◈ Encrygma — AI Cyber Security Intelligence. Defensive research only. No exploit code or attack instructions. All analysis based on public reporting & OSINT. ◈
37 articles tagged with #zero-day
Security researchers have identified a new wave of AI-driven zero-day exploit chains targeting critical infrastructure. The campaign has resulted in the exposure of over 543,000 live secrets globally.
CISA has added a critical Zammad helpdesk zero-day chain (CVE-2026-102489 and CVE-2026-102490) to its KEV catalog. Attackers are chaining these flaws to achieve remote code execution and root escalation.
Security agencies are scrambling as critical zero-day vulnerabilities in FortiMail (CVE-2026-104286) and Cisco SD-WAN (CVE-2026-76504) are actively exploited in the wild. CISA has mandated immediate patching for federal agencies to mitigate the risk of arbitrary file writes and remote code execution.
Multiple critical zero-day vulnerabilities in FortiMail and Citrix NetScaler are currently being exploited in the wild. CISA has issued emergency directives for federal agencies to remediate these flaws immediately.
Security researchers have confirmed active in-the-wild exploitation of critical zero-day vulnerabilities in FortiMail and Zammad systems. CISA has mandated immediate patching for federal agencies.
The China-linked Warlock group has launched a series of high-impact attacks against water utilities and telecom providers. The campaign leverages a sophisticated chain of zero-day vulnerabilities known as ToolShell.
The Warlock ransomware group is actively exploiting a chain of Microsoft SharePoint zero-day vulnerabilities to compromise water utilities and telecom providers. This campaign marks a significant escalation in targeting critical infrastructure across multiple continents.
Security researchers have confirmed active in-the-wild exploitation of critical RCE vulnerabilities in Citrix NetScaler and Cisco SD-WAN. CISA has mandated immediate patching for federal agencies.
Cisco has confirmed a critical authentication bypass vulnerability (CVE-2026-76504) in its SD-WAN Manager, currently being exploited in the wild. CISA has mandated federal agencies to patch by October 3, 2026.
Paragon Solutions confirms it cannot track misuse of its Graphite spyware, while a new CoreGraphics zero-day (CVE-2026-86950) emerges, threatening high-risk users with potential mercenary exploitation.
Security teams are scrambling to patch critical RCE vulnerabilities in Citrix NetScaler and F5 BIG-IP APM after confirmed in-the-wild exploitation. These zero-days allow unauthenticated remote code execution.
Global infrastructure faces heightened risk as threat actors exploit critical zero-day vulnerabilities in Citrix NetScaler and F5 BIG-IP appliances. Security agencies have issued urgent warnings.
Four distinct nation-state threat actors have rapidly adopted the BlueMoon Chrome-and-Windows exploit kit within a 12-day window. This surge suggests a coordinated or AI-accelerated proliferation of zero-day capabilities targeting global infrastructure.
Threat actors are actively exploiting two critical remote code execution zero-day vulnerabilities in Citrix NetScaler ADC and Gateway. CISA has added these flaws to its Known Exploited Vulnerabilities catalog.
Citrix has confirmed active, in-the-wild exploitation of two critical remote code execution zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway products.
Citrix has issued emergency patches for two critical RCE zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, following confirmed in-the-wild exploitation. CISA has added both flaws to its Known Exploited Vulnerabilities (KEV) catalog, urging immediate remediation.
CISA has added eight new critical vulnerabilities in Citrix NetScaler ADC and Gateway to its Known Exploited Vulnerabilities catalog. Threat actors are actively using these flaws for remote code execution.
CISA has added two critical zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to its Known Exploited Vulnerabilities catalog. Threat actors are actively leveraging these flaws for remote code execution.
CISA has added two critical RCE vulnerabilities in Citrix NetScaler ADC and Gateway to its KEV catalog following reports of active exploitation. Organizations are urged to patch immediately.
The ShinyHunters extortion group is actively exploiting a critical Oracle PeopleSoft vulnerability (CVE-2026-35273) by utilizing URL-encoding techniques to bypass existing WAF mitigations. This development follows a series of high-profile zero-day disclosures throughout September 2026.
In a rare display of inter-gang hostility, the prolific extortion group ShinyHunters has claimed a successful breach of the Clop ransomware infrastructure. This development marks a significant shift in the 2026 threat landscape as criminal syndicates begin targeting one another.
Check Point has patched a critical zero-day vulnerability, CVE-2026-93616, which allowed unauthenticated attackers to gain administrative access. The flaw is under active exploitation in the wild.
Recent intelligence indicates a surge in state-sponsored actors leveraging zero-day vulnerabilities in edge networking hardware. These campaigns prioritize long-term persistence within critical infrastructure.
Check Point has issued an urgent warning regarding a zero-day vulnerability in its Quantum Security Gateways being actively exploited by ransomware actors. The flaw allows unauthorized access to admin panels.
Google has issued an urgent security update for Pixel devices to address CVE-2026-58704, a high-severity zero-day vulnerability in the modem subcomponent currently under limited, targeted exploitation.
Security agencies are scrambling to address a wave of active zero-day exploits targeting critical infrastructure, including Cisco Secure Email Gateways and Google Pixel modem firmware.
CISA and security agencies have issued urgent warnings regarding active exploitation of a critical SQL injection vulnerability (CVE-2026-76461) in Cisco AsyncOS, allowing remote root-level command execution.
Intelligence reports indicate a surge in sophisticated cyber-espionage operations by the state-sponsored actor APT41. The campaign focuses on compromising telecommunications backbones to facilitate long-term data exfiltration.
CISA has mandated federal agencies patch a critical Google Pixel modem vulnerability (CVE-2026-58704) within three days due to active, zero-click exploitation in the wild.
Arista Networks has confirmed active exploitation of a critical zero-day vulnerability in its VeloCloud platform. Security teams are urged to prioritize patching as attackers leverage the flaw.
Cisco has issued urgent patches for two critical zero-day vulnerabilities, CVE-2026-76460 and CVE-2026-76461, currently under active exploitation. Both flaws allow unauthenticated remote attackers to gain root access.
A critical directory traversal vulnerability (CVE-2026-59310) in VMware vCenter Server is being actively exploited in the wild. The flaw allows unauthenticated remote attackers to achieve arbitrary code execution.
Security researchers have identified active exploitation of a critical SQL injection vulnerability in Cisco Secure Email Gateways and a high-severity modem flaw in Google Pixel devices. Both vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog as of mid-September 2026.
Security teams are scrambling as multiple zero-day vulnerabilities, including critical flaws in Cisco Secure Email Gateways and Google Pixel devices, are being actively exploited in the wild.
Security teams are scrambling to patch active zero-day exploits in Cisco Secure Email Gateways and Google Pixel devices. Both vulnerabilities are currently being leveraged by threat actors in the wild.
Cisco has issued emergency patches for two actively exploited zero-day vulnerabilities, CVE-2026-76461 and CVE-2026-76460, impacting Secure Email Gateway and Identity Services Engine appliances respectively.
Security researchers have confirmed a surge in autonomous AI-driven cyber operations, highlighted by a recent incident where an AI agent swarm successfully breached the RubyGems package manager.