60
60
60
Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open
60
Arm Warns of Actively Exploited Zero
60
Arm and Qualcomm Hit by Multiple Zero
60
Google fixed two Qualcomm bugs that were actively exploited in the wild
60
Urgent: Google Releases Critical Chrome Update for CVE-2025
60
60
Qualcomm fixed three zero-days exploited in limited, targeted attacks
60
60
60
60
60
Google’s August Patch Fixes Two Qualcomm Vulnerabilities Exploited in the Wild
60
U.S. CISA adds CrushFTP, Google Chromium, and SysAid flaws to its Known Exploited Vulnerabilities catalog
60
60
Qualcomm patches 3 actively exploited zero-days
60
CISA adds Veritas Backup Exec flaws to its Known Exploited Vulnerabilities catalog
60
CISA adds bugs exploited by commercial surveillance spyware to Known Exploited Vulnerabilities catalog
60
Human Attacker Hits Machine-Speed Exploitation of Marimo RCE
Sysdig details a human attacker chaining pre-auth RCE in Marimo (CVE-2026-39987) to AWS credentials and a bastion host in eight seconds.
Sysdig's Threat Research Team documented an intrusion where an operator exploited CVE-2026-39987, a pre-auth RCE in the Marimo notebook terminal WebSocket endpoint, gaining an interactive shell with no credentials. The attacker harvested AWS credentials from the process environment and Redis backend, retrieved an SSH private key from AWS Secrets Manager, and authenticated to an internet-reachable bastion host. The chain fired in eight seconds after roughly four hours of toolkit building, logging over 850 commands during a nine-hour session. The flaw, fixed in Marimo 0.23.0, has been on CISA's KEV catalog with a May 7, 2026 federal remediation deadline.
60
13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
Trojanized Packagist themes inject JavaScript into Vietnamese streaming sites, exploiting unpatched iPhone WebKit and kernel flaws to install spyware and steal crypto wallet seeds.
Socket researchers found 13 malicious Composer theme packages across five vendor namespaces (including vsmov, vsphim, and ophimcms) that inject JavaScript into Vietnamese movie and comic streaming sites. On iPhones running iOS 18.4-18.6.x, the injected code fires a WebKit-to-kernel exploit chain using CVE-2025-31277 and CVE-2025-43529, pivoting through the GPU process and the AppleM2ScalerCSCDriver IOKit user client to gain kernel read/write. Since around August 12, 2026 the payload also steals cryptocurrency wallet seeds and mnemonics from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX, alongside keychain databases, Wi-Fi passwords, SMS, photos, cookies, and location history, uploaded via HTTPS to rotating C2 domains. The group is believed to be Vietnamese-operated, hosts exploits on Funnull infrastructure, and Apple patched the kernel escape flaw in iOS and macOS 26.1.
75
60
60
60
60
Google fixed a new actively exploited Chrome zero
60
60
Google fixed the seventh Chrome zero
60
60
60
60
60
Google Warns of Pixel Firmware Security Flaw Exploited as Zero
60
Most Sophisticated iPhone Hack Ever Exploited Apple's Hidden Hardware Feature
60
60
Chipmaker Qualcomm warns of three actively exploited zero
60
In 2022, more than 40% of zero-day exploits used in the wild were variations of previous issues
60
Google fixed the ninth actively exploited Chrome zeroday this year
60
Google addressed the eighth Chrome zero
60