Google released an update for Chrome 149 that patches 74 vulnerabilities, including a critical zero-day tracked as CVE-2026-11645. This vulnerability is a high-severity out-of-bounds read/write flaw in the V8 JavaScript engine, which allows remote code execution within the sandbox via a specially crafted HTML page. The zero-day was actively exploited in the wild and reported by an anonymous researcher in late April 2026. This is the fifth Chrome zero-day exploited in 2026, highlighting an ongoing trend of critical vulnerabilities in the browser. Google has awarded the researcher $55,000 for responsible disclosure. The patch fixes this and other critical vulnerabilities, mitigating the risk posed by these exploits.
An autonomous AI agent developed by the security startup depthfirst discovered 21 zero-day vulnerabilities in the FFmpeg multimedia framework, including nine assigned CVEs (CVE-2026-39210 through CVE-2026-39218). These vulnerabilities primarily involve heap and stack overflows in various parsers and demuxers, with some bugs dating back to 2003. FFmpeg maintainers have been responsive and are shipping fixes. The discovery raises concerns about the effectiveness of traditional static and dynamic analysis tools against memory corruption in large C codebases and the potential impact of AI-driven vulnerability discovery on disclosure pipelines and vulnerability economics.
Cisco has disclosed a critical, unpatched zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager that is actively exploited in the wild. The flaw allows local attackers with netadmin privileges to perform command injection attacks, leading to root privilege escalation by uploading crafted files. Exploitation requires valid credentials or prior exploitation of related vulnerabilities (CVE-2026-20182 or CVE-2026-20127). The vulnerability affects all deployment types of the product, including on-premises and cloud-managed versions. Cisco has not yet released a patch for this zero-day but advises monitoring for indicators of compromise and engaging Cisco TAC for incident response support. The vendor has released patches for related vulnerabilities but this specific flaw remains unpatched at this time.
A security researcher publicly disclosed a critical zero-day vulnerability in Visual Studio Code's browser-based editor github.dev after losing trust in Microsoft's security response process. The vulnerability allows an attacker to steal OAuth tokens with broad repository access by exploiting how github.dev receives tokens from github.com without repo-specific scoping. An attacker who can modify a repository's . vscode/extensions.json can recommend a malicious extension that installs automatically when the victim opens the repo in github.dev, bypassing user approval via a hidden Jupyter Notebook trigger. This enables silent installation of malicious extensions capable of stealing tokens and accessing private repositories.
A security researcher known for releasing Windows zero-day vulnerabilities was banned from GitHub amid reports of vindictive behavior. The incident involves the public disclosure of unpatched Windows zero-day exploits. No specific technical details, affected software versions, or exploitation evidence are provided in the source. The situation highlights concerns about responsible disclosure and platform policies but does not confirm active exploitation or patch availability.
RedSun.exe is a publicly available proof-of-concept exploit targeting a zero-day vulnerability in Microsoft Defender on Windows systems. It enables local privilege escalation from a standard user to SYSTEM-level access by exploiting flawed Defender remediation logic for cloud-tagged malicious files and redirecting high-privilege file operations to overwrite protected system locations such as C:\Windows\System32. This allows arbitrary code execution as SYSTEM without needing administrator privileges or kernel exploits. The exploit is reliable, actively weaponized, and potentially unpatched in some environments, posing a significant risk for persistence, lateral movement, and defense evasion. No official patch or remediation guidance is currently available. Organizations should enforce least privilege principles and deploy behavior-based detection focused on suspicious Defender-related file operations and privilege escalation attempts. Monitoring for filesystem manipulation targeting protected system directories is also recommended. Rapid patching should be applied once vendor updates are released.
The LABYRINTH CHOLLIMA threat group has split into three distinct adversaries: GOLDEN CHOLLIMA, PRESSURE CHOLLIMA, and core LABYRINTH CHOLLIMA. Each subgroup has specialized malware, objectives, and tradecraft. GOLDEN CHOLLIMA and PRESSURE CHOLLIMA focus on cryptocurrency entities, while core LABYRINTH CHOLLIMA continues espionage operations targeting industrial, logistics, and defense companies. Despite operating independently, these groups share tools and infrastructure, indicating coordinated resource allocation within North Korea's cyber ecosystem. The evolution stems from the KorDLL malware framework, which spawned several malware families. Recent operations demonstrate cloud-focused tradecraft and the use of zero-day vulnerabilities to deliver malware.
This article details a recently patched critical zero-day vulnerability (CVE-2026-20805) in Microsoft's Desktop Window Manager (DWM) that allows local low-privilege attackers to disclose sensitive memory addresses, aiding privilege escalation. The vulnerability is actively exploited in the wild and affects legacy Windows versions still under extended support. Microsoft has released patches and recommends urgent deployment alongside monitoring and restricting local low-privilege accounts.
