https://0daynews.com/articles/2026-07-15-unit-42-tuxbot-v3-llm-chain-of-thought-iot-botnet/ 0dayNews en 2026-07-15T21:15:00.000Z Unit 42: TuxBot v3 shipped LLM chain-of-thought in comments TuxBot, Unit 42, Palo Alto Networks, IoT botnet, LLM, Mirai, MHDDoS https://0daynews.com/articles/2026-07-15-unit-42-tuxbot-v3-llm-chain-of-thought-iot-botnet/cover.jpg Unit 42: TuxBot v3 shipped LLM chain-of-thought in comments https://0daynews.com/articles/2026-07-15-trend-micro-bandcampro-gemini-cli-c2-botnet-operator/ 0dayNews en 2026-07-15T20:20:00.000Z Trend Micro: bandcampro ran a C2 botnet on Gemini CLI Trend Micro, Gemini CLI, bandcampro, agentic C2, LLM abuse, OpenDental, dental clinic breach https://0daynews.com/articles/2026-07-15-trend-micro-bandcampro-gemini-cli-c2-botnet-operator/cover.jpg Trend Micro: bandcampro ran a C2 botnet on Gemini CLI https://0daynews.com/articles/2026-07-15-rapid7-blazek-aws-persistence-iam-lambda-federated-hunt-runbook/ 0dayNews en 2026-07-15T19:15:00.000Z AWS persistence: four patterns to hunt after an incident aws, iam, cloudtrail, lambda, persistence, cloud-security, detection-engineering https://0daynews.com/articles/2026-07-15-rapid7-blazek-aws-persistence-iam-lambda-federated-hunt-runbook/cover.jpg AWS persistence: four patterns to hunt after an incident https://0daynews.com/articles/2026-07-15-kaspersky-okobot-seedhunter-ledger-trezor-electron-hook/ 0dayNews en 2026-07-15T18:15:00.000Z Kaspersky: OkoBot phishes seeds inside Ledger, Trezor apps OkoBot, Kaspersky GReAT, SeedHunter, Ledger Live, Trezor Suite, TookPS, hardware wallet phishing https://0daynews.com/articles/2026-07-15-kaspersky-okobot-seedhunter-ledger-trezor-electron-hook/cover.jpg Kaspersky: OkoBot phishes seeds inside Ledger, Trezor apps https://0daynews.com/articles/2026-07-15-zyxel-cve-2023-28771-epss-099-three-years-post-patch/ 0dayNews en 2026-07-15T17:15:00.000Z Zyxel CVE-2023-28771: EPSS 0.99 three years after the patch zyxel, cve-2023-28771, kev, epss, firewall, edge-network, command-injection https://0daynews.com/articles/2026-07-15-zyxel-cve-2023-28771-epss-099-three-years-post-patch/cover.jpg Zyxel CVE-2023-28771: EPSS 0.99 three years after the patch https://0daynews.com/articles/2026-07-15-chaotic-eclipse-legacyhive-profsvc-lpe-poc-drop/ 0dayNews en 2026-07-15T16:15:00.000Z LegacyHive: Chaotic Eclipse's fourth Windows zero-day LegacyHive, Chaotic Eclipse, Nightmare-Eclipse, Windows User Profile Service, ProfSvc, local privilege escalation, zero-day https://0daynews.com/articles/2026-07-15-chaotic-eclipse-legacyhive-profsvc-lpe-poc-drop/cover.jpg LegacyHive: Chaotic Eclipse's fourth Windows zero-day https://0daynews.com/articles/2026-07-15-mozilla-firefox-exploit-public-chrome-adobe-coldfusion-patch-day/ 0dayNews en 2026-07-15T15:15:00.000Z Firefox exploit code public; Chrome, Adobe patch same day Firefox, Chrome, Adobe ColdFusion, patch management, CVE-2026-15718, CVE-2026-15719, CVE-2026-48318 https://0daynews.com/articles/2026-07-15-mozilla-firefox-exploit-public-chrome-adobe-coldfusion-patch-day/cover.jpg Firefox exploit code public; Chrome, Adobe patch same day https://0daynews.com/articles/2026-07-15-cisa-sharepoint-three-cves-bod-26-04-july-17-deadline/ 0dayNews en 