ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “publishing”

14 stories in the last 3d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI safety & security 28Vulnerability 24Industry 18Exploit / PoC 17Advisory 15Malware 15Research 13Policy & legal 12AI industry 11Threat actor 11AI research 11Tools 9Data breach 8AI policy 5
SeverityAllcritical 11high 49medium 42low 5info 97

Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges

Linux kernel RDS zero-copy flaw CVE-2026-43502 (ZcopyReaper) lets unprivileged local users gain root; fix in 7.1-rc3, public PoC published.

CVE-2026-43502, dubbed ZcopyReaper, is a Linux kernel local privilege escalation flaw in the RDS zerocopy send path, present since kernel 4.17, allowing unprivileged local attackers to gain root. NebuSec researcher Yuan Tan demonstrated root escalation on openSUSE kernel 6.4.0-150600.23.100; the fix landed in commit 44b550d88b26 with Linux 7.1-rc3 the first patched mainline release. Exploitation requires CONFIG_RDS and CONFIG_RDS_TCP but not unprivileged user namespaces, and PoC exploit material is publicly released alongside more than 20 other exploitable 2026 kernel CVEs.

GBHackers · 1d agoExploit / PoCCVE-2026-43502CVE-2026-43501CVE-2026-43074+4 CVEs1

CISA Warns of Critical ScreenConnect Vulnerability Actively Exploited in Attacks

CISA added actively exploited ConnectWise ScreenConnect flaw CVE-2026-84869 to the KEV catalog, setting a September 14 patch deadline.

CISA added CVE-2026-84869, a critical improper privilege management and missing authorization flaw (CWE-269, CWE-862) in ConnectWise ScreenConnect, to its Known Exploited Vulnerabilities Catalog on September 11, 2026, confirming active exploitation. The flaw lets attackers transfer files to a device and execute them during an active remote ScreenConnect session without authorization or host-user confirmation, enabling payload delivery, unauthorized tools, and persistence while blending into legitimate remote-management traffic. CISA set a September 14 remediation deadline under BOD 26-04 and flagged the vulnerability as requiring forensic triage. ConnectWise has published a security bulletin, and defenders are urged to review exposure, sessions, file-transfer records, and outbound connections.

Cyber Security News · 10h agoExploit / PoC in the wild 4 sourcesCVE-2026-848691

14th September – Threat Intelligence Report

Check Point weekly digest: Microsoft's record 974-vuln Patch Tuesday ships two actively exploited Windows zero-days; IDScan.net, Mathspace, Revolut suffer breaches.

Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities, including two actively exploited privilege-escalation zero-days, CVE-2026-85880 and CVE-2026-81963, plus 20 flaws allowing unauthenticated remote code execution. Disclosed breaches include IDScan.net (identity documents), Mathspace (over 1 million people via Metabase CVE-2026-72898), Revolut, and Florida DMV (ShinyHunters). GitLab fixed critical CVSS 10.0 path traversal CVE-2026-85706, and MikroTik fixed chainable RouterOS flaws CVE-2026-67276 and CVE-2026-86060. The report also covers the PuzzleMask LLM jailbreak technique, GoldFactory's Gigabud Android fraud, and the BlueMoon Chromium exploit chain (CVE-2026-85046).

Check Point Research · 2d agoExploit / PoC in the wildCVE-2026-72898CVE-2026-85880CVE-2026-81963+4 CVEs2· 1 read

Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories

Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.

Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.

Cyber Security News · 2d agoExploit / PoC in the wildCVE-2026-85880CVE-2026-81963CVE-2025-25249+3 CVEs3

CVE-2026-86218 | N-able N-central Pre-Authentication Remote Code Execution Vulnerability

N-able N-central pre-auth RCE CVE-2026-86218 (CVSS 10.0) is actively exploited; CISA added it to KEV and a hotfix is available.

CVE-2026-86218 is a critical pre-authentication remote code execution flaw (CWE-96 static code injection) in N-able N-central servers, scored 10.0 CVSS 4.0 by N-able and 9.8 CVSS 3.1 by NIST. N-able fixed it in N-central 2026.3 Hotfix 4 (build 2026.3.1.14) on September 5, 2026, and has already patched hosted NCOD environments. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 8, 2026, citing evidence of active exploitation, though researchers have not attributed every reported N-central compromise to this flaw. Horizon3 released a NodeZero Rapid Response test to validate exposure and recommends log review for prior compromise.

