https://0daynews.com/articles/2026-07-16-anyrun-phantomenigma-brazil-gov-br-hijack-dmarc-inno-node/ 0dayNews en 2026-07-16T17:20:00.000Z PhantomEnigma rides Brazilian .gov.br sites and mailboxes PhantomEnigma, ANY.RUN, Brazil, gov.br, DMARC, Inno Setup, banking-trojan https://0daynews.com/articles/2026-07-16-anyrun-phantomenigma-brazil-gov-br-hijack-dmarc-inno-node/cover.jpg PhantomEnigma rides Brazilian .gov.br sites and mailboxes https://0daynews.com/articles/2026-07-16-rapid7-attackerkb-public-sunset-august-18-curation/ 0dayNews en 2026-07-16T16:30:00.000Z AttackerKB's public tier closes August 18 AttackerKB, Rapid7, vulnerability intelligence, Douglas McKee, AI-generated submissions, community disclosure https://0daynews.com/articles/2026-07-16-rapid7-attackerkb-public-sunset-august-18-curation/cover.jpg AttackerKB's public tier closes August 18 https://0daynews.com/articles/2026-07-16-23andme-chrome-holding-18m-43-state-ag-settlement-2023-breach/ 0dayNews en 2026-07-16T15:20:00.000Z 23andMe settles genetics breach: $18M, 43 states 23andMe, Chrome Holding, genetic data breach, state attorneys general, Letitia James, credential stuffing, settlement https://0daynews.com/articles/2026-07-16-23andme-chrome-holding-18m-43-state-ag-settlement-2023-breach/cover.jpg 23andMe settles genetics breach: $18M, 43 states https://0daynews.com/articles/2026-07-16-daxin-srt64-stupig-winlogon-taiwan-digiwin-jdk/ 0dayNews en 2026-07-16T14:20:00.000Z Daxin resurfaces in Taiwan alongside new Stupig backdoor daxin, stupig, symantec, kernel-rootkit, winlogon, taiwan, china-linked https://0daynews.com/articles/2026-07-16-daxin-srt64-stupig-winlogon-taiwan-digiwin-jdk/cover.jpg Daxin resurfaces in Taiwan alongside new Stupig backdoor https://0daynews.com/articles/2026-07-16-scattered-spider-tfl-jubair-flowers-nca-cma-sentence/ 0dayNews en 2026-07-16T13:20:00.000Z Two Scattered Spider affiliates get 5.5 years for TfL hack Scattered Spider, Transport for London, Thalha Jubair, Owen Flowers, National Crime Agency, Computer Misuse Act https://0daynews.com/articles/2026-07-16-scattered-spider-tfl-jubair-flowers-nca-cma-sentence/cover.jpg Two Scattered Spider affiliates get 5.5 years for TfL hack https://0daynews.com/articles/2026-07-16-sharkninja-tokay0-aws-iot-cert-region-root-no-patch/ 0dayNews en 2026-07-16T12:00:00.000Z Unpatched Shark vacuums: regional root, no CVE, no patch SharkNinja, Shark robot vacuum, AWS IoT, IoT device certificate, tokay0, responsible disclosure, IOT_POLICY_OVERLY_PERMISSIVE_CHECK https://0daynews.com/articles/2026-07-16-sharkninja-tokay0-aws-iot-cert-region-root-no-patch/cover.jpg Unpatched Shark vacuums: regional root, no CVE, no patch https://0daynews.com/articles/2026-07-16-symantec-spirals-ransomware-iis-webshell-24h-south-asia/ 0dayNews en 2026-07-16T11:15:00.000Z Spirals ransomware: full network encrypted in under 24h Spirals ransomware, Symantec, IIS web shell, PsExec, WMI lateral movement, Rust ransomware, intermittent encryption https://0daynews.com/articles/2026-07-16-symantec-spirals-ransomware-iis-webshell-24h-south-asia/cover.jpg Spirals ransomware: full