2026-07-15T14:15:00.000Z CISA: three SharePoint bugs exploited, patch by July 17 SharePoint, CISA KEV, BOD 26-04, CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, patch management https://0daynews.com/articles/2026-07-15-cisa-sharepoint-three-cves-bod-26-04-july-17-deadline/cover.jpg CISA: three SharePoint bugs exploited, patch by July 17 https://0daynews.com/articles/2026-07-15-asyncapi-npm-miasma-multi-c2-loader-cicd-compromise/ 0dayNews en 2026-07-15T13:00:00.000Z Miasma loader shipped in 5 @asyncapi npm package versions asyncapi, npm-supply-chain, miasma-loader, cicd-compromise, ipfs-c2, nostr-c2, ox-security, socket https://0daynews.com/articles/2026-07-15-asyncapi-npm-miasma-multi-c2-loader-cicd-compromise/cover.jpg Miasma loader shipped in 5 @asyncapi npm package versions https://0daynews.com/articles/2026-07-15-mindgard-cursor-git-exe-workspace-root-no-patch/ 0dayNews en 2026-07-15T12:20:00.000Z Mindgard: Cursor still runs git.exe from repo root Cursor, Mindgard, Aaron Portnoy, Windows executable search order, workspace trust, AI coding editor, full disclosure https://0daynews.com/articles/2026-07-15-mindgard-cursor-git-exe-workspace-root-no-patch/cover.jpg Mindgard: Cursor still runs git.exe from repo root https://0daynews.com/articles/2026-07-15-doj-media-land-yalishanda-lockbit-blacksuit-play-bulletproof-hosting-indictment/ 0dayNews en 2026-07-15T10:15:00.000Z DOJ indicts Media Land trio: LockBit, BlackSuit, Play host media-land, ml-cloud, yalishanda, lockbit, blacksuit, play, bulletproof-hosting, doj-indictment https://0daynews.com/articles/2026-07-15-doj-media-land-yalishanda-lockbit-blacksuit-play-bulletproof-hosting-indictment/cover.jpg DOJ indicts Media Land trio: LockBit, BlackSuit, Play host https://0daynews.com/articles/2026-07-15-microsoft-safeguard-hold-dell-kb5101650-intel-ipf-shutdowns/ 0dayNews en 2026-07-15T10:15:00.000Z Microsoft blocks Dell PCs from July KB5101650 rollout Microsoft, Windows 11, Dell, KB5101650, KB5095093, safeguard hold, Patch Tuesday https://0daynews.com/articles/2026-07-15-microsoft-safeguard-hold-dell-kb5101650-intel-ipf-shutdowns/cover.jpg Microsoft blocks Dell PCs from July KB5101650 rollout https://0daynews.com/articles/2026-07-15-microsoft-entra-id-passkeys-default-september-sms-voice-retirement-feb-2027/ 0dayNews en 2026-07-15T08:15:00.000Z Entra ID passkeys go default in Sept; SMS/voice out Feb 1 Microsoft Entra ID, passkeys default, SMS MFA retirement, voice MFA retirement, phishing-resistant MFA, Entra ID rollout September 2026 https://0daynews.com/articles/2026-07-15-microsoft-entra-id-passkeys-default-september-sms-voice-retirement-feb-2027/cover.jpg Entra ID passkeys go default in Sept; SMS/voice out Feb 1 https://0daynews.com/articles/2026-07-15-reliaquest-jalisco-omegalord-m365-device-code-mfa-bypass/ 0dayNews en 2026-07-15T07:00:00.000Z Jalisco kit auto-refreshes M365 device codes on demand reliaquest, jalisco, omegalord, microsoft-365, device-code-phishing, oauth, entra-id https://0daynews.com/articles/2026-07-15-reliaquest-jalisco-omegalord-m365-device-code-mfa-bypass/cover.jpg Jalisco kit auto-refreshes M365 device codes on demand https://0daynews.com/articles/2026-07-15-spain-140m-bec-fraud-ring-800-accounts-67-mules/ 0dayNews