◈ Encrygma — AI Cyber Security Intelligence. Defensive research only. No exploit code or attack instructions. All analysis based on public reporting & OSINT. ◈
40 articles tagged with #Zero-Day
Citrix has issued urgent security updates for NetScaler ADC and Gateway to address a high-severity zero-day vulnerability, CVE-2026-88779, currently being exploited in targeted attacks.
Threat actors are actively exploiting critical zero-day vulnerabilities in Fortinet FortiMail and Citrix NetScaler appliances. CISA has mandated urgent patching as these flaws allow for remote code execution and system compromise.
Security researchers disclosed 32 zero-day vulnerabilities at Pwn2Own Ireland, highlighting a volatile threat landscape. This follows a week of critical disclosures affecting Fortinet, Cisco, and Citrix.
Apple has initiated a massive wave of threat notifications to users across 110 countries, warning of targeted mercenary spyware attacks. These alerts highlight the escalating threat from private-sector offensive actors.
Apple has intensified its global defense against mercenary spyware, issuing high-confidence alerts to users across 110 countries. These notifications highlight the persistent threat posed by state-sponsored surveillance tools targeting high-risk individuals.
Security researchers have unveiled 32 zero-day vulnerabilities on the first day of Pwn2Own, coinciding with a wave of critical in-the-wild exploits targeting Cisco, Fortinet, and Citrix infrastructure.
Security agencies have issued urgent warnings following the active exploitation of critical zero-day vulnerabilities in Fortinet FortiMail and Cisco Catalyst SD-WAN Manager, leading to CISA KEV inclusion.
A wave of critical zero-day vulnerabilities is impacting enterprise infrastructure, with CISA issuing urgent mandates for FortiMail and Citrix NetScaler. Threat actors are actively exploiting these flaws.
A critical path traversal vulnerability in Fortinet's FortiMail gateway is being actively exploited in the wild. CISA has mandated immediate patching for US federal agencies to prevent arbitrary file writes.
Security researchers have identified a new wave of AI-driven zero-day exploit chains targeting critical infrastructure. The campaign has resulted in the exposure of over 543,000 live secrets globally.
Security agencies are scrambling as critical zero-day vulnerabilities in FortiMail (CVE-2026-104286) and Cisco SD-WAN (CVE-2026-76504) are actively exploited in the wild. CISA has mandated immediate patching for federal agencies to mitigate the risk of arbitrary file writes and remote code execution.
CISA has added a critical Zammad helpdesk zero-day chain (CVE-2026-102489 and CVE-2026-102490) to its KEV catalog. Attackers are chaining these flaws to achieve remote code execution and root escalation.
The Warlock ransomware group is actively exploiting a chain of Microsoft SharePoint zero-day vulnerabilities to compromise water utilities and telecom providers. This campaign marks a significant escalation in targeting critical infrastructure across multiple continents.
The China-linked Warlock group has launched a series of high-impact attacks against water utilities and telecom providers. The campaign leverages a sophisticated chain of zero-day vulnerabilities known as ToolShell.
Multiple critical zero-day vulnerabilities in FortiMail and Citrix NetScaler are currently being exploited in the wild. CISA has issued emergency directives for federal agencies to remediate these flaws immediately.
Security researchers have confirmed active in-the-wild exploitation of critical zero-day vulnerabilities in FortiMail and Zammad systems. CISA has mandated immediate patching for federal agencies.
Paragon Solutions confirms it cannot track misuse of its Graphite spyware, while a new CoreGraphics zero-day (CVE-2026-86950) emerges, threatening high-risk users with potential mercenary exploitation.
Cisco has confirmed a critical authentication bypass vulnerability (CVE-2026-76504) in its SD-WAN Manager, currently being exploited in the wild. CISA has mandated federal agencies to patch by October 3, 2026.
Security researchers have confirmed active in-the-wild exploitation of critical RCE vulnerabilities in Citrix NetScaler and Cisco SD-WAN. CISA has mandated immediate patching for federal agencies.
