Zero-Day Vulnerabilities News

412 stories · Updated every 5 minutes · Page 3 of 11

1. Apple patches CoreGraphics zero-day flaw exploited in attacks

   BleepingComputer · 29 Sep 2026, 13:03 IST · Critical severity

   Apple released security updates to fix a zero-day vulnerability exploited in "extremely sophisticated" targeted attacks on iOS devices.

2. Apple Patches Meta-Reported Zero-Day Linked to ‘Extremely Sophisticated Attack’

   SecurityWeek · 29 Sep 2026, 11:48 IST · Critical severity

   Apple has released iOS and macOS updates to patch the zero-day vulnerability tracked as CVE-2026-86950. The post Apple Patches Meta-Reported Zero-Day Linked to ‘Extremely Sophisticated Attack’ appeared first on SecurityWeek .

3. Citrix NetScaler Zero-Day exploitation: What enterprise teams need to know

   DQ : Latest Posts · 28 Sep 2026, 16:25 IST · Critical severity

   Citrix confirms active NetScaler ADC and Gateway zero-day exploitation, and recommends affected customers install the relevant security updates as soon as possible. The two critical vulnerabilities are already being exploited on...

4. Hackers are exploiting two critical Citrix NetScaler zero-days

   TNW · 28 Sep 2026, 22:12 IST · Critical severity

   Attackers are exploiting two critical flaws in Citrix NetScaler ADC and NetScaler Gateway. Companies use the devices to give staff remote access to internal networks. Citrix confirmed the attacks in a security bulletin on Sunday and...

5. US, UK warn of exploited Citrix NetScaler zero-day bugs

   The Record by Recorded Future · 28 Sep 2026, 21:49 IST · Critical severity

   Incident responders began warning of potential vulnerabilities in NetScaler Gateway products on Saturday before cybersecurity agencies in the Netherlands, U.S. released advisories on Sunday confirming vulnerabilities. Citrix itself...

6. Citrix says two worrying NetScaler RCE zero-days exploited in attacks

   TechRadar · 28 Sep 2026, 20:40 IST · Critical severity

   Citrix says two worrying NetScaler RCE zero-days exploited in attacks

7. Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild

   Palo Alto Unit 42 · 28 Sep 2026, 20:32 IST · Medium severity

   Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited...

8. FBI job portals remain offline after ShinyHunters claims breach via PeopleSoft zero-day

   Help Net Security · 28 Sep 2026, 19:26 IST · Critical severity

   The FBI’s online portals for job applicants (at apply.fbijobs.gov) and special agent applicants (at fbijobs.gov/special-agents) are still unavailable, following what appears to be successful compromises by the ShinyHunters cyber...

9. NetScaler admins told to patch critical zero-days in ADC and Gateway now

   CSO Online Security · 28 Sep 2026, 15:32 IST · Critical severity

   Citrix NetScaler ADC and NetScaler Gateway users should take their systems offline and patch them immediately, they were told over the weekend, as news emerged of two critical unauthenticated remote code execution zero-day...

10. Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)

    Help Net Security · 28 Sep 2026, 15:21 IST · Critical severity

    Citrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited in zero-day attacks to plant webshells on compromised devices....

11. Citrix Patches Critical Zero Days Under Active Exploitation

    Infosecurity Magazine · 28 Sep 2026, 14:00 IST · Critical severity

    Citrix has confirmed exploitation of two critical zero-day RCE bugs

12. Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug

    SecurityWeek · 28 Sep 2026, 12:59 IST · Critical severity

    Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772. The post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek .

13. Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

    CISA Alerts · 27 Sep 2026, 17:30 IST · Critical severity

    CISA is amplifying Citrix’s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771 , CVE-2026-88772 , CVE-2026-88773 , CVE-2026-88774 , CVE-2026-88775 ,...

14. Citrix admins warned to shut down NetScalers over 2 exploited zero-days

    BleepingComputer · 27 Sep 2026, 21:32 IST · Critical severity

    Two unpatched Citrix NetScaler zero-day vulnerabilities are reportedly being exploited in attacks, with cybersecurity agencies, security researchers, and IT providers privately warning organizations about the flaws ahead of patches...

15. Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities

    Tenable Research · 27 Sep 2026, 15:05 IST · Critical severity

    There are reportedly two unpatched zero-day Citrix NetScaler vulnerabilities capable of enabling remote code execution that have been actively exploited in the wild, with no patches available at this time. Key takeaways Reports indicate...

16. Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

    The Hacker News · 27 Sep 2026, 13:17 IST · Critical severity

    Two new unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that allow remote code execution are being actively exploited in the wild, security firm watchTowr said on September 26. Citrix has not...

17. Kiteworks urges 6-hour server shutdown over potential zero-day attacks

    BleepingComputer · 26 Sep 2026, 03:11 IST · Critical severity

    Secure file-sharing software company Kiteworks is urging customers worldwide to temporarily shut down their servers on Saturday for a six-hour window after receiving threat intelligence warning of a potentially imminent cyberattack.

18. SCOUTz Prospect Intelligence Platform Launches for MSPs with 30-Day Beta

    HackRead · 24 Sep 2026, 19:42 IST · Medium severity

    SCOUTz Prospect Intelligence Platform Launches for MSPs with 30-Day Beta

19. Someone's attacking a critical 0-day RCE in F5 BIG-IP APM

    The Register · 23 Sep 2026, 23:39 IST · Critical severity

    F5 has fixed a critical zero-day bug in its BIG-IP Access Policy Manager (APM) that unknown miscreants are exploiting to remotely execute malicious code. BIG-IP APM is a centralized access management and security proxy that allows users...

