https://0daynews.com/articles/2026-07-17-ec-google-android-qaap-mic-cam-screen-hotword-rival-ai/ 0dayNews en 2026-07-17T22:15:00.000Z EU order opens Android mic, cam, screen to rival AI agents Android, Google, European Commission, Digital Markets Act, Gemini, QAAP, hotword, prompt injection https://0daynews.com/articles/2026-07-17-ec-google-android-qaap-mic-cam-screen-hotword-rival-ai/cover.jpg EU order opens Android mic, cam, screen to rival AI agents https://0daynews.com/articles/2026-07-17-flare-2889-underground-posts-clean-residential-proxies-post-netnut/ 0dayNews en 2026-07-17T18:15:00.000Z Flare finds carders still hunting clean IPs post-NetNut Flare, residential proxies, carding, NetNut, Popa botnet, underground economy, antidetect browser https://0daynews.com/articles/2026-07-17-flare-2889-underground-posts-clean-residential-proxies-post-netnut/cover.jpg Flare finds carders still hunting clean IPs post-NetNut https://0daynews.com/articles/2026-07-17-ernst-young-third-party-support-ticket-breach-mar-apr-window/ 0dayNews en 2026-07-17T17:35:00.000Z EY discloses breach via third-party IT ticket system Ernst & Young, EY, third-party breach, support ticket system, tax data, Experian identity monitoring, Big Four https://0daynews.com/articles/2026-07-17-ernst-young-third-party-support-ticket-breach-mar-apr-window/cover.jpg EY discloses breach via third-party IT ticket system https://0daynews.com/articles/2026-07-17-armenia-detains-ermakov-yerevan-revil-warrant-identity-dispute/ 0dayNews en 2026-07-17T16:15:00.000Z Armenia detains Aleksandr Ermakov on US REvil warrant REvil, Sodinokibi, Aleksandr Ermakov, Armenia extradition, Interpol, Medibank, ransomware prosecution https://0daynews.com/articles/2026-07-17-armenia-detains-ermakov-yerevan-revil-warrant-identity-dispute/cover.jpg Armenia detains Aleksandr Ermakov on US REvil warrant https://0daynews.com/articles/2026-07-17-elastic-ottercookie-svg-flag-steganography-ai-tool-configs/ 0dayNews en 2026-07-17T15:15:00.000Z OtterCookie's fake interview now steals AI-tool configs OtterCookie, Contagious Interview, Elastic Security Labs, DPRK, SVG steganography, AI assistant configs, Slack recruiting lure, REF9403 https://0daynews.com/articles/2026-07-17-elastic-ottercookie-svg-flag-steganography-ai-tool-configs/cover.jpg OtterCookie's fake interview now steals AI-tool configs https://0daynews.com/articles/2026-07-17-kaspersky-goserpent-go-rat-tetrisphantom-overlap-apac-diplomatic/ 0dayNews en 2026-07-17T14:05:00.000Z GoSerpent: Go RAT hits APAC gov, TetrisPhantom overlap GoSerpent, TetrisPhantom, Kaspersky, Southeast Asia espionage, Go malware, Stowaway, McMx RAT https://0daynews.com/articles/2026-07-17-kaspersky-goserpent-go-rat-tetrisphantom-overlap-apac-diplomatic/cover.jpg GoSerpent: Go RAT hits APAC gov, TetrisPhantom overlap https://0daynews.com/articles/2026-07-17-nightmare-eclipse-legacyhive-windows-user-profile-service-lpe-zero-day/ 0dayNews en 2026-07-17T13:00:00.000Z LegacyHive: unpatched Windows LPE zero-day, PoC public LegacyHive, Nightmare Eclipse, Windows LPE, User Profile Service, usrclass.dat, registry hive, zero-day, Kevin Beaumont https://0daynews.com/articles/2026-07-17-nightmare-eclipse-legacyhive-windows-user-profile-service-lpe-zero-day/cover.jpg LegacyHive: unpatched Windows LPE zero-day, PoC public https://0daynews.com/articles/2026-07-17-microsoft-defender-experts-acr-stealer-clickfix-run-box-paste-and-run/ 0dayNews en 2026-07-17T11:15:00.000Z ACR Stealer, ClickFix, and why the Run box still works ACR Stealer, Amatera, AcridRain, ClickFix, infostealer, Microsoft Defender Experts, Microsoft 365 https://0daynews.com/articles/2026-07-17-microsoft-defender-experts-acr-stealer-clickfix-run-box-paste-and-run/cover.jpg ACR Stealer, ClickFix, and why the Run box still works https://0daynews.com/articles/2026-07-17-microsoft-windows-server-2022-mainstream-eos-october-13-extended-2031/ 