en 2026-07-15T05:10:00.000Z Spain Dismantles €140M BEC Ring; 800 Accounts, 67 Mules BEC, business email compromise, Spanish National Police, Europol, Interpol, money mules, investment fraud, financial crime https://0daynews.com/articles/2026-07-15-spain-140m-bec-fraud-ring-800-accounts-67-mules/cover.jpg Spain Dismantles €140M BEC Ring; 800 Accounts, 67 Mules https://0daynews.com/articles/2026-07-15-lastpass-bitwarden-compliance-lookalike-domain-phishing/ 0dayNews en 2026-07-15T04:15:00.000Z LastPass, Bitwarden users hit by lookalike-domain phishing LastPass, Bitwarden, password manager phishing, lookalike domain, DocuSign lure, credential theft https://0daynews.com/articles/2026-07-15-lastpass-bitwarden-compliance-lookalike-domain-phishing/cover.jpg LastPass, Bitwarden users hit by lookalike-domain phishing https://0daynews.com/articles/2026-07-15-blackpoint-labubarat-rust-nvidia-sysruntime-maas/ 0dayNews en 2026-07-15T03:15:00.000Z Blackpoint flags LabubaRAT: Rust MaaS RAT poses as NVIDIA LabubaRAT, Blackpoint Cyber, Rust, RAT, malware-as-a-service, NVIDIA, Windows https://0daynews.com/articles/2026-07-15-blackpoint-labubarat-rust-nvidia-sysruntime-maas/cover.jpg Blackpoint flags LabubaRAT: Rust MaaS RAT poses as NVIDIA https://0daynews.com/articles/2026-07-14-arctic-wolf-292-fake-github-repos-boryptgrab-infostealer/ 0dayNews en 2026-07-14T22:15:00.000Z Arctic Wolf: 292 fake GitHub repos push BoryptGrab stealer github, arctic-wolf, boryptgrab, infostealer, supply-chain, typosquatting, chrome-app-bound-encryption https://0daynews.com/articles/2026-07-14-arctic-wolf-292-fake-github-repos-boryptgrab-infostealer/cover.jpg Arctic Wolf: 292 fake GitHub repos push BoryptGrab stealer https://0daynews.com/articles/2026-07-14-sonicwall-sma1000-cve-2026-15409-15410-kev-active-exploitation/ 0dayNews en 2026-07-14T21:45:00.000Z SonicWall SMA1000 zero-days on CISA KEV: patch by July 17 SonicWall SMA1000, CVE-2026-15409, CVE-2026-15410, CISA KEV, zero-day, remote access, vendor patch https://0daynews.com/articles/2026-07-14-sonicwall-sma1000-cve-2026-15409-15410-kev-active-exploitation/cover.jpg SonicWall SMA1000 zero-days on CISA KEV: patch by July 17 https://0daynews.com/articles/2026-07-14-manifold-claude-for-chrome-trust-boundary-still-open/ 0dayNews en 2026-07-14T21:30:00.000Z Claude for Chrome flaw lets other extensions read Gmail claude for chrome, manifold security, anthropic, claudebleed, layerx security, browser extension, prompt injection, trust boundary https://0daynews.com/articles/2026-07-14-manifold-claude-for-chrome-trust-boundary-still-open/cover.jpg Claude for Chrome flaw lets other extensions read Gmail https://0daynews.com/articles/2026-07-14-rapid7-sharepoint-cve-2026-55040-jwt-auth-bypass-rce-chain-half/ 0dayNews en 2026-07-14T20:15:00.000Z SharePoint JWT bypass fixed; RCE half of chain still open microsoft, sharepoint, cve-2026-55040, authentication-bypass, rapid7, jwt, patch-tuesday https://0daynews.com/articles/2026-07-14-rapid7-sharepoint-cve-2026-55040-jwt-auth-bypass-rce-chain-half/cover.jpg SharePoint JWT bypass fixed; RCE half of chain still open https://0daynews.com/articles/2026-07-14-microsoft-july-patch-tuesday-570-cves-adfs-sharepoint-bitlocker-zero-days/ 0dayNews en 