ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Aug 10, 2026 · ZeroDay Catalog

    Critical SQL Injection Vulnerability Discovered in Metabase

    A significant SQL injection vulnerability has been identified in Metabase, allowing remote attackers to gain unauthorized access to sensitive data.

    What changed

    A critical SQL injection vulnerability has been discovered in the Metabase application. This flaw enables unauthenticated remote attackers to execute arbitrary SQL commands on the Metabase database, potentially leading to severe security breaches.

    Exploitation of this vulnerability could allow attackers to gain administrator access, modify application settings, and extract sensitive information from connected databases.

    Who is affected

    The vulnerability primarily impacts users of the Metabase application, particularly those who have not implemented sufficient security measures.

    Organizations utilizing Metabase for data analytics and business intelligence are at risk, especially if they expose the application to the internet without proper access controls.

    • Metabase users and administrators.
    • Organizations leveraging Metabase for data visualization.
    • Businesses with sensitive data connected to Metabase.

    What to do

    Immediate action is recommended for all Metabase users to mitigate the risks associated with this vulnerability. Users should review their configurations and apply necessary security measures.

    Consider restricting access to the Metabase application and implementing robust authentication mechanisms to prevent unauthorized access.

    • Audit current Metabase configurations for security weaknesses.
    • Implement strict access controls to limit exposure.
    • Regularly update Metabase to the latest version to ensure vulnerabilities are patched.

    Original report

  2. Aug 6, 2026 · HackRead

    Critical Vulnerabilities Discovered in TP-Link Products at Black Hat USA 2026

    Forescout has revealed multiple vulnerabilities in TP-Link products that could compromise Omada credentials and expose sensitive camera feeds.

    What changed

    During the Black Hat USA 2026 conference, Forescout disclosed a series of 15 vulnerabilities affecting TP-Link products. These flaws have the potential to expose sensitive information such as Omada credentials and VPN keys, leading to unauthorized internal access.

    Additionally, the vulnerabilities could impact VIGI camera feeds, raising concerns about the security and privacy of surveillance data.

    Who is affected

    Organizations utilizing TP-Link's Omada controllers and VIGI cameras are at significant risk due to these vulnerabilities. The flaws could lead to unauthorized access and data breaches.

    Users of TP-Link's networking equipment and services should be particularly vigilant, as the vulnerabilities may allow attackers to gain internal network access.

    • TP-Link Omada Controllers
    • TP-Link VIGI Cameras
    • Organizations relying on TP-Link networking solutions
    • Businesses with remote access configurations using TP-Link products

    What to do

    Security teams should prioritize assessing their TP-Link deployments for the disclosed vulnerabilities. Immediate action is recommended to mitigate potential risks.

    Updating firmware and applying security patches as they become available will be crucial in protecting against exploitation.

    • Review and update TP-Link device firmware promptly.
    • Implement network segmentation to limit access to vulnerable devices.
    • Monitor network traffic for unusual activity that may indicate exploitation attempts.
    • Educate staff on security best practices related to device management and access controls.

    Original report