An actively exploited zero-day in Adobe Reader allows data exfiltration through malicious PDF files. No user interaction beyond opening the file is required. Immediate mitigation measures available.
On April 3, 2026, researcher Nightmare-Eclipse published a fully functional Windows LPE exploit on GitHub with no Microsoft patch available. Any attacker with initial access can escalate to SYSTEM privileges.
Anthropic announces Project Glasswing and Claude Mythos Preview, an AI model capable of identifying and exploiting thousands of zero-days. Access restricted to ~40 organizations responsible for critical infrastructure security.
A critical pre-authentication flaw in FortiClient EMS 7.4.5-7.4.6 enables remote code execution. Exploited since March 31, added to CISA's KEV catalog on April 6, an emergency hotfix is available.
Microsoft Threat Intelligence documents Storm-1175, the first major Chinese actor linked to the Medusa ransomware. Targets: hospitals, education, and finance in Australia, the UK, and the USA. Less than 24 hours from initial access to encryption.
CVE-2026-20700 marks the first actively exploited Apple zero-day of 2026. Analysis of patch management obligations under NIS2 and DORA for enterprise Apple device fleets.
Google fixes CVE-2026-5281, a use-after-free in Dawn (WebGPU implementation) actively exploited in the wild. Chrome's 4th zero-day of 2026. All Chromium browsers affected.
CVE-2026-0625 (CVSS 9.8) affects end-of-life D-Link DSL routers. No patch will ever be released. Learn how to detect if you are exposed and what actions to take immediately.
UNC6201 (China) exploited CVE-2026-22769 (CVSS 10.0) in Dell RecoverPoint since mid-2024 without detection. Three malware strains deployed, root persistence achieved.
Analysis of CVE-2026-20131, a deserialization flaw in Cisco Secure Firewall Management Center. Maximum CVSS score, exploited by Interlock group since January 2026.
Technical analysis of CVE-2026-33017, a critical Langflow vulnerability allowing unauthenticated remote code execution. Exploited within 20 hours of disclosure.
Analysis of the March 2026 Patch Tuesday: 84 vulnerabilities patched by Microsoft, including 2 publicly disclosed zero-days, plus critical Chrome and Android fixes.