ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Oct 16, 2026 · The Hacker News

    Critical OpenBSD Vulnerability Exploited Through Legacy Bug Chaining

    A newly discovered exploit demonstrates a local privilege escalation vulnerability in OpenBSD, leveraging a decades-old bug to bypass security measures.

    What changed

    Researchers have unveiled a local privilege escalation exploit affecting OpenBSD 7.9. This exploit successfully combines a 37-year-old integer overflow vulnerability with a recent kernel flaw, enabling attackers to gain root access.

    The exploit circumvents OpenBSD's advanced security features, including the KARL kernel-address randomization and hardware protections such as SMAP and SMEP.

    Who is affected

    The vulnerability primarily impacts users and organizations utilizing OpenBSD 7.9. The following groups should take immediate notice:

    System administrators and security teams managing OpenBSD environments must be vigilant.

    • OpenBSD users and administrators running version 7.9
    • Organizations relying on OpenBSD for critical infrastructure
    • Security professionals monitoring for privilege escalation threats

    What to do

    Affected parties should prioritize reviewing their OpenBSD installations for potential exploitation. Immediate actions include updating systems and monitoring for unusual activity.

    It is crucial to stay informed about further developments and patches released by the OpenBSD team.

    • Apply any available security patches from OpenBSD promptly.
    • Monitor system logs for signs of unauthorized access or privilege escalation.
    • Review security configurations to ensure compliance with best practices.

    Original report

  2. Oct 16, 2026 · Security Affairs

    F5 Patches Critical RCE Vulnerabilities in NGINX

    F5 has released critical patches for multiple RCE vulnerabilities in NGINX that could be exploited without authentication, emphasizing the need for immediate updates.

    What changed

    F5 Networks has addressed several vulnerabilities in its NGINX product, including two critical remote code execution (RCE) flaws. These vulnerabilities, identified as CVE-2026-15176 and CVE-2026-93479, can be exploited by attackers without requiring authentication, posing significant risks to affected systems.

    • The vulnerabilities allow unauthorized access to execute arbitrary code.
    • Exploitation can occur through specially crafted HTTP requests.
    • F5 has released updates to mitigate these vulnerabilities.

    Who is affected

    Organizations utilizing F5's NGINX products are at risk due to these vulnerabilities. The following groups should prioritize applying the latest patches:

    1. Enterprises relying on NGINX for application delivery and security.

    • F5 NGINX Plus users.
    • F5 NGINX Open Source users.
    • Organizations using NGINX in cloud environments.

    What to do

    It is critical for affected organizations to take immediate action to secure their systems. F5 recommends updating to the latest version of NGINX to mitigate the risks associated with these vulnerabilities.

    Regularly review security advisories from F5 and implement patches as they become available.

    • Apply the latest patches for NGINX immediately.
    • Monitor systems for any unusual activity that may indicate exploitation attempts.
    • Review and enhance security policies related to web application firewalls.

    Original report