ZeroDay Findings
Sign inSign up

Every 24 hours

Tech News

Original briefings on what changed in security. Each story has a small illustration matched to what it covers, a short structure, and links to the catalog records and public identifiers it discusses.

  1. Oct 14, 2026

    VBA Code Vulnerabilities Found in AutoCAD DWG Files

    Recent findings have highlighted a significant security concern involving orphaned Visual Basic for Applications (VBA) projects embedded within AutoCAD drawing files, commonly known as DWG files. These vulnerabilities, first noted in diary entries from years past, have resurfaced in discussions among cybersecurity professionals, raising alarms about the potential risks they pose to users and organizations reliant on AutoCAD for design and engineering tasks.

    What changed

    The presence of these orphaned VBA projects indicates that malicious actors could exploit the embedded code to execute unauthorized actions within the AutoCAD environment. This not only compromises the integrity of the design files but also poses a broader risk to the systems where these files are opened. Users who frequently interact with DWG files may unknowingly become victims of attacks that leverage these vulnerabilities, leading to data breaches or system compromises.

    Who is affected

    Organizations that utilize AutoCAD software should be particularly vigilant, as the implications of such vulnerabilities extend beyond individual users. The potential for widespread exploitation means that companies could face significant operational disruptions, financial losses, or reputational damage if they fail to address these issues promptly. Therefore, it is essential for IT departments and security teams to implement strict protocols for handling DWG files, including regular audits and security assessments.

    What it means

    As the threat landscape continues to evolve, the discovery of these orphaned VBA projects serves as a reminder of the importance of maintaining robust security practices in design and engineering software. Users are encouraged to stay informed about the latest vulnerabilities and to take proactive measures to safeguard their systems against potential exploitation.

  2. Oct 14, 2026

    Critical Vulnerability Discovered in WP SYNTEX Polylang Plugin

    A significant security vulnerability, identified as CVE-2026-97278, has been found in the WP SYNTEX Polylang plugin, which is widely used for multilingual content management in WordPress. This flaw, categorized as a deserialization of untrusted data issue, permits object injection, potentially allowing attackers to manipulate the application in harmful ways. The vulnerability impacts all versions of the Polylang plugin up to and including 3.8.9, making a substantial number of WordPress installations susceptible to exploitation.

    What changed

    Users of the Polylang plugin should take immediate action to assess their systems for the presence of this vulnerability. The nature of the flaw means that it can be exploited by malicious actors to execute unauthorized commands or access sensitive data, which could lead to further compromises within the affected WordPress sites. As Polylang is a popular tool among developers and content creators for managing multilingual sites, the risk of widespread impact is significant.

    Who is affected

    Website administrators are urged to update their Polylang plugin to the latest version that addresses this vulnerability. Failure to do so not only leaves the site exposed to potential attacks but also undermines the integrity and trustworthiness of the online presence. This incident highlights the ongoing need for vigilant monitoring and timely updates in the ever-evolving landscape of web security.

    What it means

    In light of this discovery, organizations utilizing the Polylang plugin should also review their overall security posture, including the implementation of security best practices and regular vulnerability assessments. The incident serves as a reminder of the importance of maintaining up-to-date software and being proactive in identifying and mitigating security risks in web applications.