network encrypted in under 24h https://0daynews.com/articles/2026-07-16-openai-gpt-red-internal-red-teamer-prompt-injection/ 0dayNews en 2026-07-16T10:00:00.000Z OpenAI discloses GPT-Red, its internal automated red-teamer OpenAI, GPT-Red, prompt injection, AI red-teaming, adversarial training, LLM security https://0daynews.com/articles/2026-07-16-openai-gpt-red-internal-red-teamer-prompt-injection/cover.jpg OpenAI discloses GPT-Red, its internal automated red-teamer https://0daynews.com/articles/2026-07-16-mindgard-cursor-workspace-git-hijack-windows-no-patch/ 0dayNews en 2026-07-16T09:15:00.000Z Cursor: opening a repo runs its git.exe. No patch, 7 months. Cursor, Mindgard, workspace hijack, untrusted search path, CWE-427, developer tooling, Windows, full disclosure https://0daynews.com/articles/2026-07-16-mindgard-cursor-workspace-git-hijack-windows-no-patch/cover.jpg Cursor: opening a repo runs its git.exe. No patch, 7 months. https://0daynews.com/articles/2026-07-16-microsoft-mdash-july-622-cves-ai-attribution-krebs-rapid7/ 0dayNews en 2026-07-16T08:15:00.000Z The July patch count Microsoft warned would come Microsoft, Patch Tuesday, MDASH, AI vulnerability discovery, July 2026, Pavan Davuluri https://0daynews.com/articles/2026-07-16-microsoft-mdash-july-622-cves-ai-attribution-krebs-rapid7/cover.jpg The July patch count Microsoft warned would come https://0daynews.com/articles/2026-07-16-microsoft-kb5099539-windows-10-esu-july-22h2-ltsc-2021/ 0dayNews en 2026-07-16T07:00:00.000Z KB5099539 lands: Windows 10 ESU carries the July zero-days Windows 10, Extended Security Updates, KB5099539, LTSC 2021, Patch Tuesday, CVE-2026-56155, CVE-2026-56164 https://0daynews.com/articles/2026-07-16-microsoft-kb5099539-windows-10-esu-july-22h2-ltsc-2021/cover.jpg KB5099539 lands: Windows 10 ESU carries the July zero-days https://0daynews.com/articles/2026-07-16-intruder-vending-machine-llm-code-slicing-wordpress-zero-day/ 0dayNews en 2026-07-16T04:15:00.000Z Intruder ships an LLM vuln-discovery product, plus a 0-day intruder, llm, vulnerability discovery, code slicing, wordpress, zero-day, ai-assisted security https://0daynews.com/articles/2026-07-16-intruder-vending-machine-llm-code-slicing-wordpress-zero-day/cover.jpg Intruder ships an LLM vuln-discovery product, plus a 0-day https://0daynews.com/articles/2026-07-15-cisa-kev-oracle-ebs-cve-2026-46817-payments-file-transmission/ 0dayNews en 2026-07-15T23:20:00.000Z CISA KEV: Oracle EBS Payments 9.8 unauth RCE lands Oracle E-Business Suite, Oracle Payments, CVE-2026-46817, CISA KEV, BOD 26-04, Critical Patch Update, File Transmission https://0daynews.com/articles/2026-07-15-cisa-kev-oracle-ebs-cve-2026-46817-payments-file-transmission/cover.jpg CISA KEV: Oracle EBS Payments 9.8 unauth RCE lands https://0daynews.com/articles/2026-07-15-zoom-psirt-zsb-26014-workplace-windows-cvss-98-unauth-takeover/ 0dayNews en 2026-07-15T23:15:00.000Z Zoom PSIRT: patch Workplace 7.0.0, unauth takeover 9.8 Zoom, Zoom Workplace, Zoom VDI Client, ZSB-26014, account takeover, PSIRT https://0daynews.com/articles/2026-07-15-zoom-psirt-zsb-26014-workplace-windows-cvss-98-unauth-takeover/cover.jpg