https://0daynews.com/articles/2026-07-21-anubis-fairlife-1tb-nutanix-claim-declines-comment/ 0dayNews en 2026-07-21T20:15:00.000Z Anubis claims Fairlife hit, 1TB and Nutanix encrypted Anubis ransomware, Coca-Cola Fairlife, Nutanix encryption, ransomware leak site, food and beverage ransomware https://0daynews.com/articles/2026-07-21-anubis-fairlife-1tb-nutanix-claim-declines-comment/cover.jpg Anubis claims Fairlife hit, 1TB and Nutanix encrypted https://0daynews.com/articles/2026-07-21-cisa-kev-dd-wrt-cve-2021-27137-upnp-ssdp-strcpy-r45724/ 0dayNews en 2026-07-21T19:15:00.000Z DD-WRT UPnP flaw CVE-2021-27137 added to CISA KEV dd-wrt, cve-2021-27137, cisa-kev, upnp, ssdp, router, buffer-overflow https://0daynews.com/articles/2026-07-21-cisa-kev-dd-wrt-cve-2021-27137-upnp-ssdp-strcpy-r45724/cover.jpg DD-WRT UPnP flaw CVE-2021-27137 added to CISA KEV https://0daynews.com/articles/2026-07-21-watchtowr-sharepoint-cve-2026-50522-devcore-third-july-patch-active-exploitation/ 0dayNews en 2026-07-21T17:30:00.000Z SharePoint CVE-2026-50522 exploited after public PoC CVE-2026-50522, Microsoft SharePoint, watchTowr, DEVCORE, deserialization, active exploitation, Patch Tuesday https://0daynews.com/articles/2026-07-21-watchtowr-sharepoint-cve-2026-50522-devcore-third-july-patch-active-exploitation/cover.jpg SharePoint CVE-2026-50522 exploited after public PoC https://0daynews.com/articles/2026-07-21-wp2shell-mass-scanning-kevintel-watchtowr-wiz-fuse-triage/ 0dayNews en 2026-07-21T15:15:00.000Z wp2shell mass scanning confirmed — patch triage tonight wp2shell, CVE-2026-63030, WordPress, mass exploitation, KEVIntel, watchTowr, Wiz https://0daynews.com/articles/2026-07-21-wp2shell-mass-scanning-kevintel-watchtowr-wiz-fuse-triage/cover.jpg wp2shell mass scanning confirmed — patch triage tonight https://0daynews.com/articles/2026-07-21-aws-kiro-mcp-config-silent-rewrite-intezer-kodem-april-patch-july-disclosure/ 0dayNews en 2026-07-21T14:20:00.000Z AWS patched a silent Kiro RCE in April, disclosed today AWS Kiro, agentic IDE, prompt injection, MCP, supply chain, AI agent security, Intezer https://0daynews.com/articles/2026-07-21-aws-kiro-mcp-config-silent-rewrite-intezer-kodem-april-patch-july-disclosure/cover.jpg AWS patched a silent Kiro RCE in April, disclosed today https://0daynews.com/articles/2026-07-21-zhang-arxiv-android-mobile-agent-frameworks-overlay-adb-pivot/ 0dayNews en 2026-07-21T14:20:00.000Z Android AI agent frameworks: overlay text pivots to host Android, AI agents, prompt injection, ADB, AppAgent, Mobile-Agent-v3, arXiv https://0daynews.com/articles/2026-07-21-zhang-arxiv-android-mobile-agent-frameworks-overlay-adb-pivot/cover.jpg Android AI agent frameworks: overlay text pivots to host https://0daynews.com/articles/2026-07-21-bit2watt-zhejiang-ches-2026-gpu-cloud-tenant-grid-swings-analysis/ 0dayNews en 2026-07-21T13:15:00.000Z Bit2Watt: what the GPU cloud tenant abstracts away Bit2Watt, Zhejiang University, CHES 2026, GPU cloud, data center grid, power grid harmonics, cloud tenant risk https://0daynews.com/articles/2026-07-21-bit2watt-zhejiang-ches-2026-gpu-cloud-tenant-grid-swings-analysis/cover.jpg Bit2Watt: what the GPU cloud tenant abstracts away https://0daynews.com/articles/2026-07-21-qilin-pan-os-cve-2026-0257-globalprotect-arctic-wolf-june-exploitation/ 0dayNews en 2026-07-21T12:00:00.000Z Qilin exploits PAN-OS GlobalProtect CVE-2026-0257 Qilin, PAN-OS, GlobalProtect, CVE-2026-0257, Arctic Wolf, ransomware, CISA KEV https://0daynews.com/articles/2026-07-21-qilin-pan-os-cve-2026-0257-globalprotect-arctic-wolf-june-exploitation/cover.jpg