Vulnerabilities
An exploited type confusion in the V8 JavaScript engine tracked as CVE-2025-10585 was found by Google Threat Analysis Group this week.
Hi, what are you looking for?
SecurityWeek
All posts tagged "Zero-Day"
Mobile & Wireless
Reported by Meta and WhatsApp, the vulnerability leads to remote code execution and was likely exploited by a spyware vendor.
Vulnerabilities
Google has observed ViewState deserialization attacks leveraging a sample machine key exposed in older deployment guides.
Mobile & Wireless
Elevation of privilege flaws in Android Runtime (CVE-2025-48543) and Linux kernel (CVE-2025-38352) have been exploited in targeted attacks.
Vulnerabilities
The vulnerability (CVE-2025-55177) was exploited along an iOS/macOS zero-day in suspected spyware attacks.
Cloud Security
Silk Typhoon was seen exploiting n-day and zero-day vulnerabilities for initial access to victim systems.
Vulnerabilities
Apple has rolled out iOS and macOS updates that resolve a zero-day vulnerability exploited in highly targeted attacks.
Vulnerabilities
Elastic has found no evidence of a vulnerability leading to RCE after details and PoC of a Defend EDR bypass were published online.
Vulnerabilities
More than 870 N-able N-central instances have not been patched against CVE-2025-8875 and CVE-2025-8876, two exploited vulnerabilities.
Nation-State
WinRAR has patched CVE-2025-8088, a zero-day exploited by Russia’s RomCom in attacks on financial, defense, manufacturing and logistics companies.
Vulnerabilities
Trend Micro has rushed to fix two Apex One zero-days that may have been exploited by Chinese threat actors.
Vulnerabilities
Threat actors might be exploiting a zero-day vulnerability in SonicWall firewalls in a fresh wave of ransomware attacks.
Malware & Threats
Microsoft says the Chinese threat actors Linen Typhoon, Violet Typhoon, and Storm-2603 have been exploiting the ToolShell zero-days.
Malware & Threats
More details emerged on the ToolShell zero-day attacks targeting SharePoint servers, but confusion remains over the vulnerabilities.
Vulnerabilities
Microsoft has started releasing updates to fix the exploited SharePoint zero-days tracked as CVE-2025-53770 and CVE-2025-53771.
Vulnerabilities
Hackers are exploiting a zero-day vulnerability in CrushFTP to gain administrative privileges on vulnerable servers via HTTPS.
Vulnerabilities
Google has released a Chrome 138 security update that patches a zero-day, the fifth resolved in the browser this year.
Vulnerabilities
Google has released a Chrome 138 update that patches a high-severity vulnerability with an exploit in the wild.
Vulnerabilities
Citrix has released patches for a critical vulnerability in NetScaler ADC and NetScaler Gateway exploited as a zero-day.
Vulnerabilities
WhatsApp told SecurityWeek that it linked the exploited FreeType vulnerability CVE-2025-27363 to a Paragon exploit.
Vulnerabilities
CISA added CVE-2026-65660 to its KEV catalog, giving federal agencies a patching deadline of September 28.
Artificial Intelligence
Email Security
Artificial Intelligence
Artificial Intelligence
The US and China agreed to set up a communication mechanism for artificial intelligence-related incidents.
Malware & Threats
Artificial Intelligence