Zoom PSIRT: patch Workplace 7.0.0, unauth takeover 9.8 https://0daynews.com/articles/2026-07-15-dutch-politie-100m-investment-fraud-20-call-centers-700-shills/ 0dayNews en 2026-07-15T22:05:00.000Z Dutch bust €100M fraud ring, 20 call centers, 700 shills Dutch Politie, investment fraud, call center fraud, crypto fraud, takedown, Europol, Netherlands https://0daynews.com/articles/2026-07-15-dutch-politie-100m-investment-fraud-20-call-centers-700-shills/cover.jpg Dutch bust €100M fraud ring, 20 call centers, 700 shills https://0daynews.com/articles/2026-07-15-rapid7-sma1000-mdr-writeup-mfa-seeds-dc-pivots/ 0dayNews en 2026-07-15T22:00:00.000Z SonicWall SMA1000: what Rapid7 saw before disclosure SonicWall SMA1000, CVE-2026-15409, CVE-2026-15410, Rapid7 MDR, incident response, zero-day, VPN compromise https://0daynews.com/articles/2026-07-15-rapid7-sma1000-mdr-writeup-mfa-seeds-dc-pivots/cover.jpg SonicWall SMA1000: what Rapid7 saw before disclosure https://0daynews.com/articles/2026-07-15-unit-42-tuxbot-v3-llm-chain-of-thought-iot-botnet/ 0dayNews en 2026-07-15T21:15:00.000Z Unit 42: TuxBot v3 shipped LLM chain-of-thought in comments TuxBot, Unit 42, Palo Alto Networks, IoT botnet, LLM, Mirai, MHDDoS https://0daynews.com/articles/2026-07-15-unit-42-tuxbot-v3-llm-chain-of-thought-iot-botnet/cover.jpg Unit 42: TuxBot v3 shipped LLM chain-of-thought in comments https://0daynews.com/articles/2026-07-15-trend-micro-bandcampro-gemini-cli-c2-botnet-operator/ 0dayNews en 2026-07-15T20:20:00.000Z Trend Micro: bandcampro ran a C2 botnet on Gemini CLI Trend Micro, Gemini CLI, bandcampro, agentic C2, LLM abuse, OpenDental, dental clinic breach https://0daynews.com/articles/2026-07-15-trend-micro-bandcampro-gemini-cli-c2-botnet-operator/cover.jpg Trend Micro: bandcampro ran a C2 botnet on Gemini CLI https://0daynews.com/articles/2026-07-15-knx-cve-2023-4346-cisa-kev-account-lockout-bod-26-04/ 0dayNews en 2026-07-15T20:15:00.000Z KNX account-lockout flaw added to CISA KEV, three years on knx, cve-2023-4346, kev, bod-26-04, ics-ot, building-automation, cisa https://0daynews.com/articles/2026-07-15-knx-cve-2023-4346-cisa-kev-account-lockout-bod-26-04/cover.jpg KNX account-lockout flaw added to CISA KEV, three years on https://0daynews.com/articles/2026-07-15-rapid7-blazek-aws-persistence-iam-lambda-federated-hunt-runbook/ 0dayNews en 2026-07-15T19:15:00.000Z AWS persistence: four patterns to hunt after an incident aws, iam, cloudtrail, lambda, persistence, cloud-security, detection-engineering https://0daynews.com/articles/2026-07-15-rapid7-blazek-aws-persistence-iam-lambda-federated-hunt-runbook/cover.jpg AWS persistence: four patterns to hunt after an incident https://0daynews.com/articles/2026-07-15-kaspersky-okobot-seedhunter-ledger-trezor-electron-hook/ 0dayNews en 2026-07-15T18:15:00.000Z Kaspersky: OkoBot phishes seeds inside Ledger, Trezor apps OkoBot, Kaspersky GReAT, SeedHunter, Ledger Live, Trezor Suite, TookPS, hardware wallet phishing https://0daynews.com/articles/2026-07-15-kaspersky-okobot-seedhunter-ledger-trezor-electron-hook/cover.jpg