ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Aug 25, 2026 · ZeroDay Catalog

    Critical Code Injection Vulnerability Discovered in Gitea

    A significant code injection vulnerability has been identified in Gitea, affecting its diffpatch API endpoint and allowing potential execution of arbitrary commands.

    What changed

    Gitea has been found to contain a critical code injection vulnerability that can be exploited by attackers with write access to repositories. This flaw allows for the submission of malicious patches to the diffpatch API endpoint, which can lead to the execution of arbitrary shell commands under the Gitea service account.

    • Vulnerability allows execution of arbitrary commands.
    • Exploitable via malicious patches sent to the diffpatch API.
    • Impacts the integrity and security of the Gitea service.

    Who is affected

    The vulnerability primarily affects users of Gitea, particularly those who have granted repository write access to untrusted contributors. Organizations using this platform should be aware of the potential risks associated with this vulnerability.

    • Gitea users with repository write access.
    • Organizations relying on Gitea for version control.
    • Developers and teams utilizing Gitea for collaborative projects.

    What to do

    It is crucial for affected organizations to assess their Gitea installations and restrict write access to trusted users only. Additionally, monitoring for any unusual activity related to repository changes is recommended.

    • Limit repository write access to trusted contributors.
    • Monitor repository activity for signs of exploitation.
    • Stay informed on updates from Gitea regarding patches or mitigations.

    Original report

  2. Aug 19, 2026 · ZeroDay Catalog

    Critical Authentication Bypass Vulnerability in Citrix NetScaler Products

    A critical authentication bypass vulnerability has been identified in Citrix NetScaler ADC and Gateway, allowing remote exploitation by unauthenticated attackers.

    What changed

    On August 19, 2026, Citrix published a security advisory addressing CVE-2026-19490, a severe authentication bypass vulnerability in its NetScaler ADC and NetScaler Gateway products. This vulnerability has a CVSS v4.0 base score of 9.3, indicating its critical nature and potential impact.

    • The vulnerability allows remote exploitation without user interaction.
    • Unauthenticated attackers can bypass authentication mechanisms.
    • The issue is particularly concerning due to the common deployment of these products at network perimeters.

    Who is affected

    Organizations utilizing Citrix NetScaler ADC and NetScaler Gateway are at risk due to this vulnerability. Given the widespread use of these products, the potential for exploitation is significant.

    • Enterprises relying on Citrix NetScaler for application delivery and load balancing.
    • Organizations with NetScaler Gateway for secure remote access.
    • Any network infrastructure positioned near the perimeter using these products.

    What to do

    Immediate action is required to mitigate the risks associated with CVE-2026-19490. Administrators should prioritize patching affected systems and reviewing security configurations.

    • Apply the latest security updates provided by Citrix as soon as possible.
    • Review and enhance network perimeter security measures.
    • Monitor for unusual activity that may indicate exploitation attempts.

    Original report