VMware ESXi zero-days likely exploited a year before disclosure

Chinese-speaking threat actors used a compromised SonicWall VPN appliance to deliver a VMware ESXi exploit toolkit that seems to have been developed more than a year before the targeted ...
HotHardware

CrushFTP Zero-Day Exploit Leaves Thousands Of Servers Vulnerable To Hijacking

CrushFTP, a service that provides users with secure file server software, has recently been targeted by hackers. Unfortunately, it seems as if some customers have been compromised, with thousands of ...
Hosted on MSN

Russia's RomCom among those exploiting a WinRAR 0-day in highly-targeted attacks

Russia-linked attackers found and exploited a high-severity WinRAR vulnerability before the maintainers of the Windows file archiver issued a fix.… The bug, tracked as CVE-2025-8088, is a ...
Dark Reading

2 Android Zero-Day Bugs Under Active Exploit

Google has patched 62 vulnerabilities in Android, including two zero-days that are actively being exploited in attacks, tracked as CVE-2024-53197 and CVE-2024-53150. CVE-2024-53197 is a privilege ...
PC World

Update Chrome now! Your PC is at risk from this zero-day exploit

Another major flaw has been found in Chrome—and it’s already being exploited in the wild. First discovered by Google’s Threat Analysis Group on May 27th, this zero-day vulnerability allows attackers ...
Dark Reading

Cyberattackers Exploit Zimbra Zero-Day Via ICS

An unknown threat actor masquerading as the Libyan Navy's Office of Protocol targeted the Brazilian military earlier this year using a malicious calendar (ICS) file to deliver an exploit for a then ...
Forbes

Microsoft Worm Attack Warning — Act Rapidly And Change Passwords Now

Forbes contributors publish independent expert analyses and insights. Davey Winder is a veteran cybersecurity writer, hacker and analyst. Updated December 13 with news of a zero-day exploit that ...
Benzinga.com

Lazarus Hackers Exploit Zero-Day Vulnerability in Chrome Using Fake NFT Games

Cybersecurity giant Kaspersky has uncovered a highly sophisticated crypto-targeted malicious campaign, led by the North Korean threat actor group Lazarus. Unveiled on Wednesday, the Lazarus Group ...
Forbes

Samsung Spyware Attack — Critical Landfall 0-Day Exploited

Landfall spyware attacks targeted Samsung smartphones. Updated November 9 with a statement and advice from Meta regarding the potential WhatsApp connection as mentioned in the Landfall Samsung spyware ...
CSOonline

Russian APT RomCom combines Firefox and Windows zero-day flaws in drive-by exploit

The no-click exploit launched in October infected computers in Europe and North America with the RomCom backdoor when victims were redirected through attacker-controlled websites. A Russia-aligned ...
HotHardware

Microsoft Fixes Six Actively-Exploited 0-Day Flaws In Patch Tuesday Rollout, Update ASAP

This month's Microsoft Patch Tuesday is here and it's a big one. Last month fixed 63 vulnerabilities. This month's update, however, includes patches for another 57 security vulnerabilities, six of ...