Qilin exploits PAN-OS GlobalProtect CVE-2026-0257 https://0daynews.com/articles/2026-07-21-microsoft-wsus-manual-fix-susdb-cleanup-maxxml-reindex-iisreset/ 0dayNews en 2026-07-21T10:30:00.000Z Microsoft ships manual WSUS fix: SUSDB cleanup, IISReset WSUS, Windows Server Update Services, Microsoft, SUSDB, MaxXMLPerRequest, patch management, Configuration Manager https://0daynews.com/articles/2026-07-21-microsoft-wsus-manual-fix-susdb-cleanup-maxxml-reindex-iisreset/cover.jpg Microsoft ships manual WSUS fix: SUSDB cleanup, IISReset https://0daynews.com/articles/2026-07-21-acros-0patch-legacyhive-free-micropatches-windows-10-server-2019/ 0dayNews en 2026-07-21T09:15:00.000Z 0patch ships free unofficial fix for LegacyHive zero-day LegacyHive, 0patch, ACROS Security, Windows zero-day, micropatch, User Profile Service, LPE https://0daynews.com/articles/2026-07-21-acros-0patch-legacyhive-free-micropatches-windows-10-server-2019/cover.jpg 0patch ships free unofficial fix for LegacyHive zero-day https://0daynews.com/articles/2026-07-21-jetbrains-teamcity-cve-2024-27198-epss-0999-two-years-past-patch/ 0dayNews en 2026-07-21T07:05:00.000Z TeamCity CVE-2024-27198: EPSS 0.999 two years past patch jetbrains, teamcity, cve-2024-27198, kev, epss, ci-cd, supply-chain https://0daynews.com/articles/2026-07-21-jetbrains-teamcity-cve-2024-27198-epss-0999-two-years-past-patch/cover.jpg TeamCity CVE-2024-27198: EPSS 0.999 two years past patch https://0daynews.com/articles/2026-07-21-signature-was-there-trust-wasnt-week-retrospective/ 0dayNews en 2026-07-21T06:15:00.000Z The signature was there. The trust wasn't. code signing, trust chain, CylindricalCanine, DigiCert, HelloNet, UAT-11795, supply chain https://0daynews.com/articles/2026-07-21-signature-was-there-trust-wasnt-week-retrospective/cover.jpg The signature was there. The trust wasn't. https://0daynews.com/articles/2026-07-21-mythos-three-months-exposure-window-triage-playbook/ 0dayNews en 2026-07-21T05:15:00.000Z Mythos at three months: measure exposure, not volume Mythos, CVE triage, exposure window, KEV, EPSS, patch management, vulnerability management https://0daynews.com/articles/2026-07-21-mythos-three-months-exposure-window-triage-playbook/cover.jpg Mythos at three months: measure exposure, not volume https://0daynews.com/articles/2026-07-21-volexity-uta0533-sonicwall-sma1000-knuckleball-orangetail-june22/ 0dayNews en 2026-07-21T04:15:00.000Z Volexity ties SonicWall SMA1000 zero-days to UTA0533 SonicWall SMA1000, CVE-2026-15409, CVE-2026-15410, UTA0533, Volexity, KNUCKLEBALL, ORANGETAIL, threat intel https://0daynews.com/articles/2026-07-21-volexity-uta0533-sonicwall-sma1000-knuckleball-orangetail-june22/cover.jpg Volexity ties SonicWall SMA1000 zero-days to UTA0533 https://0daynews.com/articles/2026-07-21-ai-agent-sandboxes-only-as-tight-as-host-tools/ 0dayNews en 2026-07-21T04:05:00.000Z AI-agent sandboxes are only as tight as the host tools AI coding agents, sandbox escape, Pillar Security, agent security, Cursor, Codex CLI, Gemini CLI https://0daynews.com/articles/2026-07-21-ai-agent-sandboxes-only-as-tight-as-host-tools/cover.jpg AI-agent sandboxes are only as tight as the host tools https://0daynews.com/articles/2026-07-20-ostium-arbitrum-off-chain-oracle-forgery-23-75m-lp-vault-drain/ 0dayNews en 2026-07-21T01:05:00.000Z Ostium's LP vault down $23.75M after oracle-feed forgery Ostium, Arbitrum, price oracle, DEX, Tornado Cash, off-chain infrastructure