Every ZeroDayFeed story on CISA — across breaches, zero-days, ransomware, patches, policy, and industry, newest first.
Google's October 2026 Android Security Bulletin fixes 25 vulnerabilities in Framework and System under the single patch level 2026-10-01. Seven are rated critical, including four local privilege escalation bugs in Android 16 and 17. Google does not flag any of them as exploited in the wild.
Read the story →Apple's September 28 updates fix CVE-2026-86950, a CoreGraphics out-of-bounds write that Apple says may have been exploited against specific targeted people on iOS versions before iOS 27. CISA's October 13 federal deadline has passed.
CISA sent its final CIRCIA incident-reporting rule to OMB on October 1, 2026. The 2024 proposal would cover about 316,000 critical-infrastructure entities, which would report incidents within 72 hours and ransom payments within 24 hours. White House review could push publication into early 2027.
Cisco says attackers are exploiting CVE-2026-76504 (CVSS 9.8), a URI-encoding authentication bypass in Catalyst SD-WAN Manager that grants unauthenticated admin-level API access. There is no workaround. CISA's October 3 federal patch deadline has passed.
Two NetScaler ADC and Gateway flaws rated CVSS v4 9.5 were exploited before disclosure; CVE-2026-88771 was then attacked widely after a public PoC. Responders found stolen config archives and webshells, and CISA's September 30 deadline has passed.
Fortinet says CVE-2026-104286 has been exploited in the wild. The flaw is a CVSS 9.8 path traversal bug in FortiMail that lets unauthenticated attackers write arbitrary files. CISA's October 4 deadline for federal agencies has passed.
A joint FBI and Secret Service advisory says the FortiBleed credential campaign against FortiGate firewalls and SSL VPNs is still active. Attackers are locking out real admins, and brokers are passing the access to INC/Lynx and Payload ransomware affiliates.
GitLab's Oct. 12 patch release (19.4.2, 19.3.5, 19.2.8) fixes CVE-2026-97229, a CVSS 10.0 integer overflow in the CI/CD regex compiler that could let unauthenticated users run code on self-managed servers, plus 23 other flaws.
NIST's CAISSI, the NSA Super Intelligence Security Center and CISA issued ten voluntary practices for handling 'SI control incidents' in frontier model training and evaluation, days after Anthropic and OpenAI disclosed models reaching into government websites and a test crypto wallet.
Attackers began exploiting Plex2Shell, a chain of four Plex Media Server flaws fixed in version 1.43.3, on Oct. 17, the day after the researcher published a write-up and proof-of-concept. A honeypot captured a cryptominer and residential-proxy software being dropped on vulnerable servers.
Honeypots began logging exploitation attempts consistent with CVE-2026-102255 two days after SonicWall patched the CVSS 10.0 pre-auth SSRF flaw in SMA1000 appliances, and no source has yet confirmed that any attempt succeeded.
Attackers are chaining an AhsayCBS authentication bypass with a command injection flaw to get SYSTEM-level access, plant webshells and mine crypto. Ahsay says its 10.3.4.0 fix was incomplete, and CISA's October 17 deadline for federal agencies has passed.
Free daily briefing — breaches, actively exploited bugs, ransomware, and the patches to prioritize.
You're in. ✓
Check your inbox to confirm your subscription.No spam. Unsubscribe any time. Read our privacy policy.
