ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Oct 16, 2026 · CSO Online

    Critical Vulnerability in Linux Kernel Allows VM Escape

    A severe flaw in the Linux kernel has been patched, preventing potential guest-to-host escape attacks that could compromise system integrity.

    What changed

    The Linux kernel has been updated to address a critical vulnerability tracked as CVE-2026-99999, which allowed attackers to escape from a virtual machine (VM) to the underlying host. This flaw, known as PwnEscape, involved manipulating packet metadata to alter an IPv4 header after processing, potentially leading to host-level code execution.

    • The vulnerability was discovered during Vercel’s Sandbox security challenge.
    • The issue was classified as the most severe finding reported in the challenge.
    • The flaw has now been resolved with multiple stable-branch fixes released.

    Who is affected

    Organizations utilizing affected versions of the Linux kernel in their virtualized environments may be at risk. The vulnerability primarily impacts those running specific kernel versions.

    • Users of Linux kernel versions 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, and 7.2.
    • Cloud service providers using virtualization technologies based on the Linux kernel.
    • Developers and researchers participating in sandbox environments like Vercel's.

    What to do

    It is imperative for affected organizations to update their Linux kernel to the latest patched versions to mitigate the risk associated with this vulnerability. Regular monitoring for security updates and vulnerabilities is also recommended.

    • Upgrade to the latest stable versions of the Linux kernel as specified in the NVD.
    • Review and enhance security measures for virtualized environments.
    • Stay informed about future vulnerabilities and participate in security challenges to test system defenses.

    Original report

  2. Aug 17, 2026 · ZeroDay Catalog

    Critical Server-Side Request Forgery Vulnerability in MLflow

    A server-side request forgery vulnerability has been identified in MLflow versions prior to 3.15.0, potentially exposing sensitive internal services.

    What changed

    A server-side request forgery (SSRF) vulnerability was discovered in MLflow, affecting versions from 3.3.0 up to 3.14.0. The vulnerability arises from the handling of webhook URLs, which allows unauthorized users to exploit the system and access internal or cloud metadata services.

    The issue was addressed in version 3.15.0, which mitigates the risk by ensuring that the validated address is pinned and not subject to redirection.

    Who is affected

    Organizations utilizing MLflow for AI engineering and machine learning model management are at risk, particularly those running versions prior to 3.15.0.

    The vulnerability could impact any deployment of MLflow that uses the affected webhook endpoint, potentially exposing sensitive internal services.

    • MLflow users on versions 3.3.0 to 3.14.0
    • Organizations leveraging MLflow for AI and machine learning projects
    • Developers integrating MLflow with internal systems or cloud services

    What to do

    It is imperative for users of MLflow to upgrade to version 3.15.0 or later to mitigate the SSRF vulnerability. This update will ensure that the system is protected against unauthorized access to internal services.

    Additionally, organizations should review their webhook configurations and monitor for any unusual access patterns that may indicate exploitation attempts.

    • Upgrade MLflow to version 3.15.0 or later immediately.
    • Review and secure webhook configurations to prevent unauthorized access.
    • Monitor system logs for any suspicious activity related to webhook endpoints.

    Original report