0dayNews en 2026-07-17T10:15:00.000Z Windows Server 2022 mainstream support ends Oct 13 Windows Server 2022, Microsoft, end of mainstream support, extended support, Windows Server 2025, lifecycle https://0daynews.com/articles/2026-07-17-microsoft-windows-server-2022-mainstream-eos-october-13-extended-2031/cover.jpg Windows Server 2022 mainstream support ends Oct 13 https://0daynews.com/articles/2026-07-17-doj-chen-zhang-43m-money-laundering-140-accounts-45-shells/ 0dayNews en 2026-07-17T09:15:00.000Z The plumbing behind $43M in investment-fraud losses pig-butchering, money laundering, investment fraud, HSI, shell companies, Zhuoying Chen, Haojie Zhang https://0daynews.com/articles/2026-07-17-doj-chen-zhang-43m-money-laundering-140-accounts-45-shells/cover.jpg The plumbing behind $43M in investment-fraud losses https://0daynews.com/articles/2026-07-16-microsoft-windows-11-24h2-home-pro-eos-october-13-25h2-enablement/ 0dayNews en 2026-07-17T01:30:00.000Z Windows 11 24H2 Home and Pro: 90 days to end of updates Windows 11, 24H2, 25H2, end of support, lifecycle, Microsoft, LTSB 2016 https://0daynews.com/articles/2026-07-16-microsoft-windows-11-24h2-home-pro-eos-october-13-25h2-enablement/cover.jpg Windows 11 24H2 Home and Pro: 90 days to end of updates https://0daynews.com/articles/2026-07-17-n8n-cve-2026-59208-cross-issuer-token-exchange-sub-iss/ 0dayNews en 2026-07-17T00:20:00.000Z n8n cross-issuer JWT bypass logs attackers in as anyone n8n, CVE-2026-59208, token exchange, JWT, multi-issuer, SSO, workflow automation https://0daynews.com/articles/2026-07-17-n8n-cve-2026-59208-cross-issuer-token-exchange-sub-iss/cover.jpg n8n cross-issuer JWT bypass logs attackers in as anyone https://0daynews.com/articles/2026-07-16-talos-uat-11795-starland-rat-wldr-c2-trojanized-installers/ 0dayNews en 2026-07-16T23:30:00.000Z UAT-11795 hides Starland RAT in trojanized installers UAT-11795, Starland RAT, WLDR C2, Cisco Talos, CastleStealer, Remcos RAT, trojanized installer https://0daynews.com/articles/2026-07-16-talos-uat-11795-starland-rat-wldr-c2-trojanized-installers/cover.jpg UAT-11795 hides Starland RAT in trojanized installers https://0daynews.com/articles/2026-07-16-sans-stephen-sims-bugcrowd-ai-triage-proof-standard/ 0dayNews en 2026-07-16T23:15:00.000Z AI can find the bug. Proving it is still the job. ai security, bug bounty, bugcrowd, sans, vulnerability discovery, proof of exploit, stephen sims https://0daynews.com/articles/2026-07-16-sans-stephen-sims-bugcrowd-ai-triage-proof-standard/cover.jpg AI can find the bug. Proving it is still the job. https://0daynews.com/articles/2026-07-16-elastic-telepuz-clickfix-maas-vidar-stage-two/ 0dayNews en 2026-07-16T22:20:00.000Z Elastic: TELEPUZ ClickFix stealer confirmed since April TELEPUZ, Elastic Security Labs, ClickFix, Vidar Stealer, malware-as-a-service, Polygon smart contract, infostealer https://0daynews.com/articles/2026-07-16-elastic-telepuz-clickfix-maas-vidar-stage-two/cover.jpg Elastic: TELEPUZ ClickFix stealer confirmed since April https://0daynews.com/articles/2026-07-16-coca-cola-fairlife-ransomware-sec-8k-us-production-halt/ 0dayNews en 2026-07-16T22:00:00.000Z Coca-Cola halts Fairlife US production after ransomware Fairlife ransomware, Coca-Cola SEC 8-K, dairy production halt, ransomware disclosure, food and beverage ransomware https://0daynews.com/articles/2026-07-16-coca-cola-fairlife-ransomware-sec-8k-us-production-halt/cover.jpg Coca-Cola halts Fairlife US production after ransomware https://0daynews.com/articles/2026-07-16-cisa-kev-sharepoint-cve-2026-58644-deserialization-fourth-in-week/ 0dayNews en 2026-07-16T21:15:00.000Z CISA adds a fourth SharePoint bug to KEV in 48 hours SharePoint, CISA KEV, CVE-2026-58644, deserialization, BOD 26-04, patch management https://0daynews.com/articles/2026-07-16-cisa-kev-sharepoint-cve-2026-58644-deserialization-fourth-in-week/cover.jpg