Horizon3.ai · 10h agoExploit / PoC in the wild 14 sourcesCVE-2026-862182

PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug

Wordfence blocked over 100,000 exploitation attempts against CVE-2026-27540 in WooCommerce Wholesale Lead Capture, letting attackers upload PHP webshells to WordPress sites.

Wordfence reported more than 100,000 blocked exploitation attempts against CVE-2026-27540 in the WooCommerce Wholesale Lead Capture plugin (roughly 6,000 active installs), which was disclosed and patched on February 20 in version 2.0.3.2. The unauthenticated AJAX handler wwlc_file_upload_handler reads permitted file extensions from the attacker-controlled request, enabling arbitrary file upload of PHP files such as shell.php that report host details and serve further upload forms. Attack activity peaked between June 4 and June 17, 2026, with additional waves on July 1 and August 30. Wordfence rates the flaw CVSS 9.8, while Patchstack's CVE record lists 9.0.

Infosecurity Magazine · 11h agoExploit / PoC in the wild 6 sourcesCVE-2026-27540

Android 0-day Vulnerability on Google Pixel Devices Actively Exploited in Attacks

Google patched CVE-2026-58704, an actively exploited Android zero-day allowing proximal privilege escalation via the Pixel cellular modem, urging the 2026-09-05 patch.

Google confirmed CVE-2026-58704, a high-severity elevation-of-privilege flaw in the Pixel cellular modem, is being exploited in limited, targeted attacks and shipped emergency fixes in the September 2026 Pixel Update Bulletin. The low-complexity bug requires no user interaction and enables proximal/adjacent privilege escalation with no additional execution privileges, phrasing Google has historically used for spyware-vendor and state-aligned zero-days. The Pixel bulletin patches 110 flaws including 12 critical RCEs, while the broader September Android update addressed roughly 180 vulnerabilities, including Wi-Fi memory-corruption bug CVE-2026-28662.

Cyber Security Newsupdated · 8h agofirst · 16h agoExploit / PoC in the wild 8 sourcesCVE-2026-58704CVE-2026-28662

Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)

Acronis warns CVE-2026-87886, an authenticated Linux privilege escalation flaw in its cPanel, WHM, and Plesk backup plugins, is under limited targeted exploitation; patches released.

Acronis disclosed CVE-2026-87886, a privilege escalation vulnerability caused by insecure file permissions in its backup plugins for cPanel, WHM, and Plesk, platforms popular among hosting providers and MSPs. Exploitation has been detected in the wild in limited, targeted attacks against cPanel & WHM deployments, with no exploitation observed on Plesk so far, and the low-complexity attack requires no user interaction. Fixes shipped last week: backup plugin version 1.9.3 HF3 for cPanel & WHM and extension version 1.8.11 for Plesk.

Help Net Securityupdated · 15h agofirst · 16h agoExploit / PoC in the wild 6 sourcesCVE-2026-87886

Enterprises Warned of Attacks Exploiting WSO2 Vulnerability

Attackers are actively exploiting CVE-2026-5430 (CVSS 10), a WSO2 JWT authentication bypass, to access enterprise API credentials and sensitive data.

WatchTowr's honeypot network recorded the first exploitation attempt of CVE-2026-5430 on September 13, roughly two months after the CVE record was published in early August. The flaw, patched by WSO2 in April with an advisory in May, carries a maximum CVSS score of 10 and allows JWT authentication bypass via tokens signed with unsupported algorithms, enabling unauthorized access and full account takeover. A forged JWT observed in the wild granted access to API backend endpoints, credentials, and consumer keys and secrets for every registered application. WSO2's API Manager, API Control Plane, Traffic Manager, and Universal Gateway are affected, and the platform serves nearly 1,000 enterprise customers in banking, government, telecom, and logistics.

SecurityWeekupdated · 11h agofirst · 17h agoExploit / PoC in the wild 3 sourcesCVE-2026-54302· 1 read

Public PoC Released for Apache Superset SQL Injection Vulnerability

A public Python PoC exploit is available for CVE-2026-23980, an authenticated error-based SQL injection in Apache Superset versions before 6.0.0.