Kaspersky: OkoBot phishes seeds inside Ledger, Trezor apps https://0daynews.com/articles/2026-07-15-zyxel-cve-2023-28771-epss-099-three-years-post-patch/ 0dayNews en 2026-07-15T17:15:00.000Z Zyxel CVE-2023-28771: EPSS 0.99 three years after the patch zyxel, cve-2023-28771, kev, epss, firewall, edge-network, command-injection https://0daynews.com/articles/2026-07-15-zyxel-cve-2023-28771-epss-099-three-years-post-patch/cover.jpg Zyxel CVE-2023-28771: EPSS 0.99 three years after the patch https://0daynews.com/articles/2026-07-15-chaotic-eclipse-legacyhive-profsvc-lpe-poc-drop/ 0dayNews en 2026-07-15T16:15:00.000Z LegacyHive: Chaotic Eclipse's fourth Windows zero-day LegacyHive, Chaotic Eclipse, Nightmare-Eclipse, Windows User Profile Service, ProfSvc, local privilege escalation, zero-day https://0daynews.com/articles/2026-07-15-chaotic-eclipse-legacyhive-profsvc-lpe-poc-drop/cover.jpg LegacyHive: Chaotic Eclipse's fourth Windows zero-day https://0daynews.com/articles/2026-07-15-mozilla-firefox-exploit-public-chrome-adobe-coldfusion-patch-day/ 0dayNews en 2026-07-15T15:15:00.000Z Firefox exploit code public; Chrome, Adobe patch same day Firefox, Chrome, Adobe ColdFusion, patch management, CVE-2026-15718, CVE-2026-15719, CVE-2026-48318 https://0daynews.com/articles/2026-07-15-mozilla-firefox-exploit-public-chrome-adobe-coldfusion-patch-day/cover.jpg Firefox exploit code public; Chrome, Adobe patch same day https://0daynews.com/articles/2026-07-15-cisa-sharepoint-three-cves-bod-26-04-july-17-deadline/ 0dayNews en 2026-07-15T14:15:00.000Z CISA: three SharePoint bugs exploited, patch by July 17 SharePoint, CISA KEV, BOD 26-04, CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, patch management https://0daynews.com/articles/2026-07-15-cisa-sharepoint-three-cves-bod-26-04-july-17-deadline/cover.jpg CISA: three SharePoint bugs exploited, patch by July 17 https://0daynews.com/articles/2026-07-15-asyncapi-npm-miasma-multi-c2-loader-cicd-compromise/ 0dayNews en 2026-07-15T13:00:00.000Z Miasma loader shipped in 5 @asyncapi npm package versions asyncapi, npm-supply-chain, miasma-loader, cicd-compromise, ipfs-c2, nostr-c2, ox-security, socket https://0daynews.com/articles/2026-07-15-asyncapi-npm-miasma-multi-c2-loader-cicd-compromise/cover.jpg Miasma loader shipped in 5 @asyncapi npm package versions https://0daynews.com/articles/2026-07-15-mindgard-cursor-git-exe-workspace-root-no-patch/ 0dayNews en 2026-07-15T12:20:00.000Z Mindgard: Cursor still runs git.exe from repo root Cursor, Mindgard, Aaron Portnoy, Windows executable search order, workspace trust, AI coding editor, full disclosure https://0daynews.com/articles/2026-07-15-mindgard-cursor-git-exe-workspace-root-no-patch/cover.jpg Mindgard: Cursor still runs git.exe from repo root https://0daynews.com/articles/2026-07-15-doj-media-land-yalishanda-lockbit-blacksuit-play-bulletproof-hosting-indictment/ 0dayNews en 2026-07-15T10:15:00.000Z DOJ indicts Media Land trio: LockBit, BlackSuit, Play host media-land, ml-cloud, yalishanda, lockbit, blacksuit, play, bulletproof-hosting, doj-indictment