19 results

Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows

On September 1, 2026, Volexity's Network Security Monitoring (NSM) service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). The emails

CVE-2026-85046 · CVE-2026-87491 · CVE-2026-85880

Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

In early July 2026, Volexity was engaged to perform an incident response investigation where it discovered a threat actor had successfully compromised SonicWall Secure Mobile Access (SMA) VPN appliances through a chain of multiple zero-day

CVE-2026-15409 · CVE-2026-15410

AI Code Sandboxes: A Comparative Security Study. Part 1 of 2 -- Engine-Level Properties (Attack Surface, Leakage, Stackability, CVE History, Patch Cadence, Fuzzing)

arXiv:2606.08433v1 Announce Type: new Abstract: This paper reads six engine-level measurements together -- 1.1 host attack surface, 1.2 information leakage, 1.3 defense-in-depth stackability, 1.4 public CVE history, 1.5 patch cadence, and 1

Gogs 0-Day Exploited in the Wild

Wiz Threat Research has observed exploitation in-the-wild of CVE-2025-8110

CVE-2025-8110

Critical WebP 0-day security CVE-2023-4863 impacts wider software ecosystem

CVE-2023-4863 vulnerability identified in the WebP library libwebp extends to more than just browsers - Learn how to find and fix this critical vulnerability with Snyk

CVE-2023-4863

Everything We Know About CVE-2023-23397 | Huntress

Huntress is tracking CVE-2023-23397, a 0-day that impacts Microsoft Outlook and requires no user interaction to expose user credential hashes.

CVE-2023-23397

CVE-2022-27518 exploited in the wild by APT5: everything you need to know

Detect and mitigate CVE-2022-27518, a Citrix ADC and Gateway unauthenticated RCE 0-day exploited in the wild by a nation state actor. Organizations should patch urgently.

CVE-2022-27518

New 0-Day Vulnerabilities Found in Microsoft Exchange | Huntress

The Huntress team is currently investigating new 0-day vulnerabilities in Microsoft Exchange servers, piggybacking on ProxyShell and ProxyLogon.

A 90-Day Action Plan to Turn Resolutions into Results with Wiz

Whether you're new to Wiz or early in your cloud security journey, start the year strong by turning cloud security resolutions into real impact in your first 90 days with Wiz.

PatchRisk: Forecasting Future Vulnerability Exposure in Open-Source Dependency Networks

arXiv:2609.13719v2 Announce Type: replace Abstract: Open-source software ecosystems are web-scale dependency networks. A downstream package can become exposed to security risk not because its own source code changes, but because one of its

There's only so much code: the rise in vulnerability numbers

Frontier AI models (like Mythos) are rapidly mining decades of technical debt across ubiquitous legacy libraries, driving monthly Microsoft Patch Tuesday vulnerability advisories up more than tenfold (reaching 1,415 this month). This volume

CVE-2021-44228

Frontier Model Is the Wrong Meter for Continuous Security

The economics of continuous security at frontier-model prices, and why the math points back to independence. The frontier models are astonishing at finding vulnerabilities. That is not in dispute, and it is not what this piece is about. The

The June 2026 AI Executive Order: What federal agencies need to know and how Tenable can help

On June 2, 2026, the White House signed an Executive Order directing federal agencies to harden their systems with AI-enabled cyber defenses and to stand up a new AI cybersecurity clearinghouse - most of it on a 30-day clock. Here's what t

GitHub expands application security coverage with AI-powered detections

AI is accelerating software development and expanding the range of languages and frameworks used in modern repositories. Security teams are increasingly responsible for protecting code written across many ecosystems, not just the core enter