Zero-day
Curated coverage and analysis in this editorial area.
Active Exchange Zero-Day: Unpatched OWA Vulnerability Under Exploitation
Microsoft has confirmed CVE-2026-42897, a zero-day XSS vulnerability in on-premise Exchange servers currently under active attack. Wit…
Palo Alto Networks Zero-Day: PAN-OS Vulnerability Grants Attackers Root Perimeter Control
CVE-2026-0300 enables unauthenticated root RCE on PAN-OS firewalls. With CISA Mandating mitigation within three days, we analyze the e…
Ivanti EPMM Zero-Day: Admin-Authenticated RCE Triggers Urgent CISA Patch Mandate
Ivanti has disclosed CVE-2026-6973, a critical zero-day in Endpoint Manager Mobile (EPMM) allowing RCE with administrative privileges.…
Apple Fixes WebKit Zero-Days Exploited in 'Extremely Sophisticated' Attacks
Apple has issued emergency security updates for Safari 26.2 and iOS 18.7.3 to remediate two critical WebKit vulnerabilities (CVE-2025-…
Cisco SD-WAN Zero-Day: 'Ghost Peers' Infiltrated Controllers Since 2023
CVE-2026-20127 in Cisco Catalyst SD-WAN controllers allowed a sophisticated threat actor to impersonate trusted peers for over three y…
Critical PAN-OS Zero-Day CVE-2026-0300: Unauthenticated Root RCE Hits Exposed Firewalls
CVE-2026-0300: An unauthenticated root RCE vulnerability in the PAN-OS Captive Portal has seen active exploitation since April 9. Whil…
BitLocker Zero-Day: Encrypted Drives Unlocked via USB and WinRE — No Credentials Needed
A new proof-of-concept named YellowKey enables BitLocker bypasses on Windows 11 and Server editions by exploiting the Windows Recovery…
Google Report: Enterprise Tech Hit by Record 48% of Zero-Day Exploits in 2025
Google’s GTIG report tracks 90 zero-days exploited in 2025, revealing a strategic pivot toward enterprise infrastructure. Chinese APT…