Cisco has disclosed a critical zero-day vulnerability in its AsyncOS platform that is currently unpatched and reportedly exploited in the wild. The vulnerability affects Cisco AsyncOS, a proprietary operating system used in various Cisco security and email appliances. Although detailed technical specifics and affected versions are not publicly available, the zero-day nature and active exploitation elevate the risk significantly. No official patch has been released yet, and known exploits have not been fully documented, increasing the urgency for organizations to implement interim mitigations. European organizations using Cisco AsyncOS-based products, especially in sectors reliant on secure email and network security appliances, face potential risks including unauthorized access, data compromise, and service disruption. Mitigation should focus on enhanced monitoring, network segmentation, and applying Cisco’s forthcoming patches promptly. Countries with high Cisco market penetration and critical infrastructure reliance on Cisco security products, such as Germany, France, the UK, and the Netherlands, are most likely to be impacted. Given the critical severity, ease of exploitation, and potential for widespread impact without authentication, this vulnerability demands immediate attention from cybersecurity teams.
A critical zero-day vulnerability has been identified in SonicWall's SMA1000 series appliances, with active exploitation reported. This vulnerability allows attackers to potentially compromise affected devices, risking confidentiality, integrity, and availability of enterprise networks. Although no official patches or CVSS scores are currently available, the threat is considered critical due to the nature of the exploited zero-day and the strategic role of SMA1000 devices in secure remote access. European organizations using SonicWall SMA1000 appliances are at heightened risk, especially in countries with significant SonicWall market presence and critical infrastructure sectors. Immediate mitigation steps include enhanced monitoring, network segmentation, and applying any forthcoming vendor updates promptly. Given the minimal public discussion and lack of detailed technical disclosures, organizations should prioritize threat intelligence gathering and incident response readiness. The threat landscape suggests that countries like Germany, France, the UK, and the Netherlands may be most affected due to their extensive use of SonicWall products and critical infrastructure reliance on secure remote access solutions.
An autonomous code analyzer has outperformed all human teams in identifying zero-day vulnerabilities in open-source software (OSS) during a recent competition. This development highlights a significant advancement in automated vulnerability discovery capabilities. While no specific vulnerabilities or affected software versions have been disclosed, the emergence of such powerful automated tools could accelerate the identification and potential exploitation of zero-day flaws. European organizations relying heavily on OSS may face increased risk exposure if threat actors adopt similar technologies. The threat does not currently have known exploits in the wild, but the critical severity suggests a high potential impact. Mitigation should focus on enhancing OSS security auditing, integrating automated analysis tools, and improving incident response readiness. Countries with strong OSS development communities and critical infrastructure dependent on OSS are most likely to be affected. Given the potential for rapid discovery and exploitation of vulnerabilities, the suggested severity is critical. Defenders should prioritize proactive vulnerability management and continuous monitoring to mitigate emerging risks from automated zero-day discovery tools.
A critical zero-day vulnerability has been discovered in the Windows RasMan (Remote Access Connection Manager) service. Although no official patches have been released by Microsoft yet, unofficial patches are circulating to mitigate the risk. The flaw could allow attackers to execute arbitrary code or escalate privileges remotely, potentially compromising affected systems. No known exploits are currently observed in the wild, but the vulnerability's critical nature and the absence of official fixes increase the urgency for organizations to take protective measures. European organizations relying on Windows infrastructure with RasMan enabled are at risk, especially those with remote access services exposed. Mitigation requires applying unofficial patches cautiously, restricting RasMan service exposure, and monitoring for suspicious activity. Countries with high Windows usage in critical infrastructure and enterprises, such as Germany, France, and the UK, are likely to be most impacted. Given the potential for remote exploitation without authentication, the severity is assessed as critical. Defenders should prioritize immediate risk assessment and containment strategies while awaiting official patches.
A critical zero-day vulnerability in Gogs, a self-hosted Git service, is actively exploited across more than 700 instances worldwide. The vulnerability remains unpatched, allowing attackers to compromise affected systems without requiring authentication or user interaction. Exploitation can lead to unauthorized code execution, data theft, or service disruption. European organizations using Gogs for source code management are at significant risk, especially those in technology, finance, and government sectors. No official patch or CVE details are currently available, increasing the urgency for defensive measures. Attackers appear to be leveraging this zero-day in targeted campaigns, emphasizing the need for immediate mitigation. The threat is particularly relevant for countries with high adoption of Gogs or similar self-hosted Git platforms. Organizations should implement network segmentation, monitor for unusual activity, and consider temporary migration to alternative platforms until a patch is released. Given the critical nature and active exploitation, the severity is assessed as critical. Defenders must prioritize detection and containment to prevent compromise and data loss.
Google has addressed the eighth zero-day vulnerability in Chrome exploited in attacks during 2025. This critical security flaw was actively exploited before the patch release, posing significant risks to users. Although specific technical details and affected versions are not disclosed, zero-day exploits in Chrome typically allow attackers to execute arbitrary code or escalate privileges. European organizations relying heavily on Chrome for web browsing and internal applications are at risk of data breaches, system compromise, and operational disruption. Mitigation requires immediate patching once updates are available, enhanced endpoint monitoring, and restricting browser privileges where possible. Countries with high Chrome usage and significant digital infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be impacted. Given the critical severity, ease of exploitation, and broad user base, this vulnerability demands urgent attention from defenders. No authentication or user interaction details are provided, but zero-days in Chrome often require minimal user interaction, increasing their threat level.