CISA adds a fourth SharePoint bug to KEV in 48 hours https://0daynews.com/articles/2026-07-16-agent-data-injection-choi-snu-uiuc-probabilistic-delimiter/ 0dayNews en 2026-07-16T20:15:00.000Z Agent Data Injection: SQL injection, different decade agent data injection, prompt injection, ai agents, llm security, claude in chrome, coding agents, trust boundary https://0daynews.com/articles/2026-07-16-agent-data-injection-choi-snu-uiuc-probabilistic-delimiter/cover.jpg Agent Data Injection: SQL injection, different decade https://0daynews.com/articles/2026-07-16-fortinet-fortisandbox-cve-2026-39808-25089-kev-unauth-rce/ 0dayNews en 2026-07-16T19:15:00.000Z FortiSandbox: two 9.8 unauth RCEs hit KEV, Sunday deadline Fortinet FortiSandbox, CVE-2026-39808, CVE-2026-25089, CISA KEV, BOD 26-04, unauthenticated RCE, OS command injection https://0daynews.com/articles/2026-07-16-fortinet-fortisandbox-cve-2026-39808-25089-kev-unauth-rce/cover.jpg FortiSandbox: two 9.8 unauth RCEs hit KEV, Sunday deadline https://0daynews.com/articles/2026-07-16-group-ib-clicklock-macos-clickfix-launchagent-210ms-loop/ 0dayNews en 2026-07-16T18:15:00.000Z ClickLock macOS stealer kills apps until user types password ClickLock, macOS stealer, ClickFix, LaunchAgent, Group-IB, Keychain, infostealer https://0daynews.com/articles/2026-07-16-group-ib-clicklock-macos-clickfix-launchagent-210ms-loop/cover.jpg ClickLock macOS stealer kills apps until user types password https://0daynews.com/articles/2026-07-16-anyrun-phantomenigma-brazil-gov-br-hijack-dmarc-inno-node/ 0dayNews en 2026-07-16T17:20:00.000Z PhantomEnigma rides Brazilian .gov.br sites and mailboxes PhantomEnigma, ANY.RUN, Brazil, gov.br, DMARC, Inno Setup, banking-trojan https://0daynews.com/articles/2026-07-16-anyrun-phantomenigma-brazil-gov-br-hijack-dmarc-inno-node/cover.jpg PhantomEnigma rides Brazilian .gov.br sites and mailboxes https://0daynews.com/articles/2026-07-16-rapid7-attackerkb-public-sunset-august-18-curation/ 0dayNews en 2026-07-16T16:30:00.000Z AttackerKB's public tier closes August 18 AttackerKB, Rapid7, vulnerability intelligence, Douglas McKee, AI-generated submissions, community disclosure https://0daynews.com/articles/2026-07-16-rapid7-attackerkb-public-sunset-august-18-curation/cover.jpg AttackerKB's public tier closes August 18 https://0daynews.com/articles/2026-07-16-23andme-chrome-holding-18m-43-state-ag-settlement-2023-breach/ 0dayNews en 2026-07-16T15:20:00.000Z 23andMe settles genetics breach: $18M, 43 states 23andMe, Chrome Holding, genetic data breach, state attorneys general, Letitia James, credential stuffing, settlement https://0daynews.com/articles/2026-07-16-23andme-chrome-holding-18m-43-state-ag-settlement-2023-breach/cover.jpg 23andMe settles genetics breach: $18M, 43 states https://0daynews.com/articles/2026-07-16-daxin-srt64-stupig-winlogon-taiwan-digiwin-jdk/ 0dayNews en 2026-07-16T14:20:00.000Z Daxin resurfaces in Taiwan alongside new Stupig backdoor daxin, stupig, symantec, kernel-rootkit, winlogon, taiwan, china-linked https://0daynews.com/articles/2026-07-16-daxin-srt64-stupig-winlogon-taiwan-digiwin-jdk/cover.jpg Daxin resurfaces in Taiwan alongside new Stupig backdoor https://0daynews.com/articles/2026-07-16-scattered-spider-tfl-jubair-flowers-nca-cma-sentence/ 0dayNews en 2026-07-16T13:20:00.000Z Two Scattered Spider affiliates get 5.5 years for TfL hack Scattered Spider, Transport for London, Thalha Jubair, Owen Flowers, National Crime Agency, Computer Misuse Act https://0daynews.com/articles/2026-07-16-scattered-spider-tfl-jubair-flowers-nca-cma-sentence/cover.jpg Two Scattered Spider affiliates get 5.5 years for TfL hack https://0daynews.com/articles/2026-07-16-sharkninja-tokay0-aws-iot-cert-region-root-no-patch/ 0dayNews en 2026-07-16T12:00:00.000Z Unpatched Shark vacuums: regional root, no CVE, no patch SharkNinja, Shark robot vacuum, AWS IoT, IoT