Vulnerabilities
Ivanti Sentry Critical Flaws Exploited 24 Hours After Disclosure
Twenty-four hours separated disclosure from in-the-wild exploitation — CISA's emergency directive gives federal agencies three days to patch.
Vulnerabilities
ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) — 100+ Organizations Breached
Google Threat Intelligence confirmed mass exploitation of an Oracle PeopleSoft zero-day by ShinyHunters; universities are the primary target and the extortion has begun.
Vulnerabilities
Microsoft's Record 206-CVE Patch Tuesday and the Nightmare Eclipse Zero-Days
The largest Patch Tuesday on record arrives with three publicly disclosed zero-days — and a running feud with one researcher producing a steady stream of Microsoft exploits.
Vulnerabilities
Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild — Patch Now
The fifth in-the-wild Chrome zero-day of the year, in the V8 JavaScript engine, is now patched — but the attack pattern shows no sign of slowing.
Vulnerabilities
Check Point VPN Zero-Day CVE-2026-50751 Exploited for a Month Before Patch; Qilin Ransomware Involved
A logic-flow weakness in Check Point's Remote Access VPN gave a Qilin ransomware affiliate and other attackers a month to operate before a patch arrived.
Vulnerabilities
Cisco SD-WAN Manager Zero-Day CVE-2026-20245 Is Exploited in the Wild With No Patch Yet
Cisco warns that CVE-2026-20245, a zero-day in Catalyst SD-WAN Manager, is being exploited to gain root, with no patch available. Exploitation needs netadmin access — obtainable by chaining CVE-2026-20182 — making it Cisco's seventh exploited SD-WAN zero-day of 2026.
Vulnerabilities
Google Patches Actively Exploited Android Framework Zero-Day CVE-2025-48595
Google's June 2026 Android update fixes CVE-2025-48595, an Android Framework integer overflow that Google says may be under limited, targeted exploitation. Because the Framework is the API layer every app touches, the flaw can hand an attacker complete control of an unpatched device.
Cybersecurity 101
Zero-Day Exploit vs Zero-Day Vulnerability vs Zero-Day Attack
The three "zero-day" terms explained — vulnerability, exploit, and attack — how they connect on a timeline, why they are dangerous, and how to defend.
Vulnerabilities
KnowledgeDeliver Zero-Day CVE-2026-5426 Dropped Godzilla Web Shell and Cobalt Strike
Google's Threat Intelligence Group caught attackers exploiting CVE-2026-5426, a hardcoded ASP.NET machineKey in Digital Knowledge's KnowledgeDeliver LMS, to forge ViewState payloads, drop the Godzilla web shell, and stage Cobalt Strike Beacon. The patch alone is not enough.
Vulnerabilities
LiteSpeed cPanel Plugin Flaw CVE-2026-48172 Lets Any Account Run Code as Root, Exploited Now
CVE-2026-48172, a CVSS 10.0 flaw in the LiteSpeed User-End cPanel plugin, lets anyone with a valid cPanel account run code as root. LiteSpeed confirms it is being actively exploited. On shared hosting, one cheap account is now a path to every account on the server.
Vulnerabilities
Trend Micro Apex One Zero-Day CVE-2026-34926 Is Under Active Exploitation
Trend Micro's own Incident Response team discovered CVE-2026-34926, a directory-traversal zero-day in Apex One, while it was being exploited. CISA added it to the KEV catalog with a June 4 federal deadline. Its modest 6.7 CVSS score conceals an environment-wide blast radius.
Vulnerabilities
Microsoft Patches Two Actively Exploited Defender Zero-Days — UnDefend and RedSun Were Built to Disable the Security Tool Itself
Microsoft patched UnDefend (CVE-2026-41091) and RedSun (CVE-2026-45498), two Defender zero-days exploited in the wild since April. Their purpose is the security tool itself — one escalates through Defender, the other disables it. Barracuda ties the wave to the researcher behind MiniPlasma.