Popular
Nothing found for . Try a course, an exam code (SC-200), a tool or a topic.
↑↓ moveEnter openEsc close
Cyber security news, as it breaks.
Updated 133 stories in 24 hours
Zero-Day Vulnerabilities
Malware, exploited flaws, phishing and botnets, from the researchers who found them.
13stories this week
0today
the last seven days
Most fromThe Hacker News, Security Affairs, BleepingComputer, CSO Online UK
In the news hereCisco3Ivanti2Palo Alto Networks2Apple1
MyCyberWay trainingYou can't patch everything at once. Learn what to fix first.See the Analyst curriculum
-
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August.
BleepingComputer
-
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Cisco confirmed this week that threat actors are exploiting a…
Security Affairs
-
A critical vulnerability affecting Cisco’s Secure Email Gateway product is allowing attackers to write arbitrary files on the underlying operating system. In an advisory issued on Wednesday, the company urged customers to apply available fixes after confirming that the flaw is being exploited in the wild. The flaw affects the product’s Advanced Malware Protection (AMP)…
CSO Online UK
-
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images. The fixes are in…
The Hacker News
-
The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available.
SecurityWeek
-
CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.
Dark Reading
-
Both Switchzilla and CISA sound the alarm…
The Register
-
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Windows Shell flaw, tracked as CVE-2026-96951 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft Patch Tuesday security updates for October 2026 address…
Security Affairs
-
In its October Patch Tuesday, the tech giant addressed more defects in one month than any annual total on record. Nearly 4 in 5 vulnerabilities affect Windows.
CyberScoop
-
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.
BleepingComputer
-
Vendor promises fix for separate privilege-escalation flaw in the coming weeks…
The Register
-
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st.
BleepingComputer
