60
60
60
60
60
60
60
45
Week in review: Microsoft fixes exploited zero-day, Mirai botnets target unpatched Wazuh servers
60
60
60
60
60
60
57
60
60
60
60
60
60
Microsoft fixes exploited zero-day in Windows CSRSS (CVE-2022-22047)
60
September 2019 Patch Tuesday: Microsoft plugs two actively exploited zero-days
60
U.S. CISA adds Microsoft Office and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalog
60
60
45
Microsoft Releases Fix for Zero-Day Flaw in July 2022 Security Patch Rollout
60
60
Microsoft patches Windows LSA spoofing zero-day under active attack (CVE-2022-26925)
60
Microsoft patches two actively exploited zero-days (CVE-2024-29988, CVE-2024-26234)
60
Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.
Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.
84
45
Hackers Mass-Scan Exposed Vite Servers to Steal AWS and Azure Cloud Credentials
F5 honeypots record mass scanning of exposed Vite dev servers exploiting CVE-2026-39364 to harvest AWS and Azure cloud credentials.
F5 honeypots recorded 807 session-grouped attacks and roughly 32,000 raw events in August 2026 against internet-exposed Vite development servers, up from 1,732 events in the previous three months. Scanners abused CVE-2026-39364 (Vite 7.1.0-7.3.1, 8.0.0-8.0.4), bypassing server.fs.deny via @fs routes with ?raw/?import query parameters and double encoding to read .env files, AWS SSO caches, Azure tokens, and Terraform state. The same infrastructure also probed CVE-2025-29927 (Next.js), CVE-2025-30208, CVE-2025-31125 (KEV-listed January 2026), and CVE-2024-45811. Most traffic originated from Google Cloud IP ranges, with the US accounting for 17,297 events.
68
60
Microsoft Patch Tuesday matches last year’s zero-day high with six actively exploited vulnerabilities
60
60
60
60
Microsoft fixes actively exploited zero-days (CVE-2024-43451, CVE-2024-49039)
60
60