ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Source: Tenable Blog

3 stories in the last 30d

Sortlatesthotimportance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 2Industry 2Tools 2Vulnerability 2Policy & legal 1AI safety & security 1Advisory 1Threat actor 1
SeverityAllcritical 1high 3medium 2low 0info 6source: Tenable Blog ✕

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.

Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.

Tenable Blog · 8d agoVulnerability in the wildCVE-2026-81963CVE-2026-858801

Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter

Joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs shows nation-state and criminal groups independently converge on the same edge infrastructure.

Tenable and SentinelOne jointly analyzed 93 CVE-actor attribution pairs covering exploitation of perimeter devices. The data shows state-sponsored and financially motivated actors independently target the same edge products from Ivanti, Fortinet, and Palo Alto Networks. The findings challenge the narrative that edge exploitation is exclusively a China-nexus nation-state problem, showing a broader shared attack surface.

Tenable Blog · 21d agoThreat actor in the wild

Frequently asked questions about the active threat to Siemens S7 Series PLCs

US government agencies warn that unattributed actors using AI-generated exploit scripts are targeting internet-exposed Siemens S7 PLCs in critical infrastructure.

A joint advisory from multiple U.S. government agencies warns that threat actors are exploiting known weaknesses and unnecessary internet exposure of Siemens S7 Series PLCs for reconnaissance and possible pre-positioning for future disruptive attacks. The attackers use AI to generate and refine exploit scripts faster than manual development would allow, lowering the technical bar for ICS attacks. There is no single patch, so defenders must reduce internet exposure and improve monitoring of ICS environments.

Tenable Blog · 27d agoExploit / PoC in the wild