N-able ships N-central hotfix after 33 Able2Shell flaws go public
Build 2026.4.1.26 patches seven CVEs and disables remote control, while proof-of-concept code for all 33 issues stays public.
Stories per day · 30 days
28 RSS
Relatedmeta47remote-code-execution47fairseq31code-injection28rce24deserialization22yaml22ivanti19kev19connect-secure18beyondtrust15cve-2026-10276414microsoft14patch-tuesday13armory-castle12vpn12chrome11pwn2own11
452 stories, newest first · one card per story
Stories tagged #zero-day
N-able takes N-Central offline after published zero-day bugs
Hosted N-Central is down, and customers were told to shut self-hosted installs while fixes are applied.
1
N-able warns of scanning for critical N-central flaws after public PoC
Hotfix 2, build 2026.4.1.26, covers seven CVEs, including path-traversal remote code execution CVE-2026-125882.
N-able releases N-central 2026.4 HF2 for publicly disclosed zero-days
Defused saw internet probing of the flaws; Shadowserver counts about 148 exposed servers, down from 1,338.
Google patches exploited Chrome zero-day CVE-2026-125350
Stable builds 157.0.8103.50 and .51 fix a use-after-free in Chrome's XML parser; attack details stay restricted.
Chrome patches exploited XML use-after-free zero-day CVE-2026-125350
The XML use-after-free is Chrome’s eighth zero-day this year; CISA wants users patched before November 24.
Patched Outlook flaw CVE-2026-124194 leaks NTLMv2 hashes in attacks
Opening a crafted message can leak an NTLMv2 hash without the usual external-content warning; it is not zero-click.
Meta fairseq parse_manifest flaw allows remote code execution (ZDI-26-938)
ZDI rates the unpatched flaw 7.8; a user must open a malicious file or visit a malicious page.
Meta fairseq load_audio_path flaw can run code (ZDI-26-913)
ZDI rates the unpatched issue 7.8; the user must visit a malicious page or open a file.
Meta fairseq FairseqAdam YAML parsing flaw enables RCE (ZDI-26-927)
Opening a malicious file is required; ZDI rates the unpatched issue CVSS 7.8.
Meta FAIRChem NPZ parser allows RCE via untrusted data (ZDI-26-946)
ZDI rates the unpatched FAIRChem flaw 7.8; a user must open a malicious file or visit a malicious page.
Meta Detectron2 checkpoint loading can run code (ZDI-26-912)
Untrusted deserialization in detection_checkpoint is unpatched; ZDI rates it CVSS 7.8.
Meta fairseq split_by_lang flaw allows remote code execution
ZDI rates the unpatched split_by_lang code-injection bug 7.8; a user must open a malicious page or file.
Meta fairseq FilterNamesDataset flaw allows remote code execution
ZDI rates the unpatched FilterNamesDataset code-injection bug 7.8; a user must open a malicious page or file.
November Patch Tuesday fixes 1,235 flaws and an Outlook zero-day
Opening a crafted Outlook message can leak an NTLMv2 hash to an attacker-controlled share.
1
Microsoft November 2026 update fixes 1,093 flaws, one Outlook zero-day
Opening a crafted file can leak an NTLMv2 hash; the Preview Pane is not an attack vector.
Researcher argues public 0-day disclosure beats selling or using them
Aaron Rainbolt's oss-security reply prefers publication over sale or weaponization, but the post is cut off.
Google patches in-the-wild Chrome XML zero-day CVE-2026-125350
Stable builds 157.0.8103.50 and .51 close nine flaws; Google has not confirmed code execution or named attackers.
Google fixes exploited Chrome XML use-after-free zero-day CVE-2026-125350
Stable builds 157.0.8103.50/.51 close the high-severity bug; Google is withholding details until most users update.
D-Link warns of multiple zero-days in DGS-3130 Series switches
D-Link has not disclosed CVE IDs but urges admins to disable DDP and restrict access to management interfaces.
Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability
Attackers compromised nearly 1,000 Zyxel GS1900 switches via pre-authentication RCE before Zyxel patched the flaw.
Hackers Exploit Zyxel GS1900 Zero-Day in the Wild
Patch for CVE-2026-7273 left switches vulnerable to new CVE-2026-107441 remote root command execution.
Adobe Commerce and Magento StyleSmuggler Zero-Day Exploited for RAT Deployment
Attackers use StyleSmuggler flaw to install PSK Agent RAT and maintain remote access on Magento stores.
1
North Korean group steals $6.43B from Binance
Volt Typhoon uses silent train for zero-day attacks; Cursor extension has SSH backdoor and Polymarket loses $2.7M to hack.
1