Vulnerabilities, zero-days and active exploitation.

CVE & Exploits · 6d ago

AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day

PortSwigger says HTTP Terminator, an artificial intelligence (AI)-assisted research system built by James Kettle,…

CVE & Exploits · 6d ago

Researcher Claims Control of ChatGPT Secure Sandbox

A researcher demonstrated a proof-of-concept attack chain that provided C2-style influence over ChatGPT's isolated…

CVE & Exploits · Aug 6, 2026

New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts

Zapscape, a new Linux kernel vulnerability, could allow an attacker with kernel privileges inside an L1 guest virtual…

CVE & Exploits · Aug 6, 2026

Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.9 CVSS Score Bugs

Cisco has rolled out updates to address multiple critical security vulnerabilities impacting Catalyst SD-WAN and IOS XE…

CVE & Exploits · Aug 6, 2026

Toolkit Hidden Inside Oracle Database Evades Endpoint Tools

Attackers used SQL injection to compile a post-exploitation toolkit inside an Oracle database

CVE & Exploits · Aug 6, 2026

ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories

Apparently, opening the thing is now enough. A repo can run before the first prompt, a package can hide among hundreds,…

CVE & Exploits · Aug 6, 2026

Meta Joins OpenAI and Anthropic in Reporting AI Exploit Incident

One of Meta’s AI models exploited a third-party security flaw during an evaluation, the latest in a series of similar…

CVE & Exploits · Aug 6, 2026

AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory

A new class of prompt injection is spreading across commercial websites. It requires no malware, no stolen credentials,…

CVE & Exploits · Aug 6, 2026

Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access

Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application,…

CVE & Exploits · Aug 5, 2026

Flaws in Google APK for Python Unlock Agent-to-Agent Attack

Google has fixed the issues, which exploited a trust boundary between two AI agents with different privilege levels to…

CVE & Exploits · Aug 4, 2026

Attackers Exploit N-able Patch Bypass Flaw on RMM Servers

Over the weekend, the vendor discovered another vector of authentication bypass CVE-2026-18577 that gives attackers…

CVE & Exploits · Aug 3, 2026

China-Linked Threat Actors Weaponize New Vulnerabilities in Under a Day

Chinese actors exploited the critical React2Shell exploit inside a day, while 88% of exploited vulnerabilities in H1…