Security teams are scrambling to patch critical RCE vulnerabilities in Citrix NetScaler and F5 BIG-IP APM after confirmed in-the-wild exploitation. These zero-days allow unauthenticated remote code execution.
Global infrastructure faces heightened risk as threat actors exploit critical zero-day vulnerabilities in Citrix NetScaler and F5 BIG-IP appliances. Security agencies have issued urgent warnings.
Four distinct nation-state threat actors have rapidly adopted the BlueMoon Chrome-and-Windows exploit kit within a 12-day window. This surge suggests a coordinated or AI-accelerated proliferation of zero-day capabilities targeting global infrastructure.
Threat actors are actively exploiting two critical remote code execution zero-day vulnerabilities in Citrix NetScaler ADC and Gateway. CISA has added these flaws to its Known Exploited Vulnerabilities catalog.
Citrix has confirmed active, in-the-wild exploitation of two critical remote code execution zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway products.
Citrix has issued emergency patches for two critical RCE zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, following confirmed in-the-wild exploitation. CISA has added both flaws to its Known Exploited Vulnerabilities (KEV) catalog, urging immediate remediation.
CISA has added eight new critical vulnerabilities in Citrix NetScaler ADC and Gateway to its Known Exploited Vulnerabilities catalog. Threat actors are actively using these flaws for remote code execution.
CISA has added two critical zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to its Known Exploited Vulnerabilities catalog. Threat actors are actively leveraging these flaws for remote code execution.
CISA has added two critical RCE vulnerabilities in Citrix NetScaler ADC and Gateway to its KEV catalog following reports of active exploitation. Organizations are urged to patch immediately.
The ShinyHunters extortion group is actively exploiting a critical Oracle PeopleSoft vulnerability (CVE-2026-35273) by utilizing URL-encoding techniques to bypass existing WAF mitigations. This development follows a series of high-profile zero-day disclosures throughout September 2026.
In a rare display of inter-gang hostility, the prolific extortion group ShinyHunters has claimed a successful breach of the Clop ransomware infrastructure. This development marks a significant shift in the 2026 threat landscape as criminal syndicates begin targeting one another.
Check Point has patched a critical zero-day vulnerability, CVE-2026-93616, which allowed unauthenticated attackers to gain administrative access. The flaw is under active exploitation in the wild.
Recent intelligence indicates a surge in state-sponsored actors leveraging zero-day vulnerabilities in edge networking hardware. These campaigns prioritize long-term persistence within critical infrastructure.
Check Point has issued an urgent warning regarding a zero-day vulnerability in its Quantum Security Gateways being actively exploited by ransomware actors. The flaw allows unauthorized access to admin panels.
Google has issued an urgent security update for Pixel devices to address CVE-2026-58704, a high-severity zero-day vulnerability in the modem subcomponent currently under limited, targeted exploitation.
Security agencies are scrambling to address a wave of active zero-day exploits targeting critical infrastructure, including Cisco Secure Email Gateways and Google Pixel modem firmware.
CISA and security agencies have issued urgent warnings regarding active exploitation of a critical SQL injection vulnerability (CVE-2026-76461) in Cisco AsyncOS, allowing remote root-level command execution.
Intelligence reports indicate a surge in sophisticated cyber-espionage operations by the state-sponsored actor APT41. The campaign focuses on compromising telecommunications backbones to facilitate long-term data exfiltration.
CISA has mandated federal agencies patch a critical Google Pixel modem vulnerability (CVE-2026-58704) within three days due to active, zero-click exploitation in the wild.
Arista Networks has confirmed active exploitation of a critical zero-day vulnerability in its VeloCloud platform. Security teams are urged to prioritize patching as attackers leverage the flaw.
Cisco has issued urgent patches for two critical zero-day vulnerabilities, CVE-2026-76460 and CVE-2026-76461, currently under active exploitation. Both flaws allow unauthenticated remote attackers to gain root access.