the findings. The result highlights how automated approaches could transform security testing for robotics, where software flaws in connected machines carry physical risks. Security experts are weighing what rapid, scalable vulnerability discovery means for defenders racing to patch industrial and consumer robots.
- 7Ivanti patches two more ConnectSecure zero-days exploited in attacks●# Ivanti patches two more # ConnectSecure zero-days chained in attacks https://www. bleepingcomputer.com/news/secu rity/
Ivanti has released security updates fixing two additional zero-day vulnerabilities in its Connect Secure VPN appliance, which attackers were chaining together in active exploitation. The patches follow earlier emergency fixes for flaws in the same product line that had already been used to compromise devices. Administrators are being urged to update their appliances and check for signs of compromise.
- 8Chinese Hackers Used VMware ESXi Zero-Day to Breach US Law Firms●Chinese espionage group WARP PANDA exploited a VMware ESXi zero-day to conceal operations and breach US law firms before
A Chinese espionage group tracked as WARP PANDA exploited a previously unknown vulnerability in VMware ESXi to hide its operations and break into US law firms, according to cybersecurity reporting. The intrusions took place before Broadcom issued patches for the flaw, raising concerns about targeting of legal practices holding sensitive client data.
- 9New Ivanti Connect Secure zero-day fuels criticism●Look at Ivanti Connect Secure right now, and it's less of a product and more of a case study. Specifically, on how to bu
Security researchers are sharply criticizing Ivanti Connect Secure after yet another zero-day vulnerability was disclosed. Commenters describe the VPN product as effectively a case study in how to build an entry point for every known threat group, reflecting a pattern of repeated exploitable flaws in the platform. The remark highlights ongoing frustration in the infosec community over the product's security record and its role as an attack surface.
- 10Rapid7 reports new Ivanti Connect Secure zero-days exploited in the wild●New. Rapid7: Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) https:/
Security firm Rapid7 has disclosed two additional zero-day vulnerabilities in Ivanti Connect Secure, CVE-2026-111357 and CVE-2026-118527, and says both are being actively exploited by attackers. The finding adds to a string of recent Ivanti VPN flaws, prompting urgent patching guidance for organisations running affected appliances.