20. DarkMe RAT trades zero-days for plain phishing emails

    Help Net Security · 23 Sep 2026, 18:54 IST · Critical severity

    DarkMe, a remote access trojan and info-stealer that has previously been associated with a threat group that targeted financial market traders and cryptocurrency users, has been spotted again. This time around, its distribution has been...

21. OTX Threat: Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits

    AlienVault OTX · 23 Sep 2026, 17:47 IST · Critical severity

    In early September 2026, Chinese threat actor UTA0565 exploited unpatched zero-day vulnerabilities in Google Chrome and Microsoft Windows through sophisticated phishing campaigns. The actor registered fake domains impersonating...

22. Arista patches actively exploited VeloCloud Orchestrator zero-day

    BleepingComputer · 23 Sep 2026, 17:59 IST · Critical severity

    Arista Networks has released security patches for a zero-day flaw that is being actively exploited and affects VeloCloud Orchestrator (VCO) On-Prem deployments.

23. Zero-day hackers ditch exploits for a fake image file in new DarkMe campaign

    IT Security Guru · 23 Sep 2026, 16:22 IST · Critical severity

    A threat group best known for exploiting previously unknown flaws in WinRAR and Windows has switched to a much simpler method: an email link to what appears to be an image. New research from Huntress details a 2026 campaign delivering...

24. Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

    The Hacker News · 23 Sep 2026, 13:59 IST · Critical severity

    A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved...

25. F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

    The Hacker News · 23 Sep 2026, 13:59 IST · Critical severity

    Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth...

26. Arista Urges Immediate Patching of Exploited VCO Zero-Day

    SecurityWeek · 23 Sep 2026, 14:03 IST · Critical severity

    Remote attackers could trigger the critical-severity flaw to access privileged internal functionality. The post Arista Urges Immediate Patching of Exploited VCO Zero-Day appeared first on SecurityWeek .

27. Critical F5 BIG-IP Vulnerability Exploited as Zero-Day

    SecurityWeek · 23 Sep 2026, 13:04 IST · Critical severity

    Unauthenticated attackers could send malicious traffic to BIG-IP to achieve remote code execution. The post Critical F5 BIG-IP Vulnerability Exploited as Zero-Day appeared first on SecurityWeek .

28. F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks

    BleepingComputer · 23 Sep 2026, 12:47 IST · Critical severity

    F5 has released security updates to address a critical BIG-IP APM zero-day vulnerability being exploited in remote code execution attacks.

29. Check Point Patches Exploited Management Server Zero-Day

    SecurityWeek · 23 Sep 2026, 11:44 IST · Critical severity

    The critical-severity flaw could allow unauthenticated attackers to upload and execute arbitrary scripts. The post Check Point Patches Exploited Management Server Zero-Day appeared first on SecurityWeek .

30. Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks

    The Hacker News · 22 Sep 2026, 23:59 IST · Critical severity

    Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the company said. The flaw, CVE-2026-93616, allows an attacker who can access the server's web...

31. ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach

    BleepingComputer · 23 Sep 2026, 00:43 IST · Critical severity

    The ShinyHunters extortion gang claims it breached FBI systems using a new Oracle PeopleSoft zero-day vulnerability, gaining access to internal services and stealing sensitive data on employees and job applicants.

32. Zero-downtime Linux kernel zero-day mitigation via eBPF and SECCOMP

    Hacker News · 23 Sep 2026, 00:04 IST · Critical severity

33. Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates

    The Hacker News · 22 Sep 2026, 21:44 IST · Critical severity

    A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19. The tool, called BigDiskBuster, has no patch, no...

34. Check Point warns of Management Server zero-day exploited in attacks

    BleepingComputer · 22 Sep 2026, 22:02 IST · Critical severity

    Check Point Software released emergency hotfixes to address a critical Security Management Server vulnerability that could let attackers run arbitrary scripts.

35. NightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the past

    The Register · 22 Sep 2026, 22:06 IST · Critical severity

    Serial Microsoft zero-day leaker NightmareEclipse has found another way to mess with Windows Defender, this time by stopping the antivirus from updating itself. The security researcher, also known as Abdelhamid Naceri, released a...

36. Meta Just Patched a Major Zero-Day Vulnerability in Its Muse AI Assistant

    Gizmodo · 22 Sep 2026, 21:10 IST · Critical severity

    The flaw could have allowed attackers to hijack Muse and take advantage of its access to a user’s apps and devices.

37. Meta Muse already has a majorly worrying zero-day security issue

    TechRadar · 22 Sep 2026, 18:35 IST · Critical severity

    Meta Muse already has a majorly worrying zero-day security issue

38. D-Link warns of max severity zero-day bug in DIR-822A routers

    BleepingComputer · 22 Sep 2026, 18:18 IST · Critical severity

    D-Link warned customers of a maximum-severity vulnerability (CVE-2026-86296) with public proof-of-concept (PoC) exploit code and no patch, affecting legacy DIR-822A dual-band Wi-Fi routers.

39. Meta’s Muse AI assistant has a zero-day that can turn it into a Mac backdoor

    Malwarebytes Labs · 22 Sep 2026, 16:23 IST · Critical severity

    Mac security researcher Patrick Wardle says it’s trivial to turn Muse into “the ultimate backdoor.” Increasingly, AI assistants are changing from tools that simply answer questions into agents that can plan tasks, use connected...

40. New Windows Defender zero-day blocks Microsoft antivirus updates

    BleepingComputer · 22 Sep 2026, 15:25 IST · Critical severity

    Over the weekend, security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) released another Microsoft Defender zero-day exploit that blocks antivirus updates.