ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

Valve

0 mentions in 7 days · 2 in 30 days · 4 total · first seen · last

Search everything

Timeline

VU#728712: Konami's Metal Gear Online 3 contains a heap-based buffer overflow

CERT/CC details CVE-2026-19874, a heap overflow in Metal Gear Online 3 letting match hosts execute code on lobby members' machines.

VU#728712 describes a heap-based buffer overflow in Konami's Metal Gear Online 3, tracked as CVE-2026-19874, affecting version 1.1.2.8 (Steam AppID 287700). The input-validation flaw lies in processing Steam lobby metadata tied to the player-removal feature, letting a match host trigger remote code execution on lobby members' machines via specially crafted data. The game is an 8v8 competitive shooter using Steam Matchmaking for lobbies.

CERT/CC Vulnerability Notes · 22d agoVulnerabilityCVE-2026-19874

Home & Small Office Wireless Routers Exploited to Attack Gaming Servers

Unit 42 details an updated Gafgyt botnet variant exploiting Zyxel, Huawei, and Realtek router vulnerabilities to recruit devices for DoS attacks on gaming servers.

Unit 42 researchers identified an updated Gafgyt variant derived from the JenX botnet that combines three remote code execution exploits: CVE-2017-18368 (Zyxel P660HN-T1A), CVE-2017-17215 (Huawei HG532), and CVE-2014-8361 (Realtek RTL81XX chipset). Shodan scans show more than 32,000 wireless routers worldwide potentially vulnerable to these exploits. The exploits act as droppers, pulling architecture-specific binaries from a malicious server (185.172.110.224), and the botnet performs denial-of-service attacks against gaming servers, most notably Valve Source engine servers.

Palo Alto Unit 42 · 28d agoMalware in the wildCVE-2017-18368CVE-2017-17215CVE-2014-8361

CEVA Logistics Cyberattack Disrupts European Warehouses and Shipments

Cyberattack on CEVA Logistics disrupted eight European warehouses and exposed customer data of clients including Valve, Ajax, and De Bijenkorf.

CEVA Logistics, part of CMA CGM Group, suffered a July 29 cyberattack that disrupted eight European warehouses and halted shipments of stored goods. Customer data linked to Valve, Ajax, and Dutch retailer De Bijenkorf was exposed, potentially including names, contact details, and online order information; Valve said payment details and passwords were not accessed. No ransomware group has claimed responsibility and the company has not disclosed technical details. A database containing customer lists, shipping records, and banking details was reportedly later offered for sale on a dark web marketplace.

Security Affairs · Aug 12, 2026Data breach in the wild

Cyberattack on logistics giant Ceva hits retailers and Steam customers across Europe

Cyberattack on Ceva Logistics disrupted eight European warehouses, delaying shipments for Bol, De Bijenkorf, Ajax and exposing Steam hardware buyers' data.

A cyberattack on Ceva Logistics disrupted operations at eight European warehouses, delaying shipments for Bol, De Bijenkorf, Ace & Tate, Ajax and Steam hardware customers. Attackers accessed two Ceva systems processing Bol orders, potentially exposing names, addresses, phone numbers, email addresses and order details. Valve began notifying European Steam customers whose hardware shipping data may have been compromised and is contacting data protection authorities. Ceva, with about 110,000 employees and over 1,700 facilities, has not disclosed the attackers or whether ransomware was involved.

The Record · Aug 11, 2026Data breach in the wild

Related CVEs

  • CVE-2017-183689.894%
    Unauthenticated OS Command Injection in Zyxel/Billion TrueOnline Routers
    CVE-2017-18368 is a critical (CVSS 9.8) unauthenticated OS command injection (CWE-78) in the Remote System Log forwarding function of Zyxel P660HN-T1A (v1 and v2) and Billion 5200W-T routers distributed by Thailand ISP TrueOnline. An unauthenticated attacker who can reach the router's web management interface sends a crafted remote_host parameter to the ViewLog.asp page, with no credentials or user interaction required. Successful injection executes arbitrary operating-system commands on the device, giving the attacker full control of the router (e.g., botnet recruitment, traffic/DNS manipulation, or pivoting into the subscriber's LAN). Only TrueOnline-issued units of these models are affected, meaning Thai broadband subscribers deployed with this CPE. The flaw is in CISA's KEV catalog (added 2023-08-07), carries a 94.4% EPSS (100th percentile), and related reporting shows IoT botnets (e.g., Gafgyt campaigns against End-of-Life Zyxel routers and multi-exploit campaigns like RondoDox) actively targeting such devices.
    · Zyxel P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 (TrueOnline-distributed firmware; model listed broadly as affected by CISA) · Zyxel P660HN-T1A v2 KEV PoC ×3mass
  • CVE-2014-8361—100%
    Improper Input Validation in Realtek SDK miniigd SOAP Service Enables Remote RCE
    The Realtek SDK, a software development kit embedded in routers, gateways, and similar network equipment sold under many OEM brands, contains an improper input validation flaw (CWE-20) in its miniigd UPnP SOAP service. A remote, unauthenticated attacker can trigger it by sending a crafted NewInternalClient request to the vulnerable SOAP interface, causing execution of malicious code on the device. Successful exploitation gives attackers control of affected devices, which can be used for botnet recruitment, staging further attacks, or ransomware operations. Affected parties are owners of devices built on the Realtek SDK, particularly routers and gateways with the UPnP service exposed to the internet. Exploitation is ongoing: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2023-09-18 and EPSS assigns it a 100% probability of exploitation within 30 days, though ransomware use is not confirmed.
    · Realtek SDK KEVmass
  • CVE-2026-198749.1<1%
    Heap-Based Buffer Overflow in Konami Metal Gear Online 3 Enables Code Execution
    CVE-2026-19874 is a critical heap-based buffer overflow (CWE-122) in the lobby-data handling of Konami's Metal Gear Online 3: the code trusts the "kick_num" field for the count of kicked-player identifiers (supplied as "kicked_id_%i" keys) without validating it against the 16-entry buffer sized for the game's maximum match size. An attacker who can supply crafted lobby data, such as a lobby host or participant, can set "kick_num" above 16, causing the parser to write past the end of the kicked-ID buffer and into adjacent memory containing Steam callback handler structures, overwriting function pointers and callback arguments. This can lead to control-flow hijacking and potentially arbitrary code execution within the game process; the CVSS 9.1 score reflects network reachability with no privileges or user interaction required. Any player running the affected title who joins or hosts lobbies with untrusted peers is exposed (the described code path touches Steam callback structures, indicating the Steam-integrated client); no fixed version information is included in the available data. There is currently no public proof-of-concept, no known in-the-wild exploitation, and the issue is not in CISA's KEV; EPSS estimates a 0.7% probability of exploitation within 30 days (52nd percentile).
    · Konami Metal Gear Online 3niche
  • CVE-2017-172158.878%
    Huawei HG532 with some customized versions has a remote code execution vulnerability.
    Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to launch attacks. Successful exploit could lead to the remote execution of arbitrary code.
    · huawei hg532 firmware—

Appears with

product Steam 3victim Ceva Logistics 2organization CERT/CC 1organization Security Affairs 1organization The Register 1organization Unit 42 1product HG532 1product Metal Gear Online 3 1product P660HN-T1A 1product RTL81XX 1product Source engine 1vendor Ajax 1vendor CEVA Logistics 1vendor CMA CGM 1vendor De Bijenkorf 1vendor Huawei 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.