ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Jul 27, 2026 · ZeroDay Catalog

    Critical Deserialization Vulnerability in JetBrains TeamCity

    A critical deserialization vulnerability in JetBrains TeamCity has been disclosed, allowing potential command execution without authentication.

    What changed

    On July 27, 2026, JetBrains issued a security advisory regarding CVE-2026-63077, a critical vulnerability in TeamCity related to unsafe deserialization of untrusted data. This flaw allows attackers to exploit the agent polling protocol over HTTP or HTTPS, enabling them to execute operating system commands with the privileges of the TeamCity server process.

    Who is affected

    The vulnerability affects organizations using JetBrains TeamCity, particularly those with exposed servers accessible over the internet. Although JetBrains reported no known active exploitation at the time of disclosure, the situation changed when CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on August 5, 2026.

    • JetBrains TeamCity users with internet-facing servers.
    • Organizations relying on CI/CD pipelines that utilize TeamCity.
    • Development teams using JetBrains products in their workflows.
    • IT departments managing JetBrains TeamCity installations.

    What to do

    It is imperative for affected organizations to assess their exposure to this vulnerability and take immediate action to mitigate risks. JetBrains has likely provided patches or workarounds that should be implemented as soon as possible.

    • Review JetBrains' security advisory for CVE-2026-63077 for detailed guidance.
    • Apply any available patches to TeamCity installations promptly.
    • Restrict access to TeamCity servers to trusted networks only.
    • Monitor for any unusual activity or unauthorized access attempts.

    Original report

  2. Jul 27, 2026 · ZeroDay Catalog

    Critical OS Command Injection Vulnerability in Arista VeloCloud Orchestrator

    A significant OS command injection vulnerability has been identified in the Arista VeloCloud Orchestrator, potentially allowing remote attackers to exploit internal functionalities.

    What changed

    A serious OS command injection vulnerability has been discovered in the Arista VeloCloud Orchestrator (VCO) On-Prem version. This flaw could enable remote attackers to access privileged internal functionalities, posing a risk to the orchestrator's host system.

    The vulnerability threatens the confidentiality, integrity, and availability of both the orchestrator and the data it manages. It is critical to note that this functionality was designed for internal use and should not be accessible remotely.

    Who is affected

    The vulnerability impacts users of the Arista VeloCloud Orchestrator, specifically those utilizing the On-Prem version.

    Both the Hosted and Dedicated versions of VCO have been patched prior to this disclosure.

    • Arista Networks - Vendor responsible for VeloCloud Orchestrator.
    • Organizations using the On-Prem version of VCO.
    • IT departments managing network orchestration tools.
    • Any entity relying on VCO for data management and orchestration.

    What to do

    Immediate action is required to mitigate the risks associated with this vulnerability. Users of the affected VCO version should ensure they are running the latest patched version.

    It is advisable to review security configurations and restrict access to the orchestrator to prevent unauthorized exploitation.

    • Update to the latest version of Arista VeloCloud Orchestrator.
    • Implement strict access controls to the orchestrator.
    • Monitor network traffic for any signs of exploitation attempts.
    • Stay informed on further updates from Arista regarding this vulnerability.

    Original report