ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Aug 6, 2026 · HackRead

    Critical GitHub Workflow Vulnerabilities Discovered at Black Hat USA 2026

    Significant vulnerabilities in GitHub workflows were revealed, posing risks to major AI coding environments and potentially leading to remote code execution and credential theft.

    What changed

    During the Black Hat USA 2026 conference, security researcher Novee disclosed critical vulnerabilities in GitHub workflows that could severely impact AI development environments. These flaws allow for remote code execution (RCE), credential theft, and unauthorized control over agents within coding pipelines.

    • Discovery of vulnerabilities affecting major AI coding tools.
    • Potential for attackers to exploit these flaws for malicious purposes.
    • Increased scrutiny on GitHub workflows in enterprise settings.

    Who is affected

    The vulnerabilities identified pose a risk to various stakeholders in the AI development community, particularly those utilizing specific tools and workflows.

    Organizations relying on AI coding tools should be particularly vigilant.

    • Users of Claude Code, a prominent AI coding assistant.
    • Developers employing Gemini CLI for command-line interactions.
    • Teams utilizing Codex for code generation and assistance.
    • Enterprises that integrate these tools into their development pipelines.

    What to do

    Organizations should immediately review their GitHub workflows and assess the potential impact of these vulnerabilities. Implementing security best practices is crucial to mitigate risks.

    Regular updates and patches should be applied to all affected tools and workflows.

    • Conduct a security audit of GitHub workflows in use.
    • Ensure that all AI coding tools are updated to the latest versions.
    • Educate development teams on secure coding practices and the importance of monitoring for vulnerabilities.

    Original report

  2. Aug 5, 2026 · HackRead

    Kali365 Exploits Microsoft Device Login to Access US Corporate Data

    Kali365 has been identified exploiting Microsoft device login mechanisms to compromise OAuth tokens, posing a significant risk to US corporations.

    What changed

    Recent findings reveal that Kali365 has been leveraging vulnerabilities in Microsoft device login processes to obtain OAuth tokens. This exploitation allows attackers to gain unauthorized access to sensitive corporate data, particularly targeting organizations in the United States.

    The implications of this activity are severe, as it not only compromises individual accounts but also potentially exposes entire corporate networks to further attacks.

    • Exploitation of Microsoft device login mechanisms.
    • Unauthorized access to OAuth tokens.
    • Targeting of US corporate data.

    Who is affected

    Organizations utilizing Microsoft device login for authentication are at risk. This includes various sectors such as finance, healthcare, and technology, which often rely on OAuth for secure access.

    Additionally, any company that has integrated Microsoft services into their operations may be vulnerable to these phishing attacks.

    • US corporations using Microsoft device login.
    • Financial institutions relying on OAuth tokens.
    • Healthcare organizations with sensitive data.
    • Technology firms integrating Microsoft services.

    What to do

    Security Operations Center (SOC) teams should enhance their monitoring and detection capabilities to identify signs of unauthorized access stemming from these exploits. Implementing multi-factor authentication (MFA) can also mitigate risks associated with compromised OAuth tokens.

    Regular training on phishing awareness for employees is crucial to reduce the likelihood of successful attacks.

    • Enhance monitoring for unauthorized access attempts.
    • Implement multi-factor authentication (MFA).
    • Conduct regular phishing awareness training for employees.
    • Review and strengthen incident response protocols.

    Original report