hype
3
Substance
7
Brief · Security
Hackers exploit a Collabora flaw in Nextcloud to plant backdoors
Attackers are exploiting CVE-2026-110447, a critical command execution flaw in the Collabora Online CODE app for Nextcloud, to backdoor servers.
Topics
#zero-day
22 items · Page 2 of 2
hype
3
Substance
6
Brief · Security
Targeted ads were used to deliver 0-click exploits for mercenary spyware
Ars Technica reports that targeted ads delivered 0-click exploits that installed mercenary malware. It calls this the first confirmed case of such spyware delivered through ads.
Analysis · Security
Patch Tuesday Triage: How to Rank Hundreds of CVEs With KEV, EPSS and Exposure
A repeatable method for ranking Patch Tuesday CVEs by known exploitation, exploit likelihood and asset exposure, worked through October 2026's record batch.
hype
3
Substance
7
Brief · Security
Palo Alto Networks patches PAN-OS RCE zero-day exploited in attacks
Palo Alto Networks released fixes for CVE-2026-0322, a high-severity PAN-OS remote code execution flaw. BleepingComputer reports it is being exploited against firewalls.
hype
3
Substance
6
Brief · Security
Cisco patches a second actively exploited Secure Email Gateway zero-day
Cisco has patched another zero-day in its Secure Email Gateway that is being exploited. It allows unauthenticated remote command execution as root.
hype
5
Substance
6
Brief · Security
CISA urges immediate patch for Ivanti Connect Secure zero-day
CISA urged administrators to patch an Ivanti Connect Secure flaw exploited as a zero-day since at least October 1. The item does not give the flaw identifier.
hype
4
Substance
6
Brief · Security
Ivanti warns of actively exploited Connect Secure zero-day
Ivanti urged customers to patch an actively exploited zero-day in its Connect Secure remote access gateway. The feed summary gives no further technical details.
hype
6
Substance
7
Brief · Security
Microsoft's October Patch Tuesday fixes a record 1,411 flaws
Microsoft's October 2026 Patch Tuesday addresses 1,411 flaws, with one actively exploited zero-day and two publicly disclosed ones. Krebs reports the batch dwarfs September's near-1,000 fixes.
Analysis · Security
How Pwn2Own Works: Zero-Day Contests, Disclosure Clocks and Patch Timelines
Pwn2Own pays hackers for live exploits. Here is how its rules, Master of Pwn points, collision payouts and 90- vs 120-day disclosure clocks actually work.
hype
4
Substance
5
Brief · Security
Pwn2Own Ireland surfaces 45 zero-days
$232,500 paid out, including three more compromises of the Samsung Galaxy S26.