Chinese state-linked hackers have exploited a zero-day vulnerability in VMware ESXi during espionage operations aimed at U.S. law firms, according to CrowdStrike’s latest assessment of threats affecting the legal sector. The activity is attributed to WARP PANDA, a China-nexus adversary that deployed malware in victims’ VMware vCenter environments. This series of intrusions, which continued into […]

The post Chinese Hackers Exploit VMware ESXi Zero-Day to Target Law Firms in Cyber Espionage Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed.

The post Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network appeared first on SecurityWeek.

Chinese state-sponsored hacking group Volt Typhoon has exploited multiple previously unknown vulnerabilities in enterprise management platforms to penetrate strategically significant organizations. Its investigation exposed Silent Train, a covert access framework built from rapidly rotating chains of compromised devices. Over three years, Black Lotus Labs issued hundreds of victim notifications, helping investigations uncover four confirmed zero-day […]

The post Volt Typhoon Hackers Exploit Multiple Zero-Days to Breach U.S. Critical Infrastructure Networks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged.

The post Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day appeared first on SecurityWeek.

Apple has released updates for iOS 18.7.11 and iPadOS 18.7.11 to address three security vulnerabilities, including a CoreGraphics flaw connected to sophisticated targeted attacks. These updates were released on October 26, 2026, and also resolve information disclosure and unauthorized camera access issues affecting the Audio and CoreMedia components. The most significant vulnerability, tracked as CVE-2026-86950, […]

The post Apple Fixes Actively Exploited iOS Zero-Day Vulnerability in CoreGraphics appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.

The post Attackers Exploit Third Arista VCO Zero-Day in Four Months appeared first on SecurityWeek.

Hackers are exploiting a command injection vulnerability (CVE-2026-73570) in the Zimbra Collaboration Suite. This vulnerability allows attackers to compromise internet-facing email servers without any user interaction. Microsoft Threat Intelligence has observed attackers deploying webshells, escalating privileges, collecting authentication secrets, and staging mailbox data across organizations in various regions and industries. Zimbra Zero-Click Flaw The “zero-click” […]

The post Hackers Exploit Zimbra Zero-Click Flaw to Take Control of Email Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts.

The post Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day appeared first on SecurityWeek.

The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available.

The post Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution appeared first on SecurityWeek.

Corelight researchers have disclosed a Windows Server vulnerability that lets attackers with network access crash affected systems with a single malicious DFS referral response. This vulnerability, tracked as CVE-2026-70111, affects Windows Server versions 2019, 2022, and 2025. According to Corelight’s disclosure on October 13, Microsoft addressed the flaw in its October 2026 updates. Notably, there […]

The post Windows Server Zero-Day Flaw Lets Attackers Crash Servers With a Single Malicious Packet appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The most important is CVE-2026-96951, a security feature bypass flaw in Windows that has been exploited in the wild.

The post Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day appeared first on SecurityWeek.

CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges. 

The post Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN appeared first on SecurityWeek.

Citrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched.

The post Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier appeared first on SecurityWeek.

CVE-2026-104286 is a critical-severity path traversal vulnerability that could allow attackers to write arbitrary files to the system.

The post Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action appeared first on SecurityWeek.

The flaws were chained to hijack sessions, achieve remote code execution, and elevate privileges to root.

The post Zammad Zero-Days Exploited in AI-Powered DIVD Hack appeared first on SecurityWeek.

The flaw could allow remote, unauthenticated attackers to access vulnerable appliances with administrative privileges.

The post Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability appeared first on SecurityWeek.

Several security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.

The post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks appeared first on SecurityWeek.

A Cursor zero-day vulnerability lets a planted git.exe run automatically when a Windows developer opens a repository. Mindgard disclosed it after seven months of silence from Cursor.

Cursor’s Unpatched Zero-Day Lets a Fake git.exe Hijack Any Windows Developer on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.

CISA added CVE-2026-48939 and CVE-2026-56291 to its Known Exploited Vulnerabilities catalog after automated attackers exploited file upload flaws in iCagenda and Balbooa Forms weeks before either bug had a CVE number.

Two Joomla Extensions Hit by Zero-Day File Upload Attacks Before Patches Landed on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.