ZeroDay Findings
Sign inSign up

Every 24 hours

Tech News

Original briefings on what changed in security. Each story has a small illustration matched to what it covers, a short structure, and links to the catalog records and public identifiers it discusses.

  1. Oct 9, 2026

    AWS WAF Vulnerabilities Exposed: CVE-2026-13762 and CVE-2026-13763

    Recent vulnerabilities identified in AWS Web Application Firewall (WAF) have raised significant concerns among users and security professionals. The vulnerabilities, cataloged as CVE-2026-13762 and CVE-2026-13763, pertain to the inspection of multi-frame request bodies in HTTP/2. This issue could potentially allow attackers to bypass security measures, making it crucial for organizations utilizing AWS WAF to be aware of the risks involved.

    What changed

    The vulnerabilities affect a broad range of AWS WAF users, particularly those relying on the service for web application protection against various threats. With the increasing adoption of HTTP/2 for its performance benefits, the implications of these vulnerabilities could be extensive, affecting the overall security posture of applications deployed on AWS.

    Who is affected

    Organizations that depend on AWS WAF must take immediate action to evaluate their configurations and ensure that they are not inadvertently exposing their applications to risks associated with these vulnerabilities. This includes reviewing their security policies and potentially implementing additional layers of security to mitigate the risks until a patch or update is available.

    What it means

    As cloud services continue to evolve, the discovery of such vulnerabilities highlights the importance of continuous monitoring and incident response planning. Companies must remain vigilant in maintaining their security measures and adapting to emerging threats in the cloud landscape. The AWS community is encouraged to stay updated on any announcements regarding fixes or workarounds for these vulnerabilities to safeguard their applications effectively.

  2. Oct 7, 2026

    Teenager Arrested in Connection with ShinyHunters Extortion Case

    A significant development has emerged in the ongoing investigation into the ShinyHunters hacking group, known for its extensive data theft and extortion activities. Authorities have apprehended a teenager from Amman, Jordan, who is suspected of being a key figure in this notorious group. The individual, known by the hacker alias "Rey," is currently cooperating with the FBI to help identify other members of the organization. This arrest comes at a crucial time as ShinyHunters was reportedly in the midst of extorting a recently divested business unit of Boeing, a major player in the aerospace industry.

    What changed

    The implications of this arrest are far-reaching, particularly for the aviation sector, as the extortion attempt targeted a company closely linked to Boeing. The fact that the suspect's father works for Royal Jordanian Airlines adds a personal dimension to the case, highlighting the intricate connections between individuals and the organizations they target. This incident underscores the ongoing threats faced by enterprises in various sectors, especially those dealing with sensitive data.

    Who is affected

    As the investigation unfolds, the cooperation of the arrested teenager with law enforcement could lead to further insights into the operations of ShinyHunters and potentially reveal the identities of other members involved in the group. This could prove beneficial in mitigating future threats posed by similar hacking organizations. The aviation industry, along with other sectors vulnerable to cyber extortion, may need to reevaluate their security measures in light of these developments.

    What it means

    The ShinyHunters group has gained notoriety for its aggressive tactics and ability to breach numerous organizations, resulting in significant data leaks and financial losses. With this arrest, there is hope that authorities can dismantle the group's operations and prevent further extortion attempts. As companies increasingly rely on digital systems, the need for robust cybersecurity measures becomes ever more critical to safeguard against such threats.