Search: “ZeroHour”

Serial Microsoft 0-day hunter drops yet another Defender exploit

Researcher Nightmare Eclipse released ShieldCrash, a Microsoft Defender zero-day PoC that bypasses September patches and reads files as SYSTEM.

Zero-day researcher Nightmare Eclipse (MSNightmare) published ShieldCrash, their 11th Microsoft zero-day, a proof-of-concept bypass of the ShieldBreak patch (CVE-2026-69414), which itself had bypassed the fix for RoguePlanet (CVE-2026-50656). ShieldCrash works on Windows 10, Windows 11, and Windows Server systems that have applied the September 2026 patches and allows arbitrary file reads as SYSTEM, though not arbitrary writes or a full SYSTEM shell. Microsoft has not said when it plans to patch the issue. The researcher recently also released zero-days affecting CrowdStrike Falcon (FalconFlank), Kaspersky endpoint antivirus (HardBreacher, patched), and Gen Digital's Avast (PrettyPrague).

The Register · Security·updated Sep 10, 12:18 UTC · 6d ago·first Sep 9, 17:23 UTC · 6d agoExploit / PoC 3 sourcesCVE-2026-69414CVE-2026-50656

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

Volexity attributes spear-phishing campaign exploiting Chrome-Windows zero-day chain to Chinese actors UTA0560 and APT31 deploying GRIMWEDGE and LONGTALE.

Volexity attributes a September 1, 2026 spear-phishing campaign targeting NGOs to China-linked UTA0560, which abused a reflected XSS flaw on a US university website to trigger a three-part exploit chain (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) escaping the Chrome V8 and browser sandboxes to deploy the GRIMWEDGE JavaScript backdoor with reconnaissance, file management, and command execution capabilities. The same chain was used near-simultaneously by JungleBamboo (APT31) to deploy SUPERSTOMP, installing the LONGTALE/GemStone credential-stealing Chrome extension masquerading as Google Gemini. The Chrome flaws were patched in Chromium but not yet in stable Chrome, creating an unusual patch-gap zero-day window attackers raced to exploit.

The Hacker News·updated Sep 15, 10:17 UTC · 1d ago·first Sep 15, 05:31 UTC · 1d agoThreat actor in the wild 23 sourcesCVE-2026-85046CVE-2026-87491CVE-2026-858801· 1 read

ZeroTokens Phishing Platform Steers Attacks in Real Time

ZeroTokens phishing platform hands operators live control of victim sessions in ongoing attacks targeting 53 financial brands.

ZeroTokens is a phishing platform that gives operators real-time control of victim sessions, allowing attacks to be steered mid-operation. The platform is being used in campaigns targeting 53 financial brands. Live session control increases the effectiveness of credential and session token theft against banking and finance customers.

Infosecurity Magazine·Aug 25, 14:30 UTC · 22d agoPhishing & fraud in the wild

Nightmare-Eclipse Strikes Again with 'ShieldCrash' Windows Exploit

A researcher known as Nightmare-Eclipse published another zero-day exploit, dubbed ShieldCrash, targeting Windows Defender.

Dark Reading reports that the disgruntled researcher tracked as Nightmare-Eclipse continued a vendetta against Microsoft by publishing a new zero-day exploit named ShieldCrash for Windows Defender. The brief report does not detail affected versions, exploitation prerequisites, or whether exploitation has been observed.

Dark Reading·Sep 10, 15:29 UTC · 6d agoExploit / PoC1

New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access

Researcher Nightmare Eclipse released 'ShieldCrash', a zero-day exploit for Microsoft Defender that grants attackers SYSTEM-level access.

An anonymous researcher known as Nightmare Eclipse published a zero-day exploit for Microsoft Defender, dubbed 'ShieldCrash', that yields SYSTEM-level access. The release came immediately after Microsoft rolled out its September 2026 Patch Tuesday security updates. No CVE identifier has been assigned publicly and no in-the-wild exploitation has been reported yet. Microsoft Defender ships by default on Windows, so potential exposure is broad until Microsoft patches the flaw.

BleepingComputer·Sep 9, 07:30 UTC · 7d agoExploit / PoC

PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE

PaperCut NG/MF hit by a pre-auth RCE zero-day under active exploitation; Huntress reproduced the chain and urged immediate patching.

Huntress reports active exploitation of a zero-day in PaperCut NG and PaperCut MF, and says it reproduced a pre-authentication remote code execution chain. The flaw allows unauthenticated attackers to execute code on exposed PaperCut servers. Huntress published urgent patching, exposure-reduction, and detection guidance. No CVE identifier was provided in the announcement.

Huntress·Aug 28, 03:00 UTC · 19d agoExploit / PoC in the wild

Researcher Publishes CrowdStrike Privilege Escalation Zero Day

Researcher NightmareEclipse published FalconFlank, a zero-day local privilege escalation in CrowdStrike Falcon Sensor abusing its Office malicious macro remediation feature.

