Breaking-Alert

Published Thursday, October 01, 2026 at 05:50 AM PT BLUF — An autonomous AI agent successfully chained multiple Zammad zero-day vulnerabilities to breach DIVD (Dutch Institute for Vulnerability Disclosure), a cybersecurity research organization, gaining session hijacking and remote code execution in seconds. Patch status uncertain; organizations running unpatched Zammad face immediate AI-driven attack surface. Assume copycat exploitation is underway. ...

Published Wednesday, September 30, 2026 at 11:48 PM PT BLUF: Bitget cryptocurrency exchange has confirmed a major theft of $387.5–$388 million in digital assets, attributed to exploitation of a zero-day vulnerability in an undisclosed third-party security product. Affected users should verify account access, enable withdrawal alerts, and assume their account metadata may have been compromised. No confirmed evidence of private key extraction; funds appear concentrated in attacker wallets. ...

Published Wednesday, September 30, 2026 at 05:46 PM PT BLUF: Zero Day Initiative’s Pwn2Own Berlin 2026 concluded with 24 newly discovered 0-day vulnerabilities publicly demonstrated across AI databases, coding agents, local inference engines, and NVIDIA products. Specific vulnerability details and affected vendors remain incomplete in available sources; immediate vendor disclosures are in progress but full proof-of-concepts and technical details are under embargo. Monitor ZDI’s coordinated disclosure calendar and vendor security advisories for 90-day notification/patch windows. ...

Published Wednesday, September 30, 2026 at 05:46 PM PT BLUF: Windows systems running Node.js applications are at risk from a local privilege escalation vulnerability in npm CLI’s module resolution system. Discord desktop app confirmed affected (CVE-2026-0776). No patch available. Immediate action: audit Windows systems for Node.js installations; restrict local user access on sensitive machines; prepare to isolate and update Discord and other Node.js applications pending vendor fixes. ...

Published Wednesday, September 30, 2026 at 05:45 PM PT BLUF: DIVD (Dutch Institute for Vulnerability Disclosure) has disclosed unpatched zero-days in Zammad helpdesk software that were actively exploited to conduct AI-driven network attacks. Organizations running Zammad should inventory instances immediately and monitor for unauthorized access. Details remain sparse; coordinated disclosure underway. DETAILS DIVD identified zero-day vulnerabilities in Zammad (helpdesk/ticketing platform) actively exploited in network breaches. Attack vector involved automated AI agent(s) coordinating initial access and reconnaissance—same methodology used in parallel breach of DIVD’s own infrastructure. Exploitation enabled network-level compromise; AI automation suggests broad targeting potential. Patch/advisory status unknown; vendors/disclosure timeline not yet public in available material. Related threat activity: concurrent AI-augmented attack frameworks observed across financial and security sectors (credential theft, lateral movement). IMPACT ...

Published Wednesday, September 30, 2026 at 11:44 AM PT BLUF: Suspected state-sponsored threat actors are exploiting two critical remote code execution zero-days in Citrix NetScaler ADC and Gateway (CVE-2026-88771, CVE-2026-88772). Active exploitation began in early September 2026 and has escalated from targeted intrusions to mass attacks affecting organizations globally. Organizations running vulnerable NetScaler instances must patch immediately. ...

Published Wednesday, September 30, 2026 at 11:43 AM PT BLUF: Cisco has warned of a new zero-day vulnerability in its SD-WAN solution that is actively exploited in attacks. Technical details, affected product versions, CVE assignment, and scope remain unconfirmed. Status: MONITORING. DETAILS Source reports Cisco warning of a zero-day flaw in SD-WAN (specific product/version not yet published) Flaw is actively exploited in ongoing attacks Cisco has issued official advisory (source: BleepingComputer) No CVE number, CVSS score, or vulnerability details available at this time Context note: Cisco has issued multiple high-severity SD-WAN and related infrastructure warnings in 2026 (ISE, Secure Email Gateway previously patched for active exploitation) IMPACT ...

Published Wednesday, September 30, 2026 at 11:42 AM PT BLUF: Vulnerability exploitation rates have doubled year-over-year, rising from an average 10.5 per month (2025) to 18 per month (Jan–Aug 2026). Google Threat Intelligence attributes acceleration to adversaries leveraging AI for automated discovery, exploitation, and attack chain orchestration. Organizations should immediately audit patch cadence and threat-detection coverage for AI-discovered CVEs; zero-day exploitation is tracking upward in parallel. ...

Published Wednesday, September 30, 2026 at 10:00 AM PT BLUF: Apple has released macOS 27.0.1. CVE details and vulnerability count are on Apple’s support portal (support.apple.com/en-us/100100). Unconfirmed: specific CVE list, severity breakdown, and affected subsystems — awaiting vendor documentation review. All macOS 27.x users should plan imminent patching. DETAILS macOS 27.0.1 release confirmed; Apple has published security documentation at support.apple.com/en-us/100100 Recent Apple 27.x series releases (referred to as “Golden Gate 27” in vendor advisories) have addressed significant vulnerability volume — prior 27.x releases patched 150+ vulnerabilities Timing: release within last ~24 hours; current date is 2026-09-30 Unconfirmed: exact CVE roster, severity distribution, and whether 27.0.1 is an initial release or patch to 27.0 The referenced support article likely contains full CVE details, attack vectors, and affected components — not accessible from available material IMPACT ...

Published Wednesday, September 30, 2026 at 05:41 AM PT BLUF: Bitget cryptocurrency exchange has been hacked via an unpatched zero-day vulnerability in a third-party security product. Attack vector and scope remain unclear. UNCONFIRMED: extent of funds/data compromise; specific vulnerable product; timeline. DETAILS: Bitget (major crypto exchange) exploitation confirmed via zero-day in third-party security software — vendor not yet disclosed in available material Attack leveraged security product vulnerability (pattern consistent with recent breaches: PaperCut, Citrix NetScaler, SonicWall, Check Point) BleepingComputer reported; no official Bitget statement available in provided sources Status of patches, incident response, or customer notification UNCONFIRMED IMPACT: ...