./Zero-days & actively exploitedMon, 19 Oct 2026 12:01:13 GMT https://securityaffairs.com/201258/security/japans-siteguard-waf-flaw-cve-2026-106931-is-already-being-exploited.html1f4kr6sMon, 19 Oct 2026 07:43:12 GMTSecurity Affairs. Attackers are exploiting vulnerability CVE-2026-106931 in SiteGuard Server Edition to run commands as root or SYSTEM. EG Secure Solutions published an urgent alert warning of CVE-2026-106931, an OS command injection bug in SiteGuard Server Edition. Threat…VulnerabilityZero-day https://cybersecuritynews.com/plex-vulnerabilities-exploited-in-wild/53zhu3Mon, 19 Oct 2026 04:14:01 GMTCybersecurity News. Hackers are exploiting flaws in Plex Media Server to install cryptocurrency mining malware, with a researcher recording successful attacks against a honeypot on October 17, 2026. The activity follows the release of Plex2Shell, a public exploit that chains…VulnerabilityZero-dayMalware https://objective-see.org/blog/blog_0x50.html2pzuf7Sun, 18 Oct 2026 21:00:39 GMTObjective-See. A 0day logic flaw in Microsoft Excel leads to 'remote' code execution on macOS, via malicious macros.ResearchVulnerabilityZero-day https://objective-see.org/blog/blog_0x45.htmlsl86h1Sun, 18 Oct 2026 21:00:39 GMTObjective-See. Recently, an attacker targeted (Mac) users via a Firefox 0day. In this third post, we analyze a second backdoor used in the attack, detailing its persistence, capabilities, and ultimate identify it a new variant of the cross-platform Mokes malware!ResearchZero-day https://objective-see.org/blog/blog_0x44.html1fi2060Sun, 18 Oct 2026 21:00:39 GMTObjective-See. Recently, an attacker targeted (Mac) users via a Firefox 0day. In this second post, we fully reverse OSX.NetWire.A, revealing (for the first time!), its inner workings and complex capabilities.ResearchZero-day https://objective-see.org/blog/blog_0x43.html1u3demrSun, 18 Oct 2026 21:00:39 GMTObjective-See. Recently, an attacker targeted (Mac) users via a Firefox 0day. In this first post, we triage and identify the malware (OSX.NetWire.A) utilized in this attack, identifying its methods of persistence, and more!ResearchZero-day https://news.google.com/rss/articles/CBMieEFVX3lxTE5mYzNHYUxockhGUHZHZWRjTVB0ZWp2bjRIU0F6ejhzLWp1d3NNU3VVOUJSUF9HQkFJTF8yc3pSMUYxZF9MeGZvRGY2bTRqQmFXZDBGaTQwVnRJaE1YUXFwSU5ZbzRYek81c0p2S2ZpZzhTRDJVNjZRMtIBfkFVX3lxTE9WLVhCTGNyRmU0NmRIN3RSTmhKbVVwWFgyWDVQWlJwRm1NeHU2WlpuQ1NFNGZocTRDaV9yZWpJd1A5Rl94bXphZUNjQTRXUDZFMzZaUE9TbkpZeS15UFNDRmxlV0VkbUE4M1l1amg4V2t5UHBCRDJqdHRYWll5UQ?oc=51cwgrreSat, 17 Oct 2026 07:00:00 GMTCybersecurity News. Hackers Exploiting Plex Vulnerabilities in the Wild to Deploy Cryptominer Malware CyberSecurityNewsVulnerabilityZero-dayMalware https://www.zscaler.com/blogs/security-research/cve-2026-88771-inside-exploitation-critical-netscaler-rce-vulnerabilityzv7tvtFri, 16 Oct 2026 21:28:21 GMTZscaler ThreatLabz. IntroductionOn September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. The vulnerability carries a CVSS v3.1 score of 9.8…ResearchVulnerabilityZero-day https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugsbtyol5Fri, 16 Oct 2026 20:34:37 GMTDark Reading. Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.VulnerabilityZero-day https://www.volexity.com/blog/2026/10/16/mind-the-patch-gap-part-3-analysis-with-volexity-volcano-threat-intel-and-mcp/1mb6406Fri, 16 Oct 2026 18:27:25 GMTVolexity. Last month, Volexity published two blog posts in its Mind the (Patch) Gap series. The series details Volexity’s discovery of multiple Chinese threat actors simultaneously using zero-day exploits in Google […]ResearchVulnerabilityZero-dayAPTAI https://cyberscoop.com/china-espionage-attacks-beyondtrust-zero-day-armory-castle/bqhrqfFri, 16 Oct 2026 17:09:09 GMTCyberScoop. Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers.Zero-dayAPT https://www.cybersecuritydive.com/news/china-espionage-beyondtrust-zero-day-hacker/833240/jobatxFri, 16 Oct 2026 15:01:39 GMTCybersecurity Dive. Researchers say the hacker is harvesting credentials and stealing sensitive information.Zero-dayAPT https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-972291wm9uj3Fri, 16 Oct 2026 13:31:56 GMTRapid7. Overview On October 12, 2026, GitLab released 19.4.2 , 19.3.5 , and 19.2.8 to fix CVE-2026-97229 , an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar . GitLab assigned it a CVSS score of 10.0 and…ResearchVulnerabilityZero-day https://therecord.media/beyond-trust-cyberattack-chinad9z2hqFri, 16 Oct 2026 13:00:00 GMTThe Record. An alleged Chinese state-backed group is using a new zero-day affecting BeyondTrust IT support software to conduct espionage attacks.Zero-dayAPT https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog15fyp83Fri, 16 Oct 2026 12:00:00 GMTCISA Advisories. CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remote Support…AdvisoryVulnerabilityZero-day https://securityaffairs.com/201086/hacking/u-s-cisa-adds-atlassian-flaw-to-its-known-exploited-vulnerabilities-catalog.htmltp5ofkFri, 16 Oct 2026 11:05:55 GMTSecurity Affairs. U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Atlassian flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Atlassian flaw, tracked as CVE-2026-21589 (CVSS score of…VulnerabilityZero-day https://cybersecuritynews.com/beyondtrust-0-day-vulnerability-exploited/1hmg90iFri, 16 Oct 2026 08:17:57 GMTCybersecurity News. A critical zero-day vulnerability in BeyondTrust Remote Support was exploited in late August, weeks before the company disclosed the flaw and released a patch. The suspected China-linked espionage group ARMORY CASTLE used the weakness to access appliances,…VulnerabilityZero-dayAPT https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/1ijalyhFri, 16 Oct 2026 06:18:08 GMTBleepingComputer. BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]VulnerabilityZero-day http://www.zerodayinitiative.com/advisories/ZDI-26-779/mxxxl1Fri, 16 Oct 2026 05:00:00 GMTZDI Published Advisories. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sparx Systems Enterprise Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a…AdvisoryVulnerabilityZero-day https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.htmlc03lkbFri, 16 Oct 2026 04:59:36 GMTThe Hacker News. A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4),…VulnerabilityMalwareZero-day https://cybersecuritynews.com/adobe-acrobat-flaw/ubeba4Fri, 16 Oct 2026 04:05:46 GMTCybersecurity News. Adobe has fixed a flaw in Acrobat and Acrobat Reader that lets a malicious PDF corrupt memory when a user opens it. Tracked as CVE-2026-81983, the out-of-bounds write carries a CVSS score of 7.8 and could lead to code execution with the victim’s user rights.…VulnerabilityZero-day https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Meraki%20Security%20Hardening%20Release:%20October%202026%26vs_k=1f68e5fThu, 15 Oct 2026 19:37:28 GMTCisco Security Advisories. As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered…AdvisoryVulnerabilityZero-day https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/hn0p1gThu, 15 Oct 2026 14:00:00 GMTGoogle Threat Intelligence (+4 more sources). Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar)…ResearchVulnerabilityZero-dayAPTMalwareAdvisory https://www.cisa.gov/news-events/alerts/2026/10/15/cisa-adds-one-known-exploited-vulnerability-catalog1h76954Thu, 15 Oct 2026 12:00:00 GMTCISA Advisories. CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability This type of…AdvisoryVulnerabilityZero-day https://www.helpnetsecurity.com/2026/10/15/cve-2026-0322-cve-2026-76519-cve-2026-105133-cve-2026-105134-exploted/1b1h08qThu, 15 Oct 2026 10:43:51 GMTHelp Net Security. The US Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-0322, a high-severity remote code execution (RCE) vulnerability in the management interface of…VulnerabilityZero-day https://cybersecuritynews.com/microsoft-windows-server-0-day-flaw/1lwibd4Thu, 15 Oct 2026 09:58:35 GMTCybersecurity News. Microsoft patched a Windows Server