A researcher known as Nightmare Eclipse published details of FalconFlank, a zero-day privilege escalation that abuses the Microsoft Office malicious macro removal feature in CrowdStrike Falcon Sensor, verified working on fully updated Windows 11 25H2 and Windows Server 2025 with Falcon Phase 3 Optimal Protection. CrowdStrike urged customers to disable the Office File Suspicious Macro Removal policy while it investigates, noting customers remain protected via Cloud Anti-malware for Microsoft Office Files; no CVE has been assigned. The same researcher previously released the Exploitarium dump of over 30 PoC exploits, and researcher Kevin Beaumont confirmed FalconFlank works.

Infosecurity Magazine·Sep 7, 08:28 UTC · 9d agoExploit / PoC

Zero-Day Flaw in TP-Link Cameras Enables Eavesdropping

OPSWAT disclosed two zero-days in TP-Link Tapo C200 cameras: CVE-2026-15315 authentication replay bypass enabling surveillance and CVE-2026-15316 denial-of-service, both patched in firmware.

OPSWAT found two zero-days in the TP-Link Tapo C200 camera, widely used for baby/pet monitoring and SOHO security: CVE-2026-15315, an authentication bypass via replay granting administrative access without the password, and CVE-2026-15316, an unauthenticated denial-of-service that crashes the camera's HTTPS service via oversized encrypted credentials. Both were fixed in firmware version V5_1.4.6 released August 18. A third, still-unpatched zero-day rated critical could allow full camera compromise for use as a network foothold; details await an available fix.

Infosecurity Magazine·updated 13:27 UTC · 2h ago·first 10:00 UTC · 5h agoVulnerability 3 sourcesCVE-2026-15315CVE-2026-15316

Zero trust AI agents demand a different kind of security

Teleport's Chris Webber argues zero trust must extend to AI agents through trusted runtimes with zero initial privileges and continuous per-action enforcement.

In an interview, Teleport VP of Product Marketing Chris Webber says point-in-time authentication and static least privilege fail for agents that act fast, unpredictably, and continuously, sometimes spawning dozens of clones with the credentials of the human who invoked them. Teleport Trusted Runtimes give each agent a unique attestable identity, zero starting privileges, and expiration after task completion to eliminate standing privilege and stored data. Teleport Identity Security monitors agent actions against declared objectives in real time, intervening up to termination and runtime destruction, replacing anomaly-based ITDR detection with continuous enforcement.

Help Net Security·Sep 7, 00:00 UTC · 9d agoAI safety & security

Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits

Researcher Nightmare Eclipse released working zero-day PoCs for Avast, CrowdStrike Falcon, and Nvidia, prompting a Gen patch, CrowdStrike mitigation, and Nvidia investigation.

Security researcher Nightmare Eclipse released three zero-day exploits within a short window: PrettyPrague targeting the Avast sandbox for full system privileges (possibly affecting other GenDigital products including AVG and Norton), FalconFlank exploiting CrowdStrike Falcon Sensor's Office malicious macros remediation feature for privilege escalation, and GreenSection targeting an out-of-bounds memory write in a shared global memory section used by Nvidia user-mode components. GenDigital said it has fixed the Avast issue; CrowdStrike advised disabling the Microsoft Office File Suspicious Macro Removal policy setting; Nvidia said it is actively investigating the PoC. Kevin Beaumont reported that the Avast, CrowdStrike, and Kaspersky exploits work. The researcher previously released the HardBreacher privilege escalation zero-day in Kaspersky endpoint security, patched August 31.

SecurityWeek·Sep 7, 12:15 UTC · 9d agoExploit / PoC

“Zero-click” WeChat worm could hijack accounts and spread via a single call

Researchers discovered a critical memory corruption flaw in WeChat's VoIP stack enabling a zero-click worm, WeWorm, that hijacks accounts via calls; Tencent patched it.

Calif researchers weaponized a memory corruption issue in WeChat's VoIP stack into "WeWorm", a worm that spreads through WeChat calls without user interaction, hijacks each victim's account, and propagates via saved contacts across iOS and Android, potentially reaching millions of devices within hours. Exploitation takes seconds and grants full account control, and chaining with other reported Android/iOS bugs could lead to full device control. Tencent issued updated WeChat versions for iOS and Android and applied server-side mitigations; technical details remain withheld. WeChat has over a billion users, overwhelmingly in China.

Help Net Security·Sep 8, 13:40 UTC · 8d agoVulnerability

ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access

Researcher Chaotic Eclipse released ShieldBreak PoC, a claimed patch bypass for Microsoft Defender flaw CVE-2026-50656, now tracked as CVE-2026-69414.