2026-07-14T19:15:00.000Z Microsoft July Patch Tuesday: 570 CVEs, 3 zero-days out Microsoft Patch Tuesday, AD FS, SharePoint, BitLocker, zero-day, CVE-2026-56155, CVE-2026-56164 https://0daynews.com/articles/2026-07-14-microsoft-july-patch-tuesday-570-cves-adfs-sharepoint-bitlocker-zero-days/cover.jpg Microsoft July Patch Tuesday: 570 CVEs, 3 zero-days out https://0daynews.com/articles/2026-07-14-ku-leuven-distrinet-85-crypto-wallet-extensions-address-linking/ 0dayNews en 2026-07-14T18:20:00.000Z KU Leuven: 85 wallet extensions leak addresses cross-site KU Leuven, DistriNet, crypto wallet extension, address linking, browser extension privacy, PETS 2026, wallet fingerprinting https://0daynews.com/articles/2026-07-14-ku-leuven-distrinet-85-crypto-wallet-extensions-address-linking/cover.jpg KU Leuven: 85 wallet extensions leak addresses cross-site https://0daynews.com/articles/2026-07-14-progress-sharefile-storage-zone-5-12-5-6-0-2-path-traversal-patch/ 0dayNews en 2026-07-14T17:20:00.000Z Progress patches ShareFile zero-day: 5.12.5 and 6.0.2 out Progress ShareFile, Storage Zone Controller, path traversal, vendor patch, managed file transfer, zero-day https://0daynews.com/articles/2026-07-14-progress-sharefile-storage-zone-5-12-5-6-0-2-path-traversal-patch/cover.jpg Progress patches ShareFile zero-day: 5.12.5 and 6.0.2 out https://0daynews.com/articles/2026-07-14-rabbitmq-miggo-oauth-secret-cross-tenant-cve-2026-57219/ 0dayNews en 2026-07-14T16:20:00.000Z Miggo: RabbitMQ leaked OAuth secret via obsolete endpoint rabbitmq, oauth, cve-2026-57219, message-broker, miggo, cross-tenant, cloud-security https://0daynews.com/articles/2026-07-14-rabbitmq-miggo-oauth-secret-cross-tenant-cve-2026-57219/cover.jpg Miggo: RabbitMQ leaked OAuth secret via obsolete endpoint https://0daynews.com/articles/2026-07-14-proofpoint-oauth-client-id-spoofing-entra-signin-logs-blind/ 0dayNews en 2026-07-14T15:00:00.000Z OAuth client ID spoofing sneaks past Entra sign-in logs microsoft-entra-id, oauth, credential-stuffing, proofpoint, ropc, conditional-access, detection-engineering https://0daynews.com/articles/2026-07-14-proofpoint-oauth-client-id-spoofing-entra-signin-logs-blind/cover.jpg OAuth client ID spoofing sneaks past Entra sign-in logs https://0daynews.com/articles/2026-07-14-eset-uefi-shim-cve-2026-8863-secure-boot-bypass/ 0dayNews en 2026-07-14T14:15:00.000Z ESET: 11 old signed UEFI shims still bypass Secure Boot uefi, secure boot, shim, eset, microsoft, cve-2026-8863, dbx https://0daynews.com/articles/2026-07-14-eset-uefi-shim-cve-2026-8863-secure-boot-bypass/cover.jpg ESET: 11 old signed UEFI shims still bypass Secure Boot https://0daynews.com/articles/2026-07-14-sap-july-patch-day-three-criticals-netweaver-approuter-commerce/ 0dayNews en 2026-07-14T13:15:00.000Z SAP's July Patch Day: three criticals, worst is 9.9 sap, netweaver, approuter, commerce cloud, patch day, cve-2026-44747, cve-2026-27690, cve-2026-44761 https://0daynews.com/articles/2026-07-14-sap-july-patch-day-three-criticals-netweaver-approuter-commerce/cover.jpg SAP's July Patch Day: three criticals, worst is 9.9 https://0daynews.com/articles/2026-07-14-ofac-1vpns-rashevskyi-silayev-sb0559-cryptor-designation/ 0dayNews en 2026-07-14T11:20:00.000Z