Latest 0-day news

Lazarus hackers exploited Windows zero-day to gain Kernel privileges

North Korean threat actors known as the Lazarus Group exploited a flaw in the Windows AppLocker driver (appid.sys) as a zero-day to gain kernel-level access and turn off security tools, allowing them to bypass noisy BYOVD (Bring Your Own Vulnerable Driver) techniques.
- Bill Toulas
- February 28, 2024
- 12:24 PM
- 1
Google: Hackers exploited Zimbra zero-day in attacks on govt orgs

Hackers leveraged a medium-severity security issue now identified as CVE-2023-37580 since June 29, nearly a month before the vendor addressed it in version 8.8.15 Patch 41of the software on July 25.
- Bill Toulas
- November 17, 2023
- 11:04 AM
- 0
Apple backports BLASTPASS zero-day fix to older iPhones

Apple released security updates for older iPhones to fix a zero-day vulnerability tracked as CVE-2023-41064 that was actively exploited to infect iOS devices with NSO's Pegasus spyware.
- Bill Toulas
- September 12, 2023
- 09:42 AM
- 0
Notepad++ 8.5.7 released with fixes for four security vulnerabilities

Notepad++ version 8.5.7 has been released with fixes for multiple buffer overflow zero-days, with one marked as potentially leading to code execution by tricking users into opening specially crafted files.
- Bill Toulas
- September 08, 2023
- 03:46 PM
- 0
Google: State hackers attack security researchers with new zero-day

Google's Threat Analysis Group (TAG) says North Korean state hackers are again targeting security researchers in attacks using at least one zero-day in an undisclosed popular software.
- Sergiu Gatlan
- September 07, 2023
- 12:48 PM
- 0
Google: Android patch gap makes n-days as dangerous as zero-days

Google has published its annual 0-day vulnerability report, presenting in-the-wild exploitation stats from 2022 and highlighting a long-standing problem in the Android platform that elevates the value and use of disclosed flaws for extended periods.
- Bill Toulas
- July 30, 2023
- 10:16 AM
- 2
Fake zero-day PoC exploits on GitHub push Windows, Linux malware

Hackers are impersonating cybersecurity researchers on Twitter and GitHub to publish fake proof-of-concept exploits for zero-day vulnerabilities that infect Windows and Linux with malware.
- Bill Toulas
- June 14, 2023
- 06:00 AM
- 1
Chinese hackers behind most zero-day exploits during 2021

Threat analysts report that zero-day vulnerability exploitation is on the rise with Chinese hackers using most of them in attacks last year.
- Bill Toulas
- April 22, 2022
- 10:34 AM
- 1
Emergency Google Chrome update fixes zero-day used in attacks

Google has released Chrome 99.0.4844.84 for Windows, Mac, and Linux users to address a high-severity zero-day bug exploited in the wild.
- Sergiu Gatlan
- March 25, 2022
- 03:10 PM
- 2
Google Chrome emergency update fixes zero-day exploited in attacks

Google has released Chrome 98.0.4758.102 for Windows, Mac, and Linux, to fix a high-severity zero-day vulnerability used by threat actors in attacks.
- Lawrence Abrams
- February 14, 2022
- 06:34 PM
- 0
Google pushes emergency Chrome update to fix zero-day used in attacks

Google has released Chrome 96.0.4664.110 for Windows, Mac, and Linux, to address a high-severity zero-day vulnerability exploited in the wild.
- Sergiu Gatlan
- December 13, 2021
- 05:31 PM
- 1
Emergency Google Chrome update fixes zero-day exploited in the wild

Google has released Chrome 94.0.4606.61 for Windows, Mac, and Linux, an emergency update addressing a high-severity zero-day vulnerability exploited in the wild.
- Sergiu Gatlan
- September 24, 2021
- 01:33 PM
- 1
Researcher drops three iOS zero-days that Apple refused to fix

Proof-of-concept exploit code for three iOS zero-day vulnerabilities (and a fourth one patched in July) was published on GitHub after Apple delayed patching and failed to credit the researcher.
- Sergiu Gatlan
- September 24, 2021
- 07:13 AM
- 3
Cisco: Firewall manager RCE bug is a zero-day, patch incoming

In a Thursday security advisory update, Cisco revealed that a remote code execution (RCE) vulnerability in the Adaptive Security Device Manager (ADSM) Launcher disclosed last month is a zero-day bug that has yet to receive a security update.
- Sergiu Gatlan
- August 06, 2021
- 01:16 PM
- 0
How to Mitigate the Windows Font Parsing Zero-Day Bug via GPO

Active Directory (AD) admins can mitigate the recently disclosed and actively exploited remote code execution (RCE) zero-day found in the Windows Adobe Type Manager Library in large AD environments using group policies.
- Sergiu Gatlan
- April 01, 2020
- 05:55 PM
- 0
Mozilla Firefox 72.0.1 Patches Actively Exploited Zero-Day

Mozilla released Firefox 72.0.1 and Firefox ESR 68.4.1 to patch a critical and actively exploited severity vulnerability that could potentially allow attackers to execute code or trigger crashes on machines running vulnerable Firefox versions.
- Sergiu Gatlan
- January 08, 2020
- 01:35 PM
- 0
Patched Windows Zero-Day Provided Full Control Over Vulnerable Systems

A Windows zero-day vulnerability which got patched by Microsoft as part of the company's April 2019 Patch Tuesday together with 73 other flaws could allow potential attackers to take full control of vulnerable systems.
- Sergiu Gatlan
- April 15, 2019
- 08:22 AM
- 0
Zero-Day TP-Link SR20 Router Vulnerability Disclosed by Google Dev

TP-Link's SR20 Smart Home Router is impacted by a zero-day arbitrary code execution (ACE) vulnerability which allows potential attackers on the same network to execute arbitrary commands as disclosed on Twitter by Google security developer Matthew Garrett.
- Sergiu Gatlan
- March 28, 2019
- 05:31 PM
- 0