https://0daynews.com/articles/2026-07-06-gitlab-exiftool-rce-cve-2021-22205/ 0dayNews en 2026-07-06T13:00:00.000Z GitLab's ExifTool RCE: A Patch That Sat Unrecognized for Months CVE-2021-22205, GitLab, ExifTool, remote code execution, patch adoption gap https://0daynews.com/articles/2026-07-06-gitlab-exiftool-rce-cve-2021-22205/cover.jpg GitLab's ExifTool RCE: A Patch That Sat Unrecognized for Months https://0daynews.com/articles/2026-07-05-flipper-zero-firmware-maintenance-only-community-driven/ 0dayNews en 2026-07-05T17:20:00.000Z Flipper Zero firmware goes maintenance-only — the honest timeline Flipper Zero, Flipper Devices, firmware, open source, red team tooling, community maintenance https://0daynews.com/articles/2026-07-05-flipper-zero-firmware-maintenance-only-community-driven/cover.jpg Flipper Zero firmware goes maintenance-only — the honest timeline https://0daynews.com/articles/2026-07-05-barracuda-esg-zero-day-cve-2023-2868/ 0dayNews en 2026-07-05T15:30:00.000Z Barracuda Told Customers to Replace Their Appliances, Not Just Patch Them. Here's Why. CVE-2023-2868, Barracuda ESG, Email Security Gateway, appliance replacement, persistent backdoor https://0daynews.com/articles/2026-07-05-barracuda-esg-zero-day-cve-2023-2868/cover.jpg Barracuda Told Customers to Replace Their Appliances, Not Just Patch Them. Here's Why. https://0daynews.com/articles/2026-07-05-jfrog-rollup-polyfill-npm-six-packages-follow-up/ 0dayNews en 2026-07-05T15:20:00.000Z Four more Rollup polyfill typosquats surface in JFrog's fuller DPRK writeup npm, supply-chain, DPRK, North Korea, Rollup, JFrog, Lazarus, typosquatting, BeaverTail https://0daynews.com/articles/2026-07-05-jfrog-rollup-polyfill-npm-six-packages-follow-up/cover.jpg Four more Rollup polyfill typosquats surface in JFrog's fuller DPRK writeup https://0daynews.com/articles/2026-07-05-winrar-path-traversal-cve-2023-38831/ 0dayNews en 2026-07-05T13:00:00.000Z The WinRAR Bug That Hid a Malicious Script Behind a Fake Photo CVE-2023-38831, WinRAR, RARLAB, path traversal, spoofed file extension https://0daynews.com/articles/2026-07-05-winrar-path-traversal-cve-2023-38831/cover.jpg The WinRAR Bug That Hid a Malicious Script Behind a Fake Photo https://0daynews.com/articles/2026-07-04-metasploit-weekly-smb-meterpreter-peyara-detection/ 0dayNews en 2026-07-04T16:20:00.000Z Metasploit's July 3 drop: SMB-to-Meterpreter and Peyara RCE — the detection tune Metasploit, Rapid7, Peyara Remote Mouse, SMB, Meterpreter, PsExec, detection engineering https://0daynews.com/articles/2026-07-04-metasploit-weekly-smb-meterpreter-peyara-detection/cover.jpg Metasploit's July 3 drop: SMB-to-Meterpreter and Peyara RCE — the detection tune https://0daynews.com/articles/2026-07-04-kairos-1m-extortion-payment-us-government-ransom-isac/ 0dayNews en 2026-07-04T15:35:00.000Z Kairos took $1M from a U.S. government entity — and never encrypted a file Kairos, data-theft extortion, Ransom-ISAC, Rakesh Krishnan, Union County Ohio, ransomware payment, blockchain forensics https://0daynews.com/articles/2026-07-04-kairos-1m-extortion-payment-us-government-ransom-isac/cover.jpg Kairos took $1M from a U.S. government entity — and never encrypted a file https://0daynews.com/articles/2026-07-04-vmware-vcenter-vsphere-client-rce-cve-2021-21972/ 0dayNews en 2026-07-04T15:30:00.000Z vCenter's Unrestricted-Upload Bug: A Reminder That Management Planes Shouldn't Face the Internet CVE-2021-21972, VMware vCenter Server, vSphere Client, unrestricted file upload, virtualization security https://0daynews.com/articles/2026-07-04-vmware-vcenter-vsphere-client-rce-cve-2021-21972/cover.jpg vCenter's Unrestricted-Upload Bug: A Reminder That Management Planes Shouldn't Face the Internet https://0daynews.com/articles/2026-07-04-bluehammer-defender-lpe-kev-ransomware-confirmed/ 0dayNews en 2026-07-04T13:00:00.000Z CISA confirms BlueHammer Defender LPE is being used in ransomware attacks CVE-2026-33825, BlueHammer, Microsoft Defender, CISA KEV, ransomware, Chaotic Eclipse, local privilege escalation https://0daynews.com/articles/2026-07-04-polinrider-108-dprk-packages-contagious-interview/ 0dayNews en 2026-07-04T13:00:00.000Z PolinRider: North Korean actors seed 108 malicious packages across four ecosystems PolinRider, Contagious Interview, North Korea, DPRK, npm, Packagist, Go modules, Chrome extensions, supply-chain https://0daynews.com/articles/2026-07-04-polinrider-108-dprk-packages-contagious-interview/cover.jpg PolinRider: North Korean actors seed 108 malicious packages across four ecosystems https://0daynews.com/articles/2026-07-04-spring4shell-vmware-spring-framework-rce/ 0dayNews en 2026-07-04T13:00:00.000Z Spring4Shell: Why This One Needed Careful Triage, Not Panic