CVE-2026-23980 is a SQL injection flaw (CWE-89) in Apache Superset affecting all releases before 6.0.0, exploitable via the sqlExpression and where parameters by authenticated users with read-level access. A public repository containing a Python exploit.py proof-of-concept has been released, reducing attacker effort against exposed instances. Apache disclosed the issue on February 24, 2026 and fixed it in Superset 6.0.0. Defenders should upgrade and monitor logs for malformed queries, database errors, and unusual activity from low-privilege accounts.

Cyber Security Newsupdated · 16h agofirst · 18h agoExploit / PoC 2 sourcesCVE-2026-239801

Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day

Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) is actively exploited for root command execution; CISA added it to KEV.

Cisco disclosed critical zero-day CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway, remotely exploitable without authentication via crafted emails containing malicious SQL statements, leading to arbitrary command execution with root privileges. The flaw affects physical and virtual appliances regardless of configuration and has no workarounds. Cisco PSIRT confirmed active exploitation, and CISA added the CVE to its KEV catalog on September 14 with a federal remediation deadline of September 17. Admins should review mail_logs for suspicious SQL statements such as 'COPY.*TO PROGRAM'.

Security Affairsupdated · 12h agofirst · 1d agoExploit / PoC in the wild 17 sourcesCVE-2026-764615· 2 reads

Hackers Mass-Scan Exposed Vite Servers to Steal AWS and Azure Cloud Credentials

F5 honeypots record mass scanning of exposed Vite dev servers exploiting CVE-2026-39364 to harvest AWS and Azure cloud credentials.

F5 honeypots recorded 807 session-grouped attacks and roughly 32,000 raw events in August 2026 against internet-exposed Vite development servers, up from 1,732 events in the previous three months. Scanners abused CVE-2026-39364 (Vite 7.1.0-7.3.1, 8.0.0-8.0.4), bypassing server.fs.deny via @fs routes with ?raw/?import query parameters and double encoding to read .env files, AWS SSO caches, Azure tokens, and Terraform state. The same infrastructure also probed CVE-2025-29927 (Next.js), CVE-2025-30208, CVE-2025-31125 (KEV-listed January 2026), and CVE-2024-45811. Most traffic originated from Google Cloud IP ranges, with the US accounting for 17,297 events.

Cyber Security Newsupdated · 1d agofirst · 2d agoExploit / PoC in the wild 4 sourcesCVE-2026-39364CVE-2025-29927CVE-2025-30208+2 CVEs1

Human Attacker Hits Machine-Speed Exploitation of Marimo RCE

Sysdig details a human attacker chaining pre-auth RCE in Marimo (CVE-2026-39987) to AWS credentials and a bastion host in eight seconds.

Sysdig's Threat Research Team documented an intrusion where an operator exploited CVE-2026-39987, a pre-auth RCE in the Marimo notebook terminal WebSocket endpoint, gaining an interactive shell with no credentials. The attacker harvested AWS credentials from the process environment and Redis backend, retrieved an SSH private key from AWS Secrets Manager, and authenticated to an internet-reachable bastion host. The chain fired in eight seconds after roughly four hours of toolkit building, logging over 850 commands during a nine-hour session. The flaw, fixed in Marimo 0.23.0, has been on CISA's KEV catalog with a May 7, 2026 federal remediation deadline.

Infosecurity Magazineupdated · 1d agofirst · 2d agoExploit / PoC in the wild 4 sourcesCVE-2026-39987

CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild

CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in GitLab CE/EE, is actively exploited and was added to CISA's KEV catalog.

GitLab patched CVE-2026-85706, a critical path traversal (CWE-22) in the repository commits API scoring CVSSv3.1 10.0, allowing unauthenticated arbitrary file reads on affected self-managed servers under certain conditions. CISA added it to the KEV catalog on September 11, 2026, citing active exploitation, with a September 14 remediation deadline and BOD 26-04 forensic triage requirements. Fixed versions are 19.1.8, 19.2.6, and 19.3.2; the release also fixes 17 other vulnerabilities including CVE-2026-87719, a CVSS 9.9 insecure deserialization flaw in GitLab EE.

Rapid7 Blogupdated · 2d agofirst · 2d agoExploit / PoC in the wild 18 sourcesCVE-2026-85706CVE-2026-877192