Zero-day
Curated coverage and analysis in this editorial area.
Zero-Day RCE in Genesis World: ZDI Publishes Advisory With No Patch Available
TrendAI Zero Day Initiative disclosed ZDI-26-756, a zero-day deserialization vulnerability in Genesis World that enables remote code e…
VM Escape Zero-Day in KVM: Vercel Confirms and Pays $50,000 Bounty
Vercel has confirmed a zero-day vulnerability in Linux KVM that allows a full guest-to-host escape with root privileges. The company p…
ShieldCrash: The Eleventh Microsoft Zero-Day That Renders the ShieldBreak Patch Useless
Nightmare Eclipse has released ShieldCrash, a new exploit that bypasses Microsoft's patch for ShieldBreak (CVE-2026-69414) in Microsof…
Exploitarium: The 'Recruitment by Chaos' That Shatters the CVD Model
Pseudonymous researcher 'bikini' dumped over 30 zero-day PoC exploits on GitHub on June 27, 2026, without any vendor coordination. CVE…
CISA Adds Apple Zero-Day CVE-2025-43300 to KEV Catalog: CVSS 10, September 11 Deadline
CISA has cataloged CVE-2025-43300, an out-of-bounds write in Apple ImageIO rated CVSS 10.0 CRITICAL. Federal civilian agencies must pa…
GeoServer Zero-Day Under Attack: The Regression Exposing Cracks in the Secure Development Lifecycle
Threat actors began probing a SQL injection zero-day in GeoServer within hours of its public disclosure on August 12, 2026. The vulner…
PAX Q80: 0-day ZDI-26-526 Leaves Payment Terminals Unpatched
Trend Micro's Zero Day Initiative has published advisory ZDI-26-526, a 0-day vulnerability with a CVSS 7.5 score that enables RCE as r…
Qualcomm Zero-Day Exploited in Targeted Attacks: Android Remains Exposed
Google confirms limited exploitation of CVE-2026-21385 in the Qualcomm graphics kernel. Patches have existed since January, but delive…
Commercial Spyware and Zero-Days: Smartphone Exploit Chains Are Now a Product
Zero-click exploit chains for iOS and Android have become commercial products. Bitdefender's dossier compiles confirmed cases and docu…
AnyDesk 0-Day ZDI-26-400: Vendor Ignored 16 Months of Coordinated Disclosure
ZDI published advisory ZDI-26-400 for CVE-2026-15681, a local denial-of-service vulnerability in AnyDesk rated CVSS 4.7. The vendor re…
LegacyHive: Nightmare Eclipse's Ninth Zero-Day Pierces Fully Patched Windows
Nightmare Eclipse has released LegacyHive, a zero-day exploit targeting the Windows User Profile Service to load arbitrary registry hi…
Exploitarium: The Speed Paradox — Public Exploits for Already-Patched Flaws
Pseudonymous researcher 'bikini' dumped 30+ zero-day PoCs on GitHub without coordinated disclosure. CVE-2026-55200 in libssh2 had a fi…