vulnerability that lets a network-adjacent attacker crash a server with a crafted Distributed File System (DFS) referral response. Tracked as CVE-2026-70111, the flaw affects Windows Server 2019, 2022, and 2025. Corelight…VulnerabilityZero-day https://cybersecuritynews.com/poc-released-for-forticlient-ems-vulnerability/1302hfyThu, 15 Oct 2026 09:47:55 GMTCybersecurity News. A public proof-of-concept (PoC) for CVE-2026-35616, a critical authentication and authorization bypass in Fortinet FortiClient Endpoint Management Server (EMS), lets defenders test whether affected systems are exposed. The Python tool’s repository says the…VulnerabilityZero-day https://seclists.org/fulldisclosure/2026/Oct/211wk8r2eThu, 15 Oct 2026 07:42:13 GMTFull Disclosure. Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Synametrics Syncrify 6.2 build 1178, the closed-source incremental backup and file-replication server from Synametrics Technologies, Inc.…AdvisoryVulnerabilityZero-day https://seclists.org/fulldisclosure/2026/Oct/201wu8crdThu, 15 Oct 2026 07:42:12 GMTFull Disclosure. Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability chain in South River Technologies Titan MFT Server 26.0.0.364, the NextGen generation of the commercial managed file transfer server from South…AdvisoryVulnerabilityZero-day https://seclists.org/fulldisclosure/2026/Oct/191z1hotThu, 15 Oct 2026 07:42:10 GMTFull Disclosure. Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in SmartBear Collaborator Server 15.1.15101, the closed-source peer and technical code-review platform from SmartBear that runs as a Java web…AdvisoryVulnerabilityZero-day https://seclists.org/fulldisclosure/2026/Oct/181p1vzuThu, 15 Oct 2026 07:42:09 GMTFull Disclosure. Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in PacsOne Server 7.3.9, Premium Edition, Linux x86-64 distribution, the closed-source commercial PACS (medical imaging archive and DICOM…AdvisoryVulnerabilityZero-day https://seclists.org/fulldisclosure/2026/Oct/171x4b3ybThu, 15 Oct 2026 07:42:08 GMTFull Disclosure. Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Pal 2.1, the self-hosted PHP shopping-cart script from Maian Media (United Kingdom), oriented at PayPal checkout and distributed as a…AdvisoryVulnerabilityZero-day https://seclists.org/fulldisclosure/2026/Oct/161wubi9cThu, 15 Oct 2026 07:42:07 GMTFull Disclosure. Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Guardian 2.1, the self-hosted licensing system for PHP applications encoded with SourceGuardian, distributed as a closed-source…AdvisoryVulnerabilityZero-day https://seclists.org/fulldisclosure/2026/Oct/151xoabc9Thu, 15 Oct 2026 07:42:05 GMTFull Disclosure. Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Dataedo Portal 26.2.8 together with Dataedo Agent 26.2.8, the closed-source enterprise data-catalog and data-governance platform from…AdvisoryVulnerabilityZero-day https://seclists.org/fulldisclosure/2026/Oct/141xeapnaThu, 15 Oct 2026 07:42:04 GMTFull Disclosure. Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in CloudPanel Community Edition 2.5.4-3+clp-bookworm, the closed-source server-management panel from cloudpanel.io (Germany) that provisions…AdvisoryVulnerabilityZero-day https://seclists.org/fulldisclosure/2026/Oct/131y89iq7Thu, 15 Oct 2026 07:42:02 GMTFull Disclosure. Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Auerswald COMmander 6000 and COMmander 6000R, firmware 8.6D build 128154, the closed-source enterprise IP-PBX and unified-communications…AdvisoryVulnerabilityZero-day https://seclists.org/fulldisclosure/2026/Oct/121xy9x18Thu, 15 Oct 2026 07:42:01 GMTFull Disclosure. Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability chain in Abyss Web Server X1 2.16.22.0, the free edition of the closed-source Abyss web server from Aprelium (Tunisia), a product family that…AdvisoryVulnerabilityZero-day https://www.securityweek.com/palo-alto-networks-patches-pan-os-zero-day-exploited-for-remote-code-execution/utwm89Thu, 15 Oct 2026 06:59:54 GMTSecurityWeek (+1 more sources). The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available.VulnerabilityZero-day http://www.zerodayinitiative.com/advisories/ZDI-26-757/nhqtz1Thu, 15 Oct 2026 05:00:00 GMTZDI Published Advisories. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has…AdvisoryVulnerabilityZero-day https://news.google.com/rss/articles/CBMiaEFVX3lxTE1SRHZGUnFkUVdQY0IwYnhRcDJuNlRwdU13cHUyY0NqZDVoQTBpeTFzYUhYbXUyV0FfNDJib096WENzU2s2MDhFNko0ZWdjWmw1Rkp0Qk5qVjQ4aVUtTDVnZDJ5aU1EbndK0gFuQVVfeXFMT2VFdkNGV0J4cDVCVDVyU0JlZVVZTWRXQTE1d2RicDdGS2FCLUdFVHNMTFp1RVBvbnFBcVRkN25EOFpTNmhiaUxrNkxZMUlRbmtMUnpyQTJPTzlYbXJBLUlTR3JFbzhnc2o3cTZnbUE?oc=51fboee5Thu, 15 Oct 2026 03:42:50 GMTCybersecurity News. Hackers Exploit Palo Alto PAN-OS 0-day Flaw to Gain Root Code Execution on Firewalls CyberSecurityNewsVulnerabilityZero-day https://news.google.com/rss/articles/CBMigwFBVV95cUxQeDVhWU5LYkVpNllERW5XU09yQWFTdURVSWF3YTZiSmg2ZVVsZS11bk4zZHVZWUtsN0VMTUtvdGZ3LTZndkpRWllWcDVlZ0w3ZldwM0QwRC1UeTYzYXR1WUIzS3RXQTdDQ2xzS2JBZ0k0MjJ4VWRSaE01cDN0WjIwSlBEUdIBiAFBVV95cUxNREo2bFRobTdBTElkNzhaRDRWdHdaemppbG01ZTVwZlBkcG93NmQwbEVGTjVPTHozZnJhZjg4d2pnRzFaemJrWVhQS0NPMnhBb2RxR1VIbEhLeGZVYmJrRVFhZnZQRGRQcmxXSUtsaFBXazA2ZmlIMF84ZVlBNnpTUVB2TEpDRW5Q?oc=5h1ywhuThu, 15 Oct 2026 03:08:31 GMTCybersecurity News. Cisco Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks CyberSecurityNewsVulnerabilityZero-day https://horizon3.ai/attack-research/vulnerabilities/cve-2026-105133-and-cve-2026-105134/5ah1jwThu, 15 Oct 2026 00:24:30 GMTHorizon3.ai. Attackers are chaining CVE-2026-105133 and CVE-2026-105134 to bypass authentication and achieve remote code execution in AhsayCBS. Explore the technical findings, indicators of compromise, affected versions, hotfixes, and how NodeZero Rapid Response helps…ResearchVulnerabilityZero-day https://www.zscaler.com/blogs/security-research/threat-actor-abuses-agentic-ai-pentesting-framework-target-south-korean15oul6hWed, 14 Oct 2026 23:20:22 GMTZscaler ThreatLabz. IntroductionZscaler ThreatLabz analyzed a recently active exploitation campaign in which a threat actor abused ARTEX to target South Korean financial institutions. ARTEX is an open source agentic penetration testing framework developed in China that uses…ResearchZero-dayAI https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/1pc963bWed, 14 Oct 2026 22:56:47 GMTBleepingComputer (+3 more sources). Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]VulnerabilityZero-dayAdvisory https://www.theregister.com/security/2026/10/14/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims/53031681fl3dr8Wed, 14 Oct 2026 21:40:29 GMTThe Register. Both Switchzilla and CISA sound the alarmVulnerabilityZero-day https://cyberscoop.com/microsoft-patch-tuesday-october-2026/1vpgiwvWed, 14 Oct 2026 17:42:11 GMTCyberScoop. In its October Patch Tuesday, the tech giant addressed more defects in one month than any annual total on record. Nearly 4 in 5 vulnerabilities affect Windows.VulnerabilityZero-day https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/1ugpdvWed, 14 Oct 2026 17:29:14 GMTBleepingComputer (+5 more sources). Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. [...]AdvisoryVulnerabilityZero-day https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Email%20Gateway%20and%20Secure%20Email%20and%20Web%20Manager%20Security%20Hardening%20Release:%20September%202026%26vs_k=117tmr8dWed, 14 Oct 2026 16:00:43 GMTCisco Security Advisories. As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software…AdvisoryVulnerabilityZero-day https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-day/128ewuwWed, 14 Oct 2026 12:58:07 GMTBleepingComputer. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. [...]VulnerabilityZero-day https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-cataloguz10mtWed, 14 Oct 2026 12:00:00 GMTCISA Advisories. CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability CVE-2026-76519 Cisco Secure Email Gateway Relative…AdvisoryVulnerabilityZero-day https://www.malwarebytes.com/blog/bugs/2026/10/update-windows-record-patch-tuesday-fixes-flaw-already-under-attackk3wde7Wed, 14 Oct 2026 11:26:09 GMTMalwarebytes Labs. Microsoft’s October updates address a record 1,413 vulnerabilities, including a Windows flaw attackers are already exploiting and two other zero-days.ResearchVulnerabilityZero-day https://securityaffairs.com/200895/hacking/volexity-uncovers-stealthy-ivanti-vpn-attack-using-three-zero-day-vulnerabilities.html1spuc0zWed, 14 Oct 2026 10:15:30 GMTSecurity Affairs. Ivanti VPN zero-days let attackers gain root access, steal credentials, evade detection, and prepare for wider network compromise. On October 5, Volexity started investigating suspicious activity at one of its monitoring customers and traced everything back…VulnerabilityZero-day https://www.helpnetsecurity.com/2026/10/14/ivanti-zero-days-gain-root-patched-vpn-appliances/jeiaunWed, 14 Oct 2026 08:59:19 GMTHelp Net Security. A threat actor has been using an exploit chain combining three vulnerabilities in Ivanti’s Connect Secure (ICS) appliances to breach organizations, collect credentials, exfiltrate configuration data, and perform network reconnaissance. “In the first week of…VulnerabilityZero-day https://cybersecuritynews.com/ivanti-connect-secure/cbhbpdWed, 14 Oct 2026 07:51:39 GMTCybersecurity News. Attackers chained three zero-day flaws in Ivanti Connect Secure VPN appliances to gain root-level access without logging in, then searched for credentials and sensitive Active Directory data. The activity, which began on October 3, 2026, targeted a fully…VulnerabilityZero-day https://news.google.com/rss/articles/CBMilgFBVV95cUxPTUh2THFuUjVPR0xnQ1ltRldvQnVRTWJSLVYxTlNzTmpRekFBODRSaVRMYjRocHNsVXE5dkVwaEtBNDdRQ29uWTdQcDEyZXJGZVNGR3JudlhaUkxmZ3hJZmF2RmhNQnM1Q0RibTFmU0hRQno3OXBBdVZHZHY1a1Q5bi0xMFN0SHAzX3lPa19HZG1vLTJuUmc?oc=5r1rsijWed, 14 Oct 2026 07:49:56 GMTDecipher (+1 more sources). Ivanti Connect Secure Zero-Day Exploited in Attacks decipher.scZero-dayVulnerability https://securityaffairs.com/200910/malware/how-a-leaked-builder-of-xworm-turned-a-remote-access-trojan-into-a-surveillance-kit.html248pc0Wed, 14 Oct 2026 05:46:19 GMTSecurity Affairs. Netskope tracks four XWorm versions in the wild, 46 plugins, and new tools for location, audio and live browser control, with detections up fourfold. Netskope Threat Labs has been following XWorm since September 2024, and its latest report shows the malware…Zero-dayBreachMalware https://news.google.com/rss/articles/CBMibEFVX3lxTE1xdUd6ZVVGUkJrNkJSczBNdXFUakI4cElOM1UxdHNyS1VZRjBiNEFTUzludFBDa1VTZW9SOV8tbEEwdktSUGY1alEzVU1wNGY0VWJNeWhLaDhLbzVkTDlqeWRkMVdPWFJudk9tZdIBckFVX3lxTE11Y1FCSDhkcXNTbjdxM2ozWG5TU0hHc3FqTl9lbXlnbEFHSlk1YTlCbHQ5VlBoSEdPUURUVm44b1pIeENUMy11aHFSRkRlblBNNTRCbWFiYlA3cmhCVldlT0QwTUhJNXIzZjRXa3dBVUFYdw?oc=5wuel0mWed, 14 Oct 2026 04:27:01 GMTCybersecurity News. Microsoft Windows Shell 0-Day Vulnerability Actively Exploited in Attacks CyberSecurityNewsVulnerabilityZero-day https://cybersecuritynews.com/windows-shell-0-day-exploited/nyg2b4Wed, 14 Oct 2026 03:28:11 GMTCybersecurity News (+4 more sources). Microsoft has patched an actively exploited Windows Shell zero-day vulnerability that allows attackers to bypass Mark of the Web protections. Tracked as CVE-2026-96951, the flaw was addressed in the October 2026 Patch Tuesday updates. It carries a CVSS score…VulnerabilityZero-day https://cyberscoop.com/ivanti-connect-secure-zero-day-actively-exploited/1djcbivTue, 13 Oct 2026 22:10:42 GMTCyberScoop. The security vendor said it initially discovered a portion of the defect during internal security checks in June, but the company said it didn’t meet the threshold for an out-of-band release.VulnerabilityZero-day https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html11c06yzTue, 13 Oct 2026 17:33:11 GMTThe Hacker News. An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions…VulnerabilityZero-day