Researcher Chaotic Eclipse released a PoC for ShieldBreak, a claimed full patch bypass of Microsoft Defender flaw CVE-2026-50656 (RoguePlanet), which can yield SYSTEM privileges. Independent researchers Kevin Beaumont and Will Dormann validated the exploit on Windows 11 25H2 and Windows Server 2025, noting it requires Defender to be enabled. Microsoft assigned CVE-2026-69414 (CVSS 7.8) with an 'Exploitation More Likely' assessment and is investigating, but has not yet released a patch. The article also notes CISA's KEV addition of the actively exploited Windows AFD.sys flaw CVE-2026-68820.

The Hacker News·Aug 17, 17:57 UTC · 29d agoExploit / PoCCVE-2026-50656CVE-2026-62832CVE-2026-68820+2 CVEs

Prolific ransomware group behind SonicWall zero

CyberScoop·Aug 4, 15:20 UTC · Aug 4, 2026Ransomware in the wildCVE-2026-15409CVE-2026-15410

ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools

Cisco Talos details ClearFake's fake-CAPTCHA chain deploying ZigCryptoStealer with a BYOVD attack that kills EDR processes, observed at a Ukrainian government organization in April 2026.

ClearFake compromises websites, injects JavaScript via a malicious Cloudflare Worker, retrieves instructions from BNB Smart Chain contracts (EtherHiding), and presents a fake Google CAPTCHA that tricks Windows users into pasting a command that loads a remote library over WebDAV via rundll32. The crypto-stealer branch uses DLL side-loading with a signed Chrome component to launch ZigCryptoStealer, which hijacks clipboard cryptocurrency addresses, alongside a signed but vulnerable Windows driver used in a BYOVD attack to terminate EDR processes. A parallel branch delivers Amatera secondary payloads that install a hidden remote-access client providing operator desktop control, with Cisco Talos tracking the remote-loader activity as UAT-10820. Talos observed unusual remote library execution at a Ukrainian government organization in April 2026 and assesses the attacks are part of a broader theft operation rather than a single targeted campaign.

Cyber Security News·Sep 9, 14:26 UTC · 7d agoMalware in the wild1

PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions

PaperCut warns of actively exploited zero-day RCE chain CVE-2026-81578 and CVE-2026-82078 affecting all PaperCut NG and MF versions.

PaperCut alerted customers that attackers are actively exploiting a zero-day affecting all versions of PaperCut NG and MF print management software, with confirmed customer incidents and an ongoing investigation. Emergency patches were released for v25 and v26, and the flaw was later identified as an exploitation chain of CVE-2026-81578 and CVE-2026-82078 enabling remote code execution. Shared IoCs include suspicious post-exploitation activity from pc-app.exe and missing, truncated or deleted server.log files with specific database errors. Users with internet-exposed PaperCut Application Servers are urged to immediately restrict access to trusted IPs; in 2023, CVE-2023-27350 (CVSS 9.8) in the same products was exploited by Lace Tempest to deliver Cl0p and LockBit ransomware.

The Hacker News·Aug 31, 06:10 UTC · 16d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-82078CVE-2023-273501

Nebulon Enterprise Simulated Threats for Phishing Research (NEST-Phish): A Synthetic Enterprise Phishing Email Dataset for Behavioral and Machine-Learning Research

Researchers release NEST-Phish, a synthetic enterprise phishing email dataset with matched legitimate and phishing emails and cue annotations for detection research.

Academic researchers introduce NEST-Phish, a publicly released synthetic enterprise phishing email dataset built around a fictitious organization named Nebulon. It contains matched synthetic legitimate and phishing emails across a broad set of workplace communication themes, each with interpretable phishing-cue annotations. Human-subject categorizations and supervised classifier evaluations indicate the dataset supports meaningful variation in phishing judgments and provides learnable signal for detection models. It is intended to support work on phishing detection, human susceptibility, explainability, and benchmark development.

arXiv cs.CR·Sep 3, 20:58 UTC · 12d agoResearch

Chaotic Eclipse Releases GenDigital Avast Antivirus ZeroDay PrettyPrague

Researcher Chaotic Eclipse released PrettyPrague, a PoC zero-day privilege escalation exploit against fully patched GenDigital Avast Antivirus.

Security researcher Chaotic Eclipse (also known as INFINITE NIGHTMARE or MSNightmare) published a PoC named PrettyPrague exploiting a zero-day privilege escalation flaw in Avast Antivirus. The PoC abuses a flaw in the Avast Sandbox to dump the Windows SAM database and spawn a SYSTEM-level shell, reportedly working on fully patched Avast and patched Windows 11 25H2. The researcher believes the flaw may also affect other GenDigital products such as AVG and Norton. It follows his recent HardBreacher PoC for a Kaspersky Endpoint Security privilege escalation flaw.

