Tag: zero-day

Critical Fortinet Zero-Day Exploited in Wild, Malicious npm Campaign Targets Databases

Fortinet released emergency patches for CVE-2026-35616, a critical pre-authentication bypass in FortiClient EMS being actively exploited. Researchers also discovered 36 malicious npm packages masquerading as Strapi plugins to exploit databases and deploy persistent implants.

Apr 5, 2026The Hacker News, MSRC Security Updates

fortinetzero-daynpm-supply-chain

criticalMalware & Threats

Critical Cisco IMC Auth Bypass, F5 RCE Exposure, and Active Zero-Day Attacks Dominate Threat Landscape

Critical infrastructure faces active attacks via Cisco IMC authentication bypass and F5 BIG-IP RCE vulnerabilities affecting thousands of exposed systems. Meanwhile, threat actors deploy new malware including CrystalRAT, NoVoice Android malware, and leverage zero-day exploits in TrueConf servers.

Apr 2, 2026BleepingComputer, Graham Cluley, Cisco Talos, Malwarebytes Labs

ciscof5-networkszero-day

🏴Qilin🏴Play

🇦🇪Telegram🇺🇸Google🇺🇸Apple

highData Breaches & Incidents

Critical ImageMagick Zero-Day Enables RCE via Image Uploads

Security researchers at Octagon Networks disclosed a critical zero-day vulnerability in ImageMagick that allows remote code execution through malicious image uploads. The flaw affects Ubuntu, Amazon Linux, and WordPress installations by bypassing security policies through magic byte manipulation.

Apr 1, 2026Hackread

imagemagickzero-dayremote-code-execution

🇺🇸Amazon

highVulnerabilities & Exploits

Zero-Day Exploitation Surges: TrueConf Attack, North Korean Supply Chain Hit, and Living-Off-The-Land Tactics

Attackers are exploiting zero-day vulnerabilities in TrueConf video conferencing software targeting Southeast Asian governments and compromising the popular Axios npm package through North Korean threat actors. Meanwhile, cybercriminals are shifting tactics to abuse legitimate administrative tools already present in enterprise environments.

Apr 1, 2026The Hacker News, Microsoft Security, SANS ISC, MSRC Security Updates

zero-daysupply-chainliving-off-the-land

🏴Anonymous

🇺🇸Google🇺🇸Meta Platforms

criticalIndustry & Policy

Weekly Threat Brief: March 15-22, 2026 — Supply Chain Attacks and Zero-Day Exploitation Surge

Supply chain attacks compromised major security tools including Trivy scanner and AppsFlyer SDK while Russian APTs actively exploited zero-days in iOS, Cisco firewalls, and Zimbra. Critical infrastructure faced sustained assault from ransomware groups and state actors.

Mar 22, 2026Black Temple Weekly Digest

weekly-roundupthreat-intelligencesupply-chain-attacks

🇰🇵Lazarus🏴Lapsus$🇨🇳Winnti

🇺🇸Meta Platforms🇦🇪Telegram🇺🇸Google🇺🇸Oracle Data Cloud🇺🇸Snap Inc

highNation-State & APT

Magento Under Siege: PolyShell Zero-Day Fuels Mass Defacements, AI Fraud Tactics Emerge

Security researchers disclosed the PolyShell vulnerability affecting Magento and Adobe Commerce platforms, enabling unauthenticated file uploads. Concurrent mass exploitation campaigns have compromised over 7,500 Magento sites since February, while threat actors increasingly leverage AI agents for sophisticated retail fraud operations.

Mar 21, 2026Security Affairs, Palo Alto Unit 42

magentoadobe-commercepolyshell

highMalware & Threats

Critical Infrastructure Under Siege: Lazarus Strikes, FBI Raids, and Zero-Days in Production

This week saw coordinated law enforcement action against massive DDoS botnets, while state-sponsored groups like Lazarus and APT28 launched destructive attacks on medical technology and government infrastructure. Multiple zero-day vulnerabilities in enterprise systems add to the threat landscape.

Mar 20, 2026BleepingComputer, Graham Cluley, Cisco Talos, Malwarebytes Labs

botnet-disruptionstate-sponsoredransomware

🇰🇵Lazarus🇰🇵BlueNoroff🇷🇺APT28

🇺🇸Google🇺🇸Amazon🇺🇸Apple

highNation-State & APT

Nation-State Roundup: Russian APT Exploits Zimbra Zero-Day, Iranian Group Hits Stryker via Microsoft Intune

Nation-state actors continue sophisticated campaigns with Russian APT exploiting Zimbra zero-day against Ukrainian targets and Iranian threat actors compromising Stryker through Microsoft Intune. Meanwhile, ransomware groups exploit Cisco firewall zero-days and law enforcement disrupts major IoT botnets.

Mar 20, 2026Security Affairs, The Record

russian-aptiranian-aptzero-day

🇺🇸Amazon

criticalVulnerabilities & Exploits

Critical iOS Zero-Day Kit and Cisco FMC Ransomware Attacks Highlight AI Security Gaps

A new iOS exploit kit called DarkSword uses three zero-days for complete device compromise, while Interlock ransomware actively exploits a critical Cisco FMC vulnerability with CVSS 10.0 severity. Meanwhile, AI coding agents like Claude Code are operating in enterprise environments without traditional security controls.

Mar 19, 2026The Hacker News, Microsoft Security, Qualys, SANS ISC, MSRC Security Updates

ios-exploitszero-dayransomware

🇺🇸Google🇺🇸Amazon🇺🇸Apple

criticalNation-State & APT

Russian Hackers Deploy DarkSword Zero-Day for Drive-By iOS 18 Exploitation

Russian threat actors have been discovered using DarkSword, a sophisticated zero-day exploit that can compromise iOS 18 devices simply by visiting infected websites. The technique potentially affects hundreds of millions of iPhones currently in use.

Mar 19, 2026WIRED Security

ioszero-dayrussian-apt

🇺🇸Apple

highIndustry & Policy

Zero-Day Exploitation Windows Shrink as AI Accelerates Attacks, FCA Tightens Incident Rules

AWS reports that Interlock ransomware has been exploiting an undisclosed Cisco firewall zero-day since January, while Rapid7 research shows AI is accelerating attacker response times to just 5 days from vulnerability disclosure to CISA KEV inclusion.

Mar 19, 2026Infosecurity Magazine

zero-dayransomwareregulatory-compliance

🇺🇸Amazon

criticalVulnerabilities & Exploits

Critical Chrome Zero-Day Under Active Attack, North Korean Campaigns Target KakaoTalk, Supply Chain Attacks Hit Python Repos

Google confirms active exploitation of Chrome zero-day CVE-2026-3909 affecting Skia rendering. Meanwhile, North Korean Konni group leverages KakaoTalk for malware distribution and GlassWorm campaign injects malware into hundreds of Python repositories using stolen GitHub tokens.

Mar 17, 2026The Hacker News, Microsoft Security, SANS ISC, MSRC Security Updates

zero-daysupply-chainchrome

🇺🇸Google