ZeroDay Findings
Sign inSign up

Every 24 hours

Tech News

Original briefings on what changed in security. Each story has a small illustration matched to what it covers, a short structure, and links to the catalog records and public identifiers it discusses.

  1. Oct 14, 2026

    AI-Powered Pentesting Uncovers Major Authentication Vulnerability in Insurer's Website

    A recent security assessment conducted by an AI pentesting agent has revealed a significant authentication vulnerability on the production website of a major insurance provider. The flaw, identified as a critical one-time passcode (OTP) bypass, allows users to dictate the destination of their sign-in codes. This discovery highlights the potential for exploitation, as attackers could easily leverage this weakness to gain unauthorized access to user accounts.

    What changed

    The vulnerability was uncovered during an authorized security evaluation, where the AI agent autonomously identified the flaw without human intervention. While the technical aspects of the attack were straightforward, demonstrating the issue on a live website proved to be more challenging. This incident underscores the importance of robust security measures, particularly in industries handling sensitive customer information.

    Who is affected

    The ramifications of this vulnerability are significant, as it affects not only the insurer's reputation but also the security of its customers' personal and financial data. If exploited, this flaw could lead to unauthorized access, potentially resulting in financial losses and a breach of trust. Consequently, the insurer must prioritize immediate remediation efforts to secure its systems and communicate transparently with affected customers.

    What it means

    This incident serves as a reminder of the evolving landscape of cybersecurity threats and the necessity for organizations to adopt advanced security measures, including automated testing solutions. As AI continues to play a pivotal role in identifying vulnerabilities, businesses must remain vigilant and proactive in safeguarding their digital assets against potential exploitation.

  2. Oct 14, 2026

    Microsoft Windows Updates Cause Remote Desktop Connection Issues for Non-Admin Users

    Microsoft has acknowledged a significant issue affecting users of its Windows operating system, particularly those who rely on Remote Desktop Protocol (RDP) for remote access. Following the recent updates rolled out by Microsoft, non-administrative users have reported being unable to connect to devices through RDP when the 'Administrator protection' security feature is enabled. This situation is concerning for organizations that depend on remote connectivity for day-to-day operations, as it can hinder productivity and disrupt workflows.

    What changed

    The impact of this issue is particularly pronounced in enterprise environments where remote access is essential for employees to perform their tasks efficiently. Non-admin users, who typically require RDP access to carry out their duties, may find themselves unable to work remotely, leading to potential delays in project timelines and increased frustration among the workforce. Furthermore, IT departments are likely to face additional pressure to address the connectivity problems, diverting resources from other critical tasks.

    Who is affected

    As organizations navigate this challenge, they must weigh the importance of the 'Administrator protection' feature against the immediate need for remote access. This dilemma could prompt some businesses to temporarily disable the security feature to restore connectivity for their non-admin users, potentially exposing them to increased security risks during this period. Such a decision underscores the delicate balance between maintaining robust security measures and ensuring operational efficiency.

    What it means

    In response to this situation, organizations are encouraged to monitor updates from Microsoft for any patches or solutions that may address the Remote Desktop connectivity issue. Additionally, IT teams should prepare to communicate effectively with users affected by this problem, providing guidance on alternative access methods or workarounds until a permanent fix is implemented. The incident serves as a reminder of the complexities involved in managing software updates, particularly in environments where security and operational needs must coexist.