Apple Patched CVE-2026-86950: Which iPhones and Macs Still Need the Fix?
Apple patched a CoreGraphics code-execution flaw and says it may have been used in targeted attacks. Identify affected devices, install the right update, and verify the result.
Zero-Day
9 articles
Microsoft's 974-CVE Patch Tuesday: Fix the Exploited Paths, Not the Headline
Microsoft's September 2026 release lists 974 Microsoft CVEs, including two Windows privilege-escalation flaws in CISA KEV. A known RDS regression makes staged, risk-based deployment more important—not less urgent.
Chrome CVE-2026-85046: Updating Is Easy. Proving Every Browser Updated Is Not
Google says an exploit for CVE-2026-85046 exists in the wild. Defenders need to deploy Chrome 152.0.7977.82 or .83 and verify the running version across managed and unmanaged endpoints.
SonicWall SMA1000 Zero-Day Chain: Patch It, Then Assume It Was Breached
CVE-2026-83548 and CVE-2026-83549 are being exploited against SonicWall SMA1000 appliances. Patching closes the flaws, but exposed gateways still need compromise assessment and credential recovery.
Exploited Before the PoC Existed: CVE-2026-46817 in Oracle Payments
A critical, unauthenticated flaw in Oracle E-Business Suite's Payments module was hit in the wild on June 27, 2026 — six weeks after the patch, with no public exploit code anywhere. Here's what's confirmed, what's still speculation, and how to check if you're exposed.
ShinyHunters Were Inside Two Weeks Before Oracle Noticed
A critical, unauthenticated RCE in Oracle PeopleSoft let ShinyHunters compromise universities and other organizations for weeks before Oracle's advisory caught up. Google notified 100+ potentially exposed organizations. The technical breakdown, IOCs, and what to hunt for.
RoguePlanet: Nightmare Eclipse's New Windows Defender LPE PoC After the June 2026 Patch
RoguePlanet is the latest public Nightmare Eclipse proof-of-concept targeting Microsoft Defender. The code points to a race condition that turns Defender cleanup behavior into SYSTEM execution.
YellowKey: The BitLocker Bypass Hidden in Windows Recovery
A researcher discovered a zero-day that bypasses BitLocker encryption on Windows 11 using a USB stick and the recovery environment — and suspects the component may be intentional. CVE-2026-45585, CVSS 6.8. Microsoft released an official mitigation on May 21, 2026.
CVE-2026-42897: Exchange Server Zero-Day Executes JavaScript Through Your Inbox
Microsoft's on-prem Exchange Server has an actively exploited XSS zero-day (CVSS 8.1). A single crafted email in OWA triggers arbitrary JavaScript — here's how it works and how to stop it.