Vulnerabilities
Microsoft's October 2026 Patch Tuesday Sets Record with 1,411 CVEs
Microsoft released a record 1,411 CVEs in October 2026, including three actively exploited zero days, driven by AI-powered scanning.
Latest Cybersecurity news
Vulnerabilities
Critical Ghostscript flaw enables remote code execution via PDF uploads
CVE-2026-39919, a heap buffer overflow in Ghostscript versions 9.21 through 10.07.1, allows unauthenticated remote code execution when processing malicious PDFs, impacting systems like WordPress and Wikipedia.
Threats
Ivanti Connect Secure zero-day chain exploited by UTA0576
Threat actor UTA0576 chained three zero-day flaws, including an unpatched privilege escalation, to achieve unauthenticated root access on fully patched Ivanti Connect Secure VPN appliances starting October 3, focusing on credential theft and network reconnaissance.
Vulnerabilities
Norway fines Microsoft's Xandr $9.6 million for Grindr data breach
Norway's Data Protection Authority has fined Microsoft-owned advertising firm Xandr $9.6 million for unlawfully processing and sharing sensitive Grindr user data in real-time ad auctions.
Incidents
Danfoss Refrigeration Controller Cyberattack Hits French Supermarkets
A cyberattack on October 11 compromised legacy Danfoss refrigeration controllers, raising temperatures to 50°C in hundreds of French supermarkets and forcing massive food spoilage.
More to read
Briefings
News
P7 DarkSword iOS variant steals keychain, crypto wallets
iVerify discovered a new P7 DarkSword variant in August 2026 that extracts keychain and cryptocurrency wallet data on the device and establishes two-way command-and-control communication.
Vulnerabilities
Google details DNS hijack of three ccTLDs for unauthorized certificates
Attackers hijacked the DNS for three country-code top-level domains to obtain 32 unauthorized HTTPS certificates for Google and other major organizations.
Vulnerabilities
Pwn2Own Ireland 2026 reveals six Samsung Galaxy S26 zero-day hacks
Security researchers earned $232,500 exploiting 45 zero-days on day two of Pwn2Own Ireland 2026, with Samsung's flagship phone hacked six times in 48 hours, highlighting critical vulnerabilities before patches.
Vulnerabilities
U.S. offers $10 million reward for Chinese national Zhang Yu
The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, charged in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM.
Regulation & compliance
Google blocks unauthorized certificates from DNS hijack of .gh, .sl and .as domains
Attackers hijacked three country-code top-level domains to obtain fraudulent HTTPS certificates for Google and YouTube.
Vulnerabilities
Anthropic expands Cyber Verification Program with reduced AI safeguards
Anthropic has expanded its Cyber Verification Program, offering vetted cybersecurity professionals reduced safeguards on advanced AI models like Claude Opus 5.5 for vulnerability discovery. The move follows Project Glasswing's identification of over 129,000 verified software vulnerabilities.
Profiles
Actively Exploited Cves
Actively exploited in the wild
Application Allowlisting
Application Allowlisting · Application Whitelisting
Asset Inventory And Finding Shadow It
Security control failure · Enterprise IT security and governance
Attacks On Managed Service Providers
Attacks on Managed Service Providers · MSPs and their clients
Australia
Australia · Vulnerability
Backup And Recovery That Survives Ransomware
Recall · CVE-2024-30051
Backup And Storage
Backup And Storage · CWE-530
Banking And Real Time Payment Systems
Banking and real-time payment... · Social engineering, credential theft, or...
Data and guides
Also this week
News
FBI Top 10 Cybercriminal Aguirre Faces U.S. ATM Jackpotting Charges
Anibal Alexander Canelon Aguirre, the first cybercriminal on the FBI's Top 10 Most Wanted list, is in U.S. custody to face charges for masterminding the Ploutus ATM malware scheme that funded the Tren de Aragua terrorist group.
Vulnerabilities
LibreOffice patches critical Java-based spreadsheet flaw
LibreOffice and Apache OpenOffice contain a critical vulnerability allowing malicious spreadsheets to execute arbitrary Java code without macro warnings.
Vulnerabilities
GitHub and Microsoft launch ReviewBench AI code review benchmark
GitHub and Microsoft have released ReviewBench, an open benchmark for evaluating AI code review tools using 219 real-world pull requests.
Vulnerabilities
ClingSTUN malware exploits 24 IoT flaws via STUN protocol
A new Linux backdoor named ClingSTUN hijacks internet-facing IoT devices by exploiting two dozen known, unpatched vulnerabilities.
Vulnerabilities
Windows 11 KB5124010 update crashes apps using AC-3 audio
Microsoft confirms the optional September 2026 KB5124010 preview update for Windows 11 causes crashes in some games and applications that use AC-3 audio decoding.
Incidents
Ofqual statistics show school cyber incidents falling to 27%
New Ofqual data reveals the proportion of UK schools hit by cyber incidents has fallen to 27%, while two-thirds can now recover immediately from attacks.
Browse sections
Common questions
What does Zero Day Room cover?
The vulnerability or campaign, and the patch or control that stops it, with an Asian regional focus. Vulnerabilities and Threats hold the offensive side as reported, Defence holds the mitigations, Regulation & compliance covers the legal duties, and Incidents follows breaches as they are disclosed.
Do you publish exploit code?
No. Coverage is defensive: pieces describe what has been disclosed, what is affected and what the vendor or advisory recommends, without proof of concept code or step by step exploitation.
Where do the advisories come from?
From vendor advisories, national cyber agencies, researchers and named publications, credited and linked in each piece. Severity ratings belong to whoever assigned them, and the vendor's own advisory is the version to patch against.
Is an incident reported here confirmed?
Only as far as the source says. Attribution and breach scope change repeatedly in the days after disclosure, and a piece reports who claimed what rather than settling it. Attacker claims are reported as claims.
Why is the source credited instead of a writer?
Nobody is bylined. Pieces are written with automated assistance from the source material, and the advisory or publication behind them is credited in place of an author.
How quickly does the site update?
As the sources publish, which for a widely exploited flaw means several pieces in a day as details change. Anything you are acting on should be checked against the current advisory rather than the summary.