Microsoft has released security updates addressing 56 vulnerabilities, including two zero-day flaws and one actively exploited vulnerability. These flaws affect multiple Microsoft products and pose significant risks to confidentiality, integrity, and availability. The presence of zero-days and active exploits indicates attackers are already leveraging these weaknesses, increasing urgency for patching. European organizations using Microsoft software are at risk of targeted attacks, data breaches, and service disruptions if unpatched. Mitigation requires immediate deployment of official patches, enhanced monitoring for exploitation attempts, and prioritization of critical systems. Countries with high Microsoft adoption and strategic sectors such as finance, government, and critical infrastructure are particularly vulnerable. Given the severity and exploitation status, the threat is assessed as high severity. Defenders must act swiftly to reduce exposure and prevent compromise.
Barts Health NHS suffered a data breach following exploitation of a zero-day vulnerability in Oracle software. The zero-day flaw was leveraged by attackers to gain unauthorized access, leading to exposure of sensitive healthcare data. Although no known exploits in the wild have been confirmed, the breach highlights critical risks associated with unpatched Oracle vulnerabilities. This incident underscores the importance of rapid detection and response to zero-day threats within healthcare environments. European healthcare organizations using Oracle products face elevated risks of similar attacks. Mitigation requires proactive monitoring, immediate patching once available, and enhanced network segmentation. Countries with significant Oracle deployments in healthcare and critical infrastructure are most at risk. Given the critical impact on confidentiality and integrity of sensitive health data, ease of exploitation, and lack of authentication barriers, the severity is assessed as critical. Defenders must prioritize Oracle vulnerability management and incident response readiness to prevent or limit damage from such zero-day exploits.
The Intellexa leaks have exposed zero-day vulnerabilities and an innovative attack vector using advertisements to deliver Predator spyware. This spyware is highly sophisticated, leveraging undisclosed vulnerabilities to infiltrate target systems without detection. The attack vector involves malicious ads that, when interacted with or simply viewed, can trigger the exploitation of zero-day flaws to install spyware. Although no known exploits are currently active in the wild, the potential for targeted espionage and surveillance is significant. European organizations, especially those in sensitive sectors, face elevated risks due to the spyware's stealth and advanced capabilities. Mitigation requires proactive threat hunting, enhanced monitoring of ad traffic, and collaboration with intelligence agencies to detect and block such campaigns. Countries with high adoption of affected platforms and strategic geopolitical importance are most likely targets. Given the high impact on confidentiality and the complexity of detection, this threat is assessed as high severity. Defenders should prioritize awareness, network segmentation, and zero-day vulnerability management to reduce exposure.
Three zero-day vulnerabilities have been discovered in PickleScan, a component used in PyTorch environments, posing a critical security risk to users. These vulnerabilities allow attackers to exploit unsafe deserialization processes, potentially leading to remote code execution or system compromise. Although no known exploits are currently observed in the wild, the critical severity and zero-day status demand immediate attention. The threat primarily affects organizations using PyTorch for machine learning and AI workloads, which are prevalent in European research institutions and enterprises. Attackers could leverage these flaws to breach confidentiality, integrity, and availability of affected systems without requiring user interaction or authentication. Mitigation is complicated by the absence of patches, necessitating proactive defensive measures such as restricting untrusted pickle data processing and enhancing network segmentation. Countries with significant AI research and industrial AI adoption, including Germany, France, the UK, and the Netherlands, are most at risk. Given the critical impact potential and ease of exploitation, this threat should be treated with the highest priority by European cybersecurity teams.
A critical zero-day vulnerability (CVE-2025-61757) in Oracle Identity Manager allows unauthenticated remote attackers to bypass authentication and execute remote code. The flaw stems from a faulty allow-list mechanism that treats protected API endpoints as publicly accessible when certain query strings are appended. This enables attackers to manipulate authentication flows and escalate privileges. Oracle has released patches for affected versions 12.2.1.4.0 and 14.1.2.1.0. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation prior to patch availability.
Fortinet has addressed two critical zero-day vulnerabilities in its FortiWeb product, a web application firewall widely used to protect web applications from attacks. These vulnerabilities are classified as critical due to their potential to allow attackers to compromise the confidentiality, integrity, and availability of affected systems. Although no known exploits are currently observed in the wild, the zero-day nature and critical severity indicate a high risk if left unpatched. European organizations using FortiWeb should prioritize applying patches and reviewing their web application firewall configurations to mitigate potential exploitation. The threat is particularly relevant for countries with significant Fortinet customer bases and critical infrastructure relying on FortiWeb for web security. Given the critical severity and zero-day status, immediate attention and proactive defense measures are essential to reduce exposure. The lack of detailed technical information limits deeper analysis, but the urgency is underscored by Fortinet's prompt patch release. Organizations should also monitor threat intelligence sources for emerging exploit activity and update incident response plans accordingly.