OFAC sanctions 1VPNS admin plus Belarusian cryptor seller ofac, sanctions, 1vpns, ransomware, cryptor, operation-saffron, us-treasury https://0daynews.com/articles/2026-07-14-ofac-1vpns-rashevskyi-silayev-sb0559-cryptor-designation/cover.jpg OFAC sanctions 1VPNS admin plus Belarusian cryptor seller https://0daynews.com/articles/2026-07-14-cereblab-grok-build-0-2-93-git-repo-upload-gcs/ 0dayNews en 2026-07-14T10:15:00.000Z Grok Build v0.2.93 uploaded whole repos to xAI's bucket grok-build, xai, ai-coding-cli, data-exposure, secrets-leak, gcs-bucket https://0daynews.com/articles/2026-07-14-cereblab-grok-build-0-2-93-git-repo-upload-gcs/cover.jpg Grok Build v0.2.93 uploaded whole repos to xAI's bucket https://0daynews.com/articles/2026-07-14-jfrog-148-npm-packages-browser-ddos-botnet-may/ 0dayNews en 2026-07-14T09:15:00.000Z 148 npm packages ran a browser-based DDoS botnet in May npm, supply-chain, JFrog, DDoS botnet, web proxy, browser abuse https://0daynews.com/articles/2026-07-14-jfrog-148-npm-packages-browser-ddos-botnet-may/cover.jpg 148 npm packages ran a browser-based DDoS botnet in May https://0daynews.com/articles/2026-07-14-microsoft-shinyhunters-salesforce-oauth-three-paths/ 0dayNews en 2026-07-14T08:20:00.000Z A year of ShinyHunters OAuth abuse, mapped by Microsoft microsoft, shinyhunters, salesforce, oauth, storm-3138, saas-supply-chain, klue https://0daynews.com/articles/2026-07-14-microsoft-shinyhunters-salesforce-oauth-three-paths/cover.jpg A year of ShinyHunters OAuth abuse, mapped by Microsoft https://0daynews.com/articles/2026-07-14-forg365-phaas-m365-device-code-aitm-market/ 0dayNews en 2026-07-14T05:45:00.000Z Forg365 shows PhaaS became a $400/mo rental market forg365, phishing-as-a-service, microsoft-365, device-code-phishing, aitm, telegram, threat-intel https://0daynews.com/articles/2026-07-14-forg365-phaas-m365-device-code-aitm-market/cover.jpg Forg365 shows PhaaS became a $400/mo rental market https://0daynews.com/articles/2026-07-14-jscrambler-npm-post-mortem-four-versions-8-22-clean/ 0dayNews en 2026-07-14T02:15:00.000Z Jscrambler: four npm versions hit, publish creds revoked jscrambler, npm, supply-chain, publish credentials, preinstall, infostealer, Socket https://0daynews.com/articles/2026-07-14-jscrambler-npm-post-mortem-four-versions-8-22-clean/cover.jpg Jscrambler: four npm versions hit, publish creds revoked https://0daynews.com/articles/2026-07-13-nca-russian-coms-five-charged-1-8m-spoofed-calls/ 0dayNews en 2026-07-13T22:15:00.000Z NCA charges five over Russian Coms spoofing platform Russian Coms, NCA, caller-ID spoofing, Operation Henhouse, vishing, STIR/SHAKEN, Ofcom https://0daynews.com/articles/2026-07-13-nca-russian-coms-five-charged-1-8m-spoofed-calls/cover.jpg NCA charges five over Russian Coms spoofing platform https://0daynews.com/articles/2026-07-13-meta-2026-0182881-lachlan-dunn-emotion-listening-patent/ 0dayNews en 2026-07-13T22:00:00.000Z Meta patent describes an always-on emotion-reading AI meta, ai patent, ambient listening, emotion analysis, surveillance, privacy, smart glasses https://0daynews.com/articles/2026-07-13-meta-2026-0182881-lachlan-dunn-emotion-listening-patent/cover.jpg Meta patent describes an always-on emotion-reading AI