A critical vulnerability (CVE-2026-42530) has been discovered in NGINX’s HTTP/3 implementation that allows unauthenticated attackers to trigger denial-of-service conditions and potentially achieve remote code execution. The flaw affects NGINX versions 1.25.0 through 1.26.3 with HTTP/3 enabled, stemm
Microsoft has officially confirmed a critical zero-day vulnerability dubbed “RoguePlanet” affecting Microsoft Defender across multiple Windows versions. The flaw allows attackers to bypass real-time protection and execute malicious code without detection. Active exploitation has been observed in the
Microsoft and Adobe have issued a historic combined total of 331 security vulnerabilities in their June 2026 Patch Tuesday release—the largest security update drop ever recorded. Microsoft addressed 208 CVEs affecting Windows, Office, Azure, and other products, including 15 zero-days and 8 actively
Microsoft has officially confirmed a critical zero-day local privilege escalation (LPE) vulnerability in the Microsoft Malware Protection Engine, designated as CVE-2026-50656. Codenamed “RoguePlanet,” the flaw allows a local attacker to execute a timing-based race condition exploit. If successful, this exploit bypasses active security controls to escalate user privileges to NT AUTHORITY\SYSTEM. The underlying Proof-of-Concept (PoC)…
A critical zero-day vulnerability in the LiteSpeed Cache plugin for cPanel has been actively exploited in the wild, allowing attackers to gain unauthorized administrative access to WordPress websites. The vulnerability, affecting thousands of hosting environments worldwide, enables privilege escalat
Cisco SD-WAN infrastructure is under active attack from a critical zero-day vulnerability that grants attackers root-level access to vulnerable systems. The flaw, affecting multiple SD-WAN components, is being actively exploited in the wild before patches are available. Organizations running Cisco S
Cisco has released emergency patches for a critical zero-day vulnerability (CVE-2025-20132) in its SD-WAN vManage software that attackers are actively exploiting. The flaw allows unauthenticated remote code execution with root privileges on affected systems. Organizations running Cisco SD-WAN deploy
Google has released an emergency security update for Chrome to address CVE-2026-11645, a high-severity use-after-free vulnerability in the V8 JavaScript engine actively exploited in the wild. The zero-day affects all major platforms (Windows, macOS, Linux) and enables remote code execution through m
A critical zero-day vulnerability in Oracle PeopleSoft has been actively exploited in the wild, affecting hundreds of organizations globally. Attackers leveraged this previously unknown flaw to exfiltrate gigabytes of sensitive data from enterprise systems, including HR records, financial informatio
Notorious cybercrime group ShinyHunters is actively exploiting a critical zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft applications, targeting enterprise HR and financial systems worldwide. The authentication bypass flaw allows attackers to gain unauthorized access to sensitive emplo