ShieldCrash is a zero-day exploit targeting Microsoft Defender on fully patched Windows systems as of September 2026. It enables privilege escalation to full System privileges, allowing attackers to perform sensitive actions such as dumping the SAM database. This exploit bypasses previous patches for related vulnerabilities including ShieldBreak and RoguePlanet, indicating incomplete remediation by Microsoft. The underlying vulnerability is tracked as CVE-2026-69414. No official patch specifically addressing ShieldCrash has been confirmed at this time.
The Dark Sword exploit is an iOS exploit chain that was active earlier in the year and has since been patched. It was reportedly used primarily against high-profile targets, but the exploit code has been leaked publicly. This raises concerns about the potential risk to average iPhone users. However, there is no evidence of widespread exploitation against typical users. The exploit is considered high severity due to its capabilities, but the risk to the general population remains low given targeted use and the availability of patches.
A security researcher known as Nightmare Eclipse has released proof-of-concept zero-day exploits targeting Avast, CrowdStrike, and Nvidia products. These exploits enable privilege escalation, allowing attackers to spawn shells with system-level privileges. The vulnerabilities affect Avast's sandbox, CrowdStrike Falcon Sensor's Office macro remediation feature, and an out-of-bounds memory write in Nvidia user-mode components. GenDigital (Avast) has patched the vulnerability, and CrowdStrike is investigating and advising mitigation steps. Nvidia has not yet publicly responded. The exploits demonstrate active research and disclosure but no confirmed active exploitation in the wild.
An AI model named Cyberkimi claims to have autonomously developed a live exploit for a recently patched V8 JavaScript engine vulnerability in under 24 hours. The exploit targets Chrome Stable versions that still contain the unpatched bugs. The AI reportedly analyzed recent V8 security patches, identified incomplete fixes, and generated a working exploit chain demonstrated in a local Chromium environment. No official CVE has been assigned to these specific bugs yet, and independent confirmation is lacking. The exploit reportedly leverages a combination of aliasing bugs, race conditions, and control flow hijacking to achieve arbitrary code execution. Google has released Chrome updates addressing some V8 vulnerabilities around the same time, but it is unclear if these fixes cover the bugs exploited by Cyberkimi. This development highlights the shrinking window between patch release and exploit weaponization, potentially accelerating the risk exposure for users of affected Chrome versions.
Google has updated the Chrome browser to address an actively exploited high-severity zero-day flaw in the V8 engine and 11 other vulnerabilities. [...]
Langflow versions prior to 1.10.0 contain a remote code execution (RCE) vulnerability identified as CVE-2026-9198. An exploit exists that leverages an API endpoint to obtain a superuser token and then executes arbitrary code on the target system. The exploit has been tested on Ubuntu 22.04.
Ghost_CMS versions from 0.7.2 up to and including 6.19.0 are affected by a remote code execution vulnerability identified as CVE-2026-29053. This vulnerability allows an attacker to execute arbitrary code remotely on affected systems. The issue is classified as critical severity. No patch or remediation information is provided in the available data. Exploit code is publicly known and categorized as an exploit. The affected platforms include Ubuntu 18.0.4 and Windows 10.
PodcastGenerator version 3.2.9 contains a stored Cross-Site Scripting (XSS) vulnerability in its Live Items functionality. An authenticated administrator can inject malicious JavaScript code into the TITLE, SHORT DESCRIPTION, or LONG DESCRIPTION fields of a Live Item. This payload is stored and executed when the Live Item is viewed both in the administrative interface and on the public Live Stream page. While administrative privileges are required to inject the payload, any unauthenticated user visiting the public Live Stream page can trigger the stored script execution.
A denial of service (DoS) vulnerability has been identified in EVerest version 2025.9.0. This issue could potentially allow an attacker to disrupt the availability of the affected software. No detailed technical information or exploit code is provided.
Wolf CMS version 0.8.3.1 is affected by a remote code execution (RCE) vulnerability. This allows an attacker to execute arbitrary code on the affected system remotely. The vulnerability is critical in severity and affects versions up to and including 0.8.3.1.
Over 8,300 Internet-exposed Gitea instances are still unpatched against a critical security flaw exploited in ongoing remote code execution attacks, according to cybersecurity watchdog Shadowserver. [...]
PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. [...]
Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence company Defused. [...]
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform. [...]
A critical remote code execution vulnerability (CVE-2026-73570) in Zimbra Collaboration Suite (ZCS) is actively exploited in the wild. The flaw arises from improper sanitization of untrusted input in the SNMP notification processing component, allowing unauthenticated attackers to execute arbitrary OS commands as the Zimbra user. The vulnerability was patched in Zimbra version 10.1.20 released on July 20, 2026. CERT Polska has warned administrators to check for signs of compromise, including unexpected service restarts and suspicious files in specific directories. Zimbra servers remain a frequent target for attackers, with many exposed servers worldwide, especially in Europe and Asia.
Threat actors gained root access to the vulnerable systems and deployed a Monero miner. The post Recent macOS Screen Sharing Vulnerability Exploited in Attacks appeared first on SecurityWeek .
Dropped on Patch Tuesday, the exploit allows any user to spawn a shell with System privileges. The post Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’ appeared first on SecurityWeek .