ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “patch”

17 stories in the last 3d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 55Advisory 51Vulnerability 44Industry 18Research 11Tools 6Malware 6Threat actor 5AI safety & security 5Data breach 5AI research 3Policy & legal 2AI policy 1
SeverityAllcritical 37high 70medium 49low 18info 38

Microsoft Releases Emergency Patch to Fix RDS Snafu

Microsoft's out-of-band KB5129195 fixes September Patch Tuesday regressions breaking RDS connections, Hyper-V shared folders, and USB audio.

Microsoft released cumulative out-of-band update KB5129195 on September 14, 2026, fixing RDS instability causing failing RDP connections, sign-in issues, and hanging servers. The patch also resolves Hyper-V Plan9 shared-folder failures affecting WSL and Claude Cowork, plus USB Audio Class 1.0 device failures. This is Microsoft's sixth emergency patch after a September Patch Tuesday that fixed a record 974 CVEs.

Infosecurity Magazine · 1d agoAdvisory 3 sources

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · security · 5h agoResearch

Cisco Identity Services Engine Information Disclosure Vulnerability

Cisco patched an ISE API flaw letting an authenticated administrator view sensitive data including hashed credentials via crafted API requests.

A vulnerability in the Cisco Identity Services Engine API allows an authenticated remote attacker with valid administrative credentials to view sensitive information, including hashed credentials usable in future attacks. The flaw is caused by insufficient validation of user-supplied API request parameters. Cisco has released software updates.

Cisco Security Advisories · 2h agoAdvisory 15 sources

Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability

Cisco patched a BroadWorks CommPilot authorization bypass letting low-privileged authenticated users alter device configurations via crafted HTTP requests.

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software is caused by missing authorization checks. An authenticated remote attacker with low privileges can send crafted HTTP requests to alter configurations on select pages. Cisco has released software updates and no workarounds are available.

Cisco Security Advisories · 2h agoAdvisory

Jenkins Security Advisory 2026-09-16

Jenkins released a security advisory patching vulnerabilities across 13 plugins, including GitLab, Bitbucket, Gradle, Keycloak Authentication, and Script Security.

The Jenkins security advisory dated September 16, 2026 addresses vulnerabilities in 13 plugins: Bitbucket Push and Pull Request, Bitbucket Server Integration, Coverage, Gitee, GitLab, Gradle, Keycloak Authentication, OWASP Dependency-Check, Pipeline: Groovy Libraries, Pipeline: Multibranch, Robot Framework, Script Security, and Warnings. Jenkins users should update the affected plugins to the patched versions listed in the advisory.

Jenkins Security Advisoriesupdated · 3h agofirst · 6h agoAdvisory 2 sources

Hackers Stole Flock’s Camera Software, Revealing How the Company Tracks Cars and People

Hackers who removed a Flock Safety license plate camera dumped its data, revealing person-detection capabilities and an encryption key stored unencrypted on the device.

A hacker collective calling itself stegan0gram physically removed a Flock Safety automatic license plate reader camera from a roadway, copied its storage, and shared the files with 404 Media, WIRED, and Distributed Denial of Secrets. Analysis found an encryption key in an unencrypted 'media' partition that unlocked videos of thousands of vehicle detections, with logs showing more than a million images generated in weeks. The software explicitly detects people, bicycles, and even bumper stickers, and records from one Georgia city were searchable by more than 2,000 agencies nationwide. The findings follow 2025 research by Jon Gaines documenting flaws enabling root-level access to Flock cameras.

404 Media · 8h agoResearch in the wild 2 sources

USN-8766-1: Suricata-Update vulnerability

Ubuntu patches Suricata-Update path validation flaw allowing arbitrary file writes outside the rules directory from malicious rule archives.

Ubuntu security notice USN-8766-1 fixes a Suricata-Update vulnerability discovered by Guillem Lefait. The tool did not properly validate destination paths when extracting files referenced by downloaded rule archives, allowing an attacker to write arbitrary files outside the configured rules directory. Users are advised to update the suricata-update package.

Ubuntu Security Notices · 1d agoAdvisory

USN-8761-1: Linux kernel (Azure) vulnerabilities

Ubuntu patches multiple Linux kernel (Azure) flaws across ARM64, Bluetooth, Netfilter, NTFS3, SMB and other subsystems.

Ubuntu security notice USN-8761-1 corrects several security issues in the Linux kernel for Azure, spanning ARM32, ARM64, and PowerPC architectures plus subsystems including Bluetooth, Netfilter, EFI core, GPU drivers, InfiniBand, SCSI, NTFS3, and SMB. An attacker could possibly use these flaws to compromise the system.

Ubuntu Security Notices · 1d agoAdvisory 2 sources

USN-8760-1: Linux kernel (NVIDIA) vulnerabilities

Canonical issues USN-8760-1 patching multiple Linux kernel (NVIDIA) vulnerabilities across numerous subsystems and CPU architectures.