Spring4Shell, CVE-2022-22965, Spring Framework, VMware, data binding https://0daynews.com/articles/2026-07-04-spring4shell-vmware-spring-framework-rce/cover.jpg Spring4Shell: Why This One Needed Careful Triage, Not Panic https://0daynews.com/articles/2026-07-04-orchid-iga-ai-agents-lifecycle-gaps/ 0dayNews en 2026-07-04T11:15:00.000Z IGA was built around employment records. Agents don't have those. identity governance, IGA, AI agents, non-human identity, OAuth, service accounts, joiner-mover-leaver https://0daynews.com/articles/2026-07-04-orchid-iga-ai-agents-lifecycle-gaps/cover.jpg IGA was built around employment records. Agents don't have those. https://0daynews.com/articles/2026-07-04-avalon-crownx-modular-malware-framework/ 0dayNews en 2026-07-04T08:00:00.000Z Blackpoint: Avalon framework bundles theft, wiper, and CrownX ransomware Avalon, CrownX, ransomware, Blackpoint Cyber, MSBuild, ETW evasion, infostealer https://0daynews.com/articles/2026-07-04-avalon-crownx-modular-malware-framework/cover.jpg Blackpoint: Avalon framework bundles theft, wiper, and CrownX ransomware https://0daynews.com/articles/2026-07-04-toddycat-umbrij-oauth-gmail-kaspersky/ 0dayNews en 2026-07-04T07:20:00.000Z Umbrij: ToddyCat grants itself Gmail OAuth by hijacking a live browser ToddyCat, Umbrij, Kaspersky, OAuth, Gmail, Google Workspace, APT, DLL sideloading https://0daynews.com/articles/2026-07-04-toddycat-umbrij-oauth-gmail-kaspersky/cover.jpg Umbrij: ToddyCat grants itself Gmail OAuth by hijacking a live browser https://0daynews.com/articles/2026-07-04-artoken-eviltokens-m365-device-code-phishing-talos/ 0dayNews en 2026-07-04T06:20:00.000Z ARToken PhaaS: device-code phishing is the M365 lane defenders keep leaving open ARToken, EvilTokens, device code phishing, Microsoft 365, phishing-as-a-service, Conditional Access, Cisco Talos https://0daynews.com/articles/2026-07-04-artoken-eviltokens-m365-device-code-phishing-talos/cover.jpg ARToken PhaaS: device-code phishing is the M365 lane defenders keep leaving open https://0daynews.com/articles/2026-07-04-talos-catan-and-mouse-curiosity-defensive-skill/ 0dayNews en 2026-07-04T05:30:00.000Z Talos on curiosity: the defensive skill that still doesn't scale Cisco Talos, Threat Source, William Largent, defender skills, pattern recognition, security operations, curiosity https://0daynews.com/articles/2026-07-04-armored-likho-busysnake-power-sector-kaspersky/ 0dayNews en 2026-07-04T05:15:00.000Z Armored Likho: Kaspersky ties BusySnake stealer to power-sector espionage Armored Likho, BusySnake, Kaspersky, electric power sector, ICS/OT, threat intelligence, critical infrastructure https://0daynews.com/articles/2026-07-04-armored-likho-busysnake-power-sector-kaspersky/cover.jpg Armored Likho: Kaspersky ties BusySnake stealer to power-sector espionage https://0daynews.com/articles/2026-07-04-consentfix-clickfix-m365-oauth-consent-phishing/ 0dayNews en 2026-07-04T04:15:00.000Z ConsentFix + ClickFix: M365 grants that outlive a password reset ConsentFix, ClickFix, OAuth consent phishing, Microsoft 365, Opera Paste Protect, token theft, MFA bypass https://0daynews.com/articles/2026-07-04-consentfix-clickfix-m365-oauth-consent-phishing/cover.jpg ConsentFix + ClickFix: M365 grants that outlive a password reset https://0daynews.com/articles/2026-07-03-fortibleed-inc-lynx-ransomware-attribution/ 0dayNews en 2026-07-04T02:30:00.000Z FortiBleed operators tied directly to INC and Lynx ransomware crews FortiBleed, FortiGate, Fortinet, INC ransomware, Lynx ransomware, credential theft, initial access https://0daynews.com/articles/2026-07-03-fortibleed-inc-lynx-ransomware-attribution/cover.jpg FortiBleed operators tied directly to INC and Lynx ransomware crews https://0daynews.com/articles/2026-07-03-pegasus-mep-kouloglou-citizen-lab-analysis/ 0dayNews en 2026-07-03T23:15:00.000Z Pegasus on the MEP investigating Pegasus Pegasus, NSO Group, Citizen Lab, Stelios Kouloglou, European Parliament, PEGA committee, commercial spyware https://0daynews.com/articles/2026-07-03-chocopoc-rat-fake-poc-github-pypi-yeswehack/ 0dayNews en 2026-07-03T22:30:00.000Z ChocoPoC: fake CVE PoC repos are shipping a stealer aimed at researchers ChocoPoC, YesWeHack, Sekoia, PyPI supply chain, fake PoC repos, vulnerability researcher targeting, GitHub malware https://0daynews.com/articles/2026-07-03-chocopoc-rat-fake-poc-github-pypi-yeswehack/cover.jpg ChocoPoC: fake CVE PoC repos are shipping a stealer aimed at researchers https://0daynews.com/articles/2026-07-03-fatfs-runzero-seven-flaws-embedded-firmware/ 0dayNews en 2026-07-03T22:15:00.000Z runZero discloses seven FatFs flaws in embedded firmware, six unpatched FatFs, embedded firmware, supply chain, runZero, CVE-2026-6682, JPCERT/CC, RTOS