https://0daynews.com/articles/2026-07-20-ostium-arbitrum-off-chain-oracle-forgery-23-75m-lp-vault-drain/cover.jpg Ostium's LP vault down $23.75M after oracle-feed forgery https://0daynews.com/articles/2026-07-21-estee-lauder-cl0p-oracle-ebs-cve-2025-61882-bi-publisher-11-month-dwell/ 0dayNews en 2026-07-21T00:20:00.000Z Estée Lauder confirms Cl0p Oracle EBS breach, 11mo dwell Estée Lauder, Cl0p, Oracle E-Business Suite, CVE-2025-61882, BI Publisher Integration, data breach, HR system https://0daynews.com/articles/2026-07-21-estee-lauder-cl0p-oracle-ebs-cve-2025-61882-bi-publisher-11-month-dwell/cover.jpg Estée Lauder confirms Cl0p Oracle EBS breach, 11mo dwell https://0daynews.com/articles/2026-07-20-jadepuffer-encforge-ai-asset-ransomware-model-weights-vector-dbs/ 0dayNews en 2026-07-20T23:15:00.000Z Sysdig: JADEPUFFER now ships EncForge, targets model weights JADEPUFFER, EncForge, AI ransomware, Sysdig, Langflow, model checkpoints https://0daynews.com/articles/2026-07-20-jadepuffer-encforge-ai-asset-ransomware-model-weights-vector-dbs/cover.jpg Sysdig: JADEPUFFER now ships EncForge, targets model weights https://0daynews.com/articles/2026-07-20-pillar-week-sandbox-escapes-cursor-codex-gemini-cli-antigravity/ 0dayNews en 2026-07-20T22:15:00.000Z Cursor, Codex, Gemini CLI, Antigravity: sandbox escapes AI coding agents, sandbox escape, Cursor, Codex CLI, Gemini CLI, Antigravity, Pillar Security https://0daynews.com/articles/2026-07-20-pillar-week-sandbox-escapes-cursor-codex-gemini-cli-antigravity/cover.jpg Cursor, Codex, Gemini CLI, Antigravity: sandbox escapes https://0daynews.com/articles/2026-07-20-island-fakegit-7600-github-mcp-smartloader-agentbaiting/ 0dayNews en 2026-07-20T21:00:00.000Z FakeGit: 7,600 GitHub repos push SmartLoader via MCP lure FakeGit, SmartLoader, MCP servers, GitHub supply chain, AgentBaiting, Island, StealC, LobeHub https://0daynews.com/articles/2026-07-20-island-fakegit-7600-github-mcp-smartloader-agentbaiting/cover.jpg FakeGit: 7,600 GitHub repos push SmartLoader via MCP lure https://0daynews.com/articles/2026-07-20-group-ib-hollowgraph-m365-calendar-events-2050-c2-dead-drop/ 0dayNews en 2026-07-20T16:20:00.000Z HollowGraph hides M365 C2 in calendar events dated 2050 hollowgraph, group-ib, microsoft-365, microsoft-graph-api, calendar-c2, dead-drop, entra-id, espionage https://0daynews.com/articles/2026-07-20-group-ib-hollowgraph-m365-calendar-events-2050-c2-dead-drop/cover.jpg HollowGraph hides M365 C2 in calendar events dated 2050 https://0daynews.com/articles/2026-07-20-rapid7-exposed-webdav-lab-1048-artifacts-mexico-curp-victims/ 0dayNews en 2026-07-20T15:15:00.000Z Exposed WebDAV lab: 1,048 artifacts, real Mexico victims Rapid7, WebDAV, CURP, PureRAT, Mexico, malware delivery, CVE-2025-33053 https://0daynews.com/articles/2026-07-20-rapid7-exposed-webdav-lab-1048-artifacts-mexico-curp-victims/cover.jpg Exposed WebDAV lab: 1,048 artifacts, real Mexico victims https://0daynews.com/articles/2026-07-20-aivd-mivd-russian-intel-ip-cameras-nato-military-transport-ukraine/ 0dayNews en 2026-07-20T14:15:00.000Z AIVD/MIVD: Russia hijacks IP cameras on NATO convoy routes AIVD, MIVD, IP cameras, Russia, Ukraine, NATO, military logistics https://0daynews.com/articles/2026-07-20-aivd-mivd-russian-intel-ip-cameras-nato-military-transport-ukraine/cover.jpg AIVD/MIVD: Russia hijacks IP cameras on NATO convoy routes https://0daynews.com/articles/2026-07-20-wsus-sync-fix-new-installs-only-old-servers-metadata-cleanup/ 0dayNews en 2026-07-20T13:15:00.000Z WSUS sync fix only for new installs, old servers still stuck WSUS, Windows Server