Canonical published USN-8760-1 to correct several Linux kernel (NVIDIA) vulnerabilities that an attacker could possibly use to compromise the system. The update fixes flaws spanning UAPI, the kernel build system, ARM32, ARM64, RISC-V, S390, and x86 architectures. Patched subsystems also include the block layer, cryptographic API, Compute Acceleration Framework, Intel NPU driver, ACPI and Bluetooth drivers, and the hardware random number generator core.

Ubuntu Security Notices · 1d agoAdvisory

Microsoft confirms KB5002914 Excel update breaks copy and paste

Microsoft confirms KB5002914 Office security update silently breaks copy-paste, autofill, and formula dragging in Excel 2016 through 2024.

Microsoft confirmed the September 2026 KB5002914 security update breaks copy-and-paste, autofill, and formula dragging in Excel 2024, 2021, 2019, and 2016. Failures occur silently with no beep or error message, leaving the destination unmodified. Uninstalling KB5002914 via OfficeC2RClient or Oarpmany restores functionality while Microsoft investigates.

BleepingComputerupdated · 1d agofirst · 1d agoAdvisory 3 sources1

MongoDB security advisory (AV26-918)

Canadian Cyber Centre advisory AV26-918 urges patching MongoDB Server vulnerability fixed in 7.0.43, 8.0.32, 8.3.11, and 9.0.1.

The Canadian Centre for Cyber Security issued advisory AV26-918 on September 14, 2026, regarding a vulnerability in MongoDB Server. Affected versions include those prior to 7.0.43, 8.0.32, 8.3.11, 9.1.0-rc0, and 9.0.1. The fix shreds collection validator constants during parsing. Users and administrators are encouraged to review MongoDB's advisory and apply updates as they become available.

Canadian Centre for Cyber Security · 2d agoAdvisory

USN-8756-1: Yelp vulnerability

Ubuntu patches Yelp help viewer flaw allowing crafted help documents to execute arbitrary scripts and expose sensitive user information.

USN-8756-1 fixes a vulnerability in Yelp, Ubuntu's help viewer, where help documents could execute arbitrary scripts. An attacker could trick a user into opening a specially crafted help document to obtain sensitive information. Ubuntu has released updated packages.

Ubuntu Security Notices · 2d agoAdvisory

USN-8755-1: libvips vulnerability

Ubuntu patches libvips flaw where crafted TIFF images converted to HEIF cause a crash, enabling denial of service.

USN-8755-1 fixes a libvips vulnerability in which specially crafted TIFF images are incorrectly handled when saved as HEIF, causing the library to crash. The impact is limited to denial of service with no code execution indicated. Ubuntu shipped updated packages.

Ubuntu Security Notices · 2d agoAdvisory

USN-8754-1: Freeciv vulnerability

Ubuntu patches Freeciv stack overflow where remote attackers crash clients or servers using crafted network packets.

USN-8754-1 fixes a Freeciv vulnerability where certain network packets trigger a stack overflow. A remote attacker could use this to crash Freeciv clients or servers, resulting in denial of service. Ubuntu released updated packages.

Ubuntu Security Notices · 2d agoAdvisory1

USN-8751-1: Urwid vulnerabilities

Ubuntu USN-8751-1 patches Urwid weak PRNG issue allowing local attacker possible denial of service or code execution.

Katriel Moses discovered that Urwid used a weak pseudo-random number generator. A local attacker could potentially exploit this issue to cause a denial of service or execute arbitrary code. Ubuntu has released a patch under USN-8751-1.

Ubuntu Security Notices · 2d agoAdvisory1

Cisco Nexus Dashboard Software Security Hardening Release: September 2026

Cisco released Nexus Dashboard hardening updates for multiple internally discovered vulnerabilities, grouped by CWE and not known to be exploited.

Cisco's Nexus Dashboard engineering team conducted an internal security review that found multiple vulnerabilities, addressed via software hardening releases. The issues were discovered during internal testing and are not known to be actively exploited. Cisco grouped the issues by CWE class and assigned a single CVE ID per issue before releasing fixes.

Cisco Security Advisories · 2h agoAdvisory

New hardware device can RAM into encrypted memory, expose your data

Researchers built a $200 DDR5 interposer that silently drops memory writes to break TDX, SGX, and SEV-SNP confidential VM integrity, requiring physical access.

Researchers from KU Leuven, ETH Zurich, Durham University, and Google demonstrated DDRop, a hardware interposer costing under $200 that corrupts DDR5 bus commands to silently drop writes to encrypted memory, enabling replay attacks on confidential VMs. Because scalable memory encryption lacks freshness checks, protected VMs keep computing on stale attacker-selected data; on an Intel TDX server the attack forces debug mode for plaintext memory reads or forges attestation reports, succeeding in under two minutes without crashing. Intel and AMD both called the attack out of scope for their cloud threat models, with no mitigation planned, and proposed cache line versioning appears still vulnerable. The full interposer design is being released as open-source hardware.

The Register · Security · 2d agoResearch