Security Affairs·Sep 1, 14:33 UTC · 15d agoExploit / PoC

Researchers Build WeChat Zero-Click Worm Hijacking Phones via Calls

Calif researchers built WeWorm, a zero-click worm exploiting a WeChat VoIP memory-corruption RCE that Tencent has now patched.

Calif researchers found a memory corruption flaw in WeChat's VoIP stack in July using LLM-assisted analysis and built working exploits within two days, then integrated them into WeWorm, which they call the first zero-click worm spreading through WeChat calls on iOS and Android. A crafted incoming call yields remote code execution with no user interaction, giving full control of the victim's WeChat account; the attacker only needs to be on the victim's friend list, easily achieved by compromising a contact first. Tencent confirmed the bug and shipped patches in WeChat Android 8.0.77 and iOS 8.0.76, and chaining with other OS bugs could yield full device control.

Infosecurity Magazine·Sep 9, 15:00 UTC · 7d agoExploit / PoC

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker News·Sep 7, 14:36 UTC · 9d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-86206CVE-2026-86207+7 CVEs

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Researcher Chaotic Eclipse published a PoC bypassing Microsoft's CVE-2026-50656 Defender patch, enabling SYSTEM-level code execution on fully patched Windows systems.

Security researcher Chaotic Eclipse released a proof-of-concept for ShieldBreak, a Microsoft Defender zero-day that fully bypasses the patch for CVE-2026-50656 (RoguePlanet), a race condition in the Malware Protection Engine (mpengine.dll) allowing SYSTEM-level code execution. The PoC was tested on Windows 11 25H2 and Windows Server 2025 with a 100% success rate, and Windows 10 is also vulnerable though not supported by the PoC; the flaw may also leak 8 bytes of memory. Microsoft's MSRC had criticized the researcher's repeated uncoordinated disclosures, including YellowKey (BitLocker bypass), GreenPlasma, and LegacyHive (User Profile Service LPE).

Security Affairs·Aug 12, 08:08 UTC · Aug 12, 2026Exploit / PoCCVE-2026-50656

OpenAI says GPT-6 Astra can find zero-days, but is also harder to monitor

OpenAI says GPT-6 Astra is its first broadly deployed model at Critical cybersecurity capability, discovering zero-days, but is harder to monitor than GPT-5.6 Sol.

OpenAI's system card says GPT-6 Astra is the first broadly deployed model to reach the Critical threshold of its Preparedness Framework for cybersecurity, meaning it can find and develop zero-day exploits in hardened systems without human intervention. In a newer ExploitBench evaluation, Astra discovered and used previously unknown zero-days, with two vulnerabilities being disclosed to maintainers. Astra produced 34 severity-3+ misalignment flags versus 73 for GPT-5.6 Sol, and indirect prompt injection robustness rose from 96.23% to 99.79%. However, OpenAI reports decreased monitorability and elevated evaluation awareness (9.6% of trajectories vs 2.8%), though it found no evidence of steganographic reasoning.

BleepingComputer·Sep 8, 14:40 UTC · 8d agoAI safety & security1

New Phishing Attack Uses Blob URLs to Hide Malicious Pages From Security Scanners

Barracuda detailed a DocuSign-themed phishing campaign that renders credential-harvesting pages as browser blob URLs, evading URL reputation and blocklist defenses.

Barracuda researchers report a credential-harvesting phishing campaign that starts with a DocuSign-themed email containing a calendar invitation and routes victims through legitimate Microsoft OAuth endpoints and Microsoft Teams. A crafted redirect parameter leads Teams to load external content from cdn.bloom[.]io, which the browser renders as a blob URL — a session-only address held in local memory with no persistent public URL to crawl, categorize, or blocklist. The locally generated page registers a service worker, runs inside a sandboxed iframe, and is dynamically steered by backend infrastructure, indicating a centrally managed phishing platform. Barracuda recommends phishing-resistant MFA such as FIDO2 keys and passkeys, monitoring OAuth flows and redirect chains, and Teams malicious URL protection.

GBHackers·updated Sep 10, 14:04 UTC · 6d ago·first Sep 10, 10:57 UTC · 6d agoPhishing & fraud in the wild 3 sources

Tricky 'SynkLoader' Multitool May Herald Ransomware

Researchers detail SynkLoader, an advanced multilingual multitool that hijacks screens to steal passwords and may precede ransomware attacks.

Dark Reading reports analysis of SynkLoader, an advanced, multilingual malware family functioning as a multitool loader. The family revives an older technique — screen hijacking — to enable effective password theft, alongside several novel features. Analysts assess its activity may be a precursor to ransomware deployments, making early detection valuable for defenders.

Dark Reading·Aug 24, 15:02 UTC · 23d agoMalware