Zero-day and exploit news from ZeroDayFeed — actively exploited vulnerabilities, CISA KEV additions, and what defenders need to know before the patch lands.
Attackers are chaining an AhsayCBS authentication bypass with a command injection flaw to get SYSTEM-level access, plant webshells and mine crypto. Ahsay says its 10.3.4.0 fix was incomplete, and CISA's October 17 deadline for federal agencies has passed.
Read the story →Citrix says attackers are targeting CVE-2026-88779, a memory-buffer flaw in SAML-configured NetScaler ADC and Gateway appliances, and CISA's October 7 federal patch deadline has now passed.
An unauthenticated command injection in Collabora's built-in CODE Server app for Nextcloud was used to plant webshells from September. The fix shipped Sep 11, but CVE-2026-110447 (CVSS 4.0 9.2) was not published until Oct 14.
Cisco says attackers are exploiting CVE-2026-76519 (CVSS 9.8), which lets an unauthenticated attacker gain root on a Secure Email Gateway with File Reputation enabled by sending a crafted attachment; there is no workaround, and CISA's October 17 KEV deadline has passed.
Attacks began within hours of a public proof of concept for CVE-2026-21589, a CVSS 9.3 unauthenticated file-read flaw in eight self-hosted Atlassian Data Center products, and CISA added it to its Known Exploited Vulnerabilities catalog on Oct 15.
Attackers exploited Ivanti Connect Secure auth bypass CVE-2026-104935 before disclosure, and Volexity says they chained it with a still-unpatched privilege escalation flaw to get root on a fully patched appliance. CISA added it to KEV on Oct 13.
Palo Alto Networks has patched CVE-2026-0322, a PAN-OS management-interface code-injection flaw that is being exploited in a very limited number of attacks. It gives authenticated attackers root on PA-Series and VM-Series firewalls and on Panorama, and CISA set an Oct 17 deadline for agencies to patch and check for compromise.
EG Secure Solutions and JPCERT/CC confirm in-the-wild exploitation of CVE-2026-106931, an OS command injection in SiteGuard Server Edition's default-on statistics feature that runs commands as root or SYSTEM. Fixed builds are 8.00 Update 5 and 7.00 Update 6.
CISA added Fortinet's CVE-2025-61624 to its KEV catalog with an Oct 19 deadline and a forensic-triage requirement, as Palo Alto Networks links the flaw to a long-running telecom intrusion using a memory-resident FortiGate implant it calls PeerStitch.
BeyondTrust has patched CVE-2026-102764, a Remote Support authentication bypass that Mandiant says has been exploited since Aug. 29 by Armory Castle (formerly UNC5221). CISA's KEV deadline for federal agencies is Oct. 19.
Free daily briefing — breaches, actively exploited bugs, ransomware, and the patches to prioritize.
You're in. ✓
Check your inbox to confirm your subscription.No spam. Unsubscribe any time. Read our privacy policy.