device certificate, tokay0, responsible disclosure, IOT_POLICY_OVERLY_PERMISSIVE_CHECK https://0daynews.com/articles/2026-07-16-sharkninja-tokay0-aws-iot-cert-region-root-no-patch/cover.jpg Unpatched Shark vacuums: regional root, no CVE, no patch https://0daynews.com/articles/2026-07-16-symantec-spirals-ransomware-iis-webshell-24h-south-asia/ 0dayNews en 2026-07-16T11:15:00.000Z Spirals ransomware: full network encrypted in under 24h Spirals ransomware, Symantec, IIS web shell, PsExec, WMI lateral movement, Rust ransomware, intermittent encryption https://0daynews.com/articles/2026-07-16-symantec-spirals-ransomware-iis-webshell-24h-south-asia/cover.jpg Spirals ransomware: full network encrypted in under 24h https://0daynews.com/articles/2026-07-16-openai-gpt-red-internal-red-teamer-prompt-injection/ 0dayNews en 2026-07-16T10:00:00.000Z OpenAI discloses GPT-Red, its internal automated red-teamer OpenAI, GPT-Red, prompt injection, AI red-teaming, adversarial training, LLM security https://0daynews.com/articles/2026-07-16-openai-gpt-red-internal-red-teamer-prompt-injection/cover.jpg OpenAI discloses GPT-Red, its internal automated red-teamer https://0daynews.com/articles/2026-07-16-mindgard-cursor-workspace-git-hijack-windows-no-patch/ 0dayNews en 2026-07-16T09:15:00.000Z Cursor: opening a repo runs its git.exe. No patch, 7 months. Cursor, Mindgard, workspace hijack, untrusted search path, CWE-427, developer tooling, Windows, full disclosure https://0daynews.com/articles/2026-07-16-mindgard-cursor-workspace-git-hijack-windows-no-patch/cover.jpg Cursor: opening a repo runs its git.exe. No patch, 7 months. https://0daynews.com/articles/2026-07-16-microsoft-mdash-july-622-cves-ai-attribution-krebs-rapid7/ 0dayNews en 2026-07-16T08:15:00.000Z The July patch count Microsoft warned would come Microsoft, Patch Tuesday, MDASH, AI vulnerability discovery, July 2026, Pavan Davuluri https://0daynews.com/articles/2026-07-16-microsoft-mdash-july-622-cves-ai-attribution-krebs-rapid7/cover.jpg The July patch count Microsoft warned would come https://0daynews.com/articles/2026-07-16-microsoft-kb5099539-windows-10-esu-july-22h2-ltsc-2021/ 0dayNews en 2026-07-16T07:00:00.000Z KB5099539 lands: Windows 10 ESU carries the July zero-days Windows 10, Extended Security Updates, KB5099539, LTSC 2021, Patch Tuesday, CVE-2026-56155, CVE-2026-56164 https://0daynews.com/articles/2026-07-16-microsoft-kb5099539-windows-10-esu-july-22h2-ltsc-2021/cover.jpg KB5099539 lands: Windows 10 ESU carries the July zero-days https://0daynews.com/articles/2026-07-16-intruder-vending-machine-llm-code-slicing-wordpress-zero-day/ 0dayNews en 2026-07-16T04:15:00.000Z Intruder ships an LLM vuln-discovery product, plus a 0-day intruder, llm, vulnerability discovery, code slicing, wordpress, zero-day, ai-assisted security https://0daynews.com/articles/2026-07-16-intruder-vending-machine-llm-code-slicing-wordpress-zero-day/cover.jpg Intruder ships an LLM vuln-discovery product, plus a 0-day https://0daynews.com/articles/2026-07-15-cisa-kev-oracle-ebs-cve-2026-46817-payments-file-transmission/ 0dayNews en 2026-07-15T23:20:00.000Z CISA KEV: Oracle EBS Payments 9.8 unauth RCE lands Oracle E-Business Suite, Oracle Payments, CVE-2026-46817, CISA KEV, BOD 26-04, Critical Patch Update, File Transmission https://0daynews.com/articles/2026-07-15-cisa-kev-oracle-ebs-cve-2026-46817-payments-file-transmission/cover.jpg CISA KEV: Oracle EBS Payments 9.8 unauth RCE lands https://0daynews.com/articles/2026-07-15-zoom-psirt-zsb-26014-workplace-windows-cvss-98-unauth-takeover/ 0dayNews en 2026-07-15T23:15:00.000Z Zoom PSIRT: patch Workplace 7.0.0, unauth takeover 9.8 Zoom, Zoom Workplace, Zoom VDI Client, ZSB-26014, account takeover, PSIRT https://0daynews.com/articles/2026-07-15-zoom-psirt-zsb-26014-workplace-windows-cvss-98-unauth-takeover/cover.jpg Zoom PSIRT: patch Workplace 7.0.0, unauth takeover 9.8