Latest Zero-Day news

A zero-day in TrueConf's update mechanism let a China-linked actor distribute Havoc C2 implants to dozens of Southeast Asian government agencies through a single compromised server. CVE-2026-3502 (CVSS 7.8) required no signature bypass because there was no signature check. Patched …

Fourth Chrome zero-day of 2026 targets the Dawn WebGPU layer. CVE-2026-5281 is a use-after-free exploited in the wild as a likely sandbox escape primitive. CISA set an April 15 federal deadline. Same researcher reported three other Dawn/WebGL bugs in two …

Attackers breached the European Commission's cloud environment and claim 350 GB stolen from Europa.eu. Segmentation held, but this is the Commission's second breach in 56 days after Ivanti zero-days hit its MDM platform in January.

Oracle's emergency patch fixes a CVSS 9.8 pre-auth RCE in Identity Manager. PTC Windchill carries a CVSS 10.0 zero-day with webshell IOCs but no patch. Langflow AI pipelines were exploited within 20 hours of disclosure. Two Chrome zero-days hit CISA …

Thirty-six days of zero-day access. Interlock ransomware hit Cisco Firewall Management Center via CVE-2026-20131 (CVSS 10.0) before anyone knew the flaw existed. A misconfigured server exposed their entire toolkit. CISA gave agencies three days to patch.

Six vulnerabilities, three zero-days, full kernel control. The DarkSword iOS exploit chain has been used by a spyware vendor, a surveillance customer, and suspected Russian spies across four countries since November 2025. Update to iOS 26.3.1.