Update Services, Microsoft, Windows Server, Configuration Manager, patch management, sync failure https://0daynews.com/articles/2026-07-20-wsus-sync-fix-new-installs-only-old-servers-metadata-cleanup/cover.jpg WSUS sync fix only for new installs, old servers still stuck https://0daynews.com/articles/2026-07-20-trend-micro-bandcampro-gemini-cli-c2-dental-clinic-eight-node-botnet/ 0dayNews en 2026-07-20T12:00:00.000Z Trend Micro: 'bandcampro' ran botnet ops through Gemini CLI Google Gemini CLI, bandcampro, Trend Micro, botnet, OpenDental, Patriot Bait, AI-assisted intrusions https://0daynews.com/articles/2026-07-20-trend-micro-bandcampro-gemini-cli-c2-dental-clinic-eight-node-botnet/cover.jpg Trend Micro: 'bandcampro' ran botnet ops through Gemini CLI https://0daynews.com/articles/2026-07-20-microsoft-kb5121767-oob-dell-intel-ipf-driver-hold-fix/ 0dayNews en 2026-07-20T11:15:00.000Z Microsoft ships KB5121767 OOB for Dell IPF driver hold Microsoft, KB5121767, Windows 11, Dell, Intel IPF, out-of-band update, KB5101650, safeguard hold https://0daynews.com/articles/2026-07-20-microsoft-kb5121767-oob-dell-intel-ipf-driver-hold-fix/cover.jpg Microsoft ships KB5121767 OOB for Dell IPF driver hold https://0daynews.com/articles/2026-07-20-servicenow-ai-platform-cve-2026-6875-defused-exploitation/ 0dayNews en 2026-07-20T10:30:00.000Z ServiceNow AI Platform RCE exploited in wild: CVE-2026-6875 ServiceNow, CVE-2026-6875, AI Platform, remote code execution, Defused, active exploitation https://0daynews.com/articles/2026-07-20-servicenow-ai-platform-cve-2026-6875-defused-exploitation/cover.jpg ServiceNow AI Platform RCE exploited in wild: CVE-2026-6875 https://0daynews.com/articles/2026-07-20-hugging-face-autonomous-ai-agent-breach-internal-datasets/ 0dayNews en 2026-07-20T09:00:00.000Z Hugging Face confirms breach by autonomous AI agent Hugging Face, autonomous AI agent, supply chain, dataset loader, template injection, GLM 5.2, AI security https://0daynews.com/articles/2026-07-20-hugging-face-autonomous-ai-agent-breach-internal-datasets/cover.jpg Hugging Face confirms breach by autonomous AI agent https://0daynews.com/articles/2026-07-20-stepsecurity-sleepergem-rubygems-dormant-accounts-forgejo-loader/ 0dayNews en 2026-07-20T08:00:00.000Z SleeperGem loader hides in dormant RubyGems, skips CI/CD SleeperGem, StepSecurity, RubyGems supply chain, git_credential_manager, Dendreo, Forgejo, dormant maintainer accounts https://0daynews.com/articles/2026-07-20-stepsecurity-sleepergem-rubygems-dormant-accounts-forgejo-loader/cover.jpg SleeperGem loader hides in dormant RubyGems, skips CI/CD https://0daynews.com/articles/2026-07-20-wp2shell-first-exploitation-cve-2026-60137-sqli-companion-patched/ 0dayNews en 2026-07-20T01:15:00.000Z wp2shell: first signs of exploitation; CVE-2026-60137 lands CVE-2026-63030, CVE-2026-60137, wp2shell, WordPress, WordPress Core, in-the-wild exploitation, watchTowr, Searchlight Cyber https://0daynews.com/articles/2026-07-20-wp2shell-first-exploitation-cve-2026-60137-sqli-companion-patched/cover.jpg wp2shell: first signs of exploitation; CVE-2026-60137 lands https://0daynews.com/articles/2026-07-19-nginx-cve-2026-42533-map-regex-heap-overflow-worker-patch/ 0dayNews en 2026-07-19T22:05:00.000Z nginx patches heap overflow in worker (CVE-2026-42533) nginx, CVE-2026-42533, F5, heap overflow, map directive, NGINX Plus, memory safety https://0daynews.com/articles/2026-07-19-nginx-cve-2026-42533-map-regex-heap-overflow-worker-patch/cover.jpg nginx patches heap overflow in worker (CVE-2026-42533)