Zero-days

Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

CISA says max severity GitLab flaw now exploited in the wild

Hackers Exploit Ivanti Connect Secure Zero-Day Vulnerabilities to Gain Root Access and Steal Credentials

Oracle PeopleSoft zero-day exploited by ShinyHunters found to be three chained flaws

Researchers report that the critical PeopleSoft bug exploited by ShinyHunters since May is three chained flaws rather than one. Oracle patched them in June under a single identifier, CVE-2026-35273. The chain begins with a server-side request forgery that reaches an internal management interface because PeopleSoft trusts its own loopback address.

Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

Volt Typhoon Hackers Exploit Multiple Zero-Days to Breach U.S. Critical Infrastructure Networks

Chinese Hackers Exploit VMware ESXi Zero-Day to Target Law Firms in Cyber Espionage Attacks

Volt Typhoon used covert Silent Train relay network to exploit zero-days in management platforms, Lumen reports

Lumen's Black Lotus Labs reports that Volt Typhoon used an operational framework called Silent Train, first seen in November 2023, to chain compromised routers, devices and enterprise servers as covert relays. The framework supported four confirmed and one likely zero-day campaign against management platforms including N-central, Versa Director, Cisco Catalyst SD-WAN, VeloCloud Orchestrator and Quest KACE. Victims included telecommunications, satellite communications, defence-linked universities and essential service operators, with Hawaii, California and Texas repeatedly targeted. Lumen assesses the activity as positioning for possible Indo-Pacific crises rather than evidence of disruption.

Volt Typhoon hides zero-day attacks using 'Silent Train' framework

New Cisco firewall zero-day exploited to crash SSL VPN devices

Cisco warns of actively exploited ASA and FTD VPN flaw CVE-2026-76418

Cisco has patched CVE-2026-76418, a high-severity flaw (CVSS 8.6) in the remote access SSL VPN of Secure Firewall ASA and Threat Defense (FTD). An unauthenticated remote attacker can send a crafted request that forces a device reload, causing denial of service. The flaw is being exploited in the wild and has been added to CISA's KEV catalogue, with federal agencies required to remediate by 1 November 2026. Cisco urges immediate updating and offers a temporary mitigation of disabling secondary authentication on the tunnel group list or DefaultWEBVPNGroup.

CISA adds VMware ESX CVE-2026-41709 and Linux Fragnesia to KEV; China-linked Warp Panda exploited ESX flaw

CISA added VMware ESX CVE-2026-41709 (insufficient logging, CVSS 7.6) and Linux kernel CVE-2026-46300 (Fragnesia) to its KEV catalogue. CrowdStrike reports that Warp Panda exploited the ESX flaw as a zero-day in early 2026 to reduce audit log visibility. The Cyber Centre also flagged exploitation of a Siemens Software Center DLL sideloading flaw and Gitea vulnerabilities, and urged administrators to apply updates.

Volt Typhoon's Silent Train network tied to Cisco SD-WAN zero-day exploitation

Lumen's Black Lotus Labs attributes a covert access network called Silent Train to the China-nexus group Volt Typhoon. It was first identified in late 2023 and was used for zero-day exploitation and strategic access, using rotating chains of compromised SOHO, IoT and enterprise devices. Cisco Talos linked malware that steals keys from Cisco SD-WAN to infrastructure overlapping with this network, which has since been disrupted.

Critical PHP flaws CVE-2026-109618 and CVE-2026-109619 now exploited in the wild

Two memory-corruption flaws in PHP, CVE-2026-109618 (out-of-memory handling) and CVE-2026-109619 (use-after-free in global state), allow unauthenticated remote code execution via crafted HTTP requests, with the risk greatest for Apache modphp. CISA added both to its Known Exploited Vulnerabilities catalogue on 26 October 2026, and AWS advises upgrading rather than relying on configuration changes alone.