https://0daynews.com/articles/2026-07-15-doj-media-land-yalishanda-lockbit-blacksuit-play-bulletproof-hosting-indictment/cover.jpg DOJ indicts Media Land trio: LockBit, BlackSuit, Play host https://0daynews.com/articles/2026-07-15-microsoft-safeguard-hold-dell-kb5101650-intel-ipf-shutdowns/ 0dayNews en 2026-07-15T10:15:00.000Z Microsoft blocks Dell PCs from July KB5101650 rollout Microsoft, Windows 11, Dell, KB5101650, KB5095093, safeguard hold, Patch Tuesday https://0daynews.com/articles/2026-07-15-microsoft-safeguard-hold-dell-kb5101650-intel-ipf-shutdowns/cover.jpg Microsoft blocks Dell PCs from July KB5101650 rollout https://0daynews.com/articles/2026-07-15-microsoft-entra-id-passkeys-default-september-sms-voice-retirement-feb-2027/ 0dayNews en 2026-07-15T08:15:00.000Z Entra ID passkeys go default in Sept; SMS/voice out Feb 1 Microsoft Entra ID, passkeys default, SMS MFA retirement, voice MFA retirement, phishing-resistant MFA, Entra ID rollout September 2026 https://0daynews.com/articles/2026-07-15-microsoft-entra-id-passkeys-default-september-sms-voice-retirement-feb-2027/cover.jpg Entra ID passkeys go default in Sept; SMS/voice out Feb 1 https://0daynews.com/articles/2026-07-15-reliaquest-jalisco-omegalord-m365-device-code-mfa-bypass/ 0dayNews en 2026-07-15T07:00:00.000Z Jalisco kit auto-refreshes M365 device codes on demand reliaquest, jalisco, omegalord, microsoft-365, device-code-phishing, oauth, entra-id https://0daynews.com/articles/2026-07-15-reliaquest-jalisco-omegalord-m365-device-code-mfa-bypass/cover.jpg Jalisco kit auto-refreshes M365 device codes on demand https://0daynews.com/articles/2026-07-15-spain-140m-bec-fraud-ring-800-accounts-67-mules/ 0dayNews en 2026-07-15T05:10:00.000Z Spain Dismantles €140M BEC Ring; 800 Accounts, 67 Mules BEC, business email compromise, Spanish National Police, Europol, Interpol, money mules, investment fraud, financial crime https://0daynews.com/articles/2026-07-15-spain-140m-bec-fraud-ring-800-accounts-67-mules/cover.jpg Spain Dismantles €140M BEC Ring; 800 Accounts, 67 Mules https://0daynews.com/articles/2026-07-15-lastpass-bitwarden-compliance-lookalike-domain-phishing/ 0dayNews en 2026-07-15T04:15:00.000Z LastPass, Bitwarden users hit by lookalike-domain phishing LastPass, Bitwarden, password manager phishing, lookalike domain, DocuSign lure, credential theft https://0daynews.com/articles/2026-07-15-lastpass-bitwarden-compliance-lookalike-domain-phishing/cover.jpg LastPass, Bitwarden users hit by lookalike-domain phishing https://0daynews.com/articles/2026-07-15-blackpoint-labubarat-rust-nvidia-sysruntime-maas/ 0dayNews en 2026-07-15T03:15:00.000Z Blackpoint flags LabubaRAT: Rust MaaS RAT poses as NVIDIA LabubaRAT, Blackpoint Cyber, Rust, RAT, malware-as-a-service, NVIDIA, Windows https://0daynews.com/articles/2026-07-15-blackpoint-labubarat-rust-nvidia-sysruntime-maas/cover.jpg Blackpoint flags LabubaRAT: Rust MaaS RAT poses as NVIDIA https://0daynews.com/articles/2026-07-14-arctic-wolf-292-fake-github-repos-boryptgrab-infostealer/ 0dayNews en 2026-07-14T22:15:00.000Z Arctic Wolf: 292 fake GitHub repos push BoryptGrab stealer github, arctic-wolf, boryptgrab, infostealer, supply-chain, typosquatting, chrome-app-bound-encryption https://0daynews.com/articles/2026-07-14-arctic-wolf-292-fake-github-repos-boryptgrab-infostealer/cover.jpg Arctic Wolf: 292 fake GitHub repos push BoryptGrab stealer https://0daynews.com/articles/2026-07-14-sonicwall-sma1000-cve-2026-15409-15410-kev-active-exploitation/ 0dayNews en 2026-07-14T21:45:00.000Z SonicWall SMA1000 zero-days on CISA KEV: patch by July 17 SonicWall SMA1000, CVE-2026-15409, CVE-2026-15410, CISA KEV, zero-day, remote access, vendor patch https://0daynews.com/articles/2026-07-14-sonicwall-sma1000-cve-2026-15409-15410-kev-active-exploitation/cover.jpg SonicWall SMA1000 zero-days on CISA KEV: patch by July 17 https://0daynews.com/articles/2026-07-14-manifold-claude-for-chrome-trust-boundary-still-open/ 0dayNews en 2026-07-14T21:30:00.000Z Claude for Chrome flaw lets other extensions read Gmail claude for chrome, manifold security, anthropic, claudebleed, layerx security, browser extension, prompt injection, trust boundary https://0daynews.com/articles/2026-07-14-manifold-claude-for-chrome-trust-boundary-still-open/cover.jpg Claude for Chrome flaw lets other extensions read Gmail https://0daynews.com/articles/2026-07-14-rapid7-sharepoint-cve-2026-55040-jwt-auth-bypass-rce-chain-half/ 0dayNews en 2026-07-14T20:15:00.000Z SharePoint JWT bypass fixed; RCE half of chain still open microsoft, sharepoint, cve-2026-55040, authentication-bypass, rapid7, jwt, patch-tuesday https://0daynews.com/articles/2026-07-14-rapid7-sharepoint-cve-2026-55040-jwt-auth-bypass-rce-chain-half/cover.jpg SharePoint JWT bypass fixed; RCE half of chain still open https://0daynews.com/articles/2026-07-14-microsoft-july-patch-tuesday-570-cves-adfs-sharepoint-bitlocker-zero-days/ 0dayNews en 2026-07-14T19:15:00.000Z Microsoft July Patch Tuesday: 570 CVEs, 3 zero-days out Microsoft Patch Tuesday, AD FS, SharePoint, BitLocker, zero-day, CVE-2026-56155, CVE-2026-56164 https://0daynews.com/articles/2026-07-14-microsoft-july-patch-tuesday-570-cves-adfs-sharepoint-bitlocker-zero-days/cover.jpg Microsoft July Patch Tuesday: 570 CVEs, 3 zero-days out https://0daynews.com/articles/2026-07-14-ku-leuven-distrinet-85-crypto-wallet-extensions-address-linking/ 0dayNews en 2026-07-14T18:20:00.000Z KU Leuven: 85 wallet extensions leak addresses cross-site KU Leuven, DistriNet, crypto wallet extension, address linking, browser extension privacy, PETS 2026, wallet fingerprinting https://0daynews.com/articles/2026-07-14-ku-leuven-distrinet-85-crypto-wallet-extensions-address-linking/cover.jpg KU Leuven: 85 wallet extensions leak addresses cross-site https://0daynews.com/articles/2026-07-14-progress-sharefile-storage-zone-5-12-5-6-0-2-path-traversal-patch/ 0dayNews en 2026-07-14T17:20:00.000Z Progress patches ShareFile zero-day: 5.12.5 and 6.0.2 out Progress ShareFile, Storage Zone Controller, path traversal, vendor patch, managed file transfer, zero-day https://0daynews.com/articles/2026-07-14-progress-sharefile-storage-zone-5-12-5-6-0-2-path-traversal-patch/cover.jpg Progress patches ShareFile zero-day: 5.12.5 and 6.0.2 out