Zero-day exploits: what was hit and what to do

CISA added two more Ivanti Connect Secure flaws to KEV on 30 Oct 2026, completing a zero-day chain that gives root. Versions, deadlines and checks.

An exploit is code or a technique that abuses a vulnerability. The main types, real examples like EternalBlue and Log4Shell, and exploit vs vulnerability.

PwnEscape: the Linux IPv4 checksum bug from Vercel’s $1M Sandbox challenge that leaked host memory to a guest. How it works and the fix to patch.

Vercel’s first-party findings from its $1M Sandbox challenge (14 Oct 2026) put the most severe bug in the Linux kernel’s networking stack — triggered by crafted packets from inside the microVM — not in the KVM/Firecracker hypervisor, which an independent Trail of Bits review called architecturally sound. A researcher leaked host memory on Vercel production and, in a matching lab, crashed the host with two packets and ran commands with full administrator privileges. CVEs are pending and no customer data was reported accessed. What changed from the early “KVM escape” framing, what is confirmed vs claimed, and what a security leader should do.

An independent, attributed roundup of the major cybersecurity incidents of September 2026 — from the actively-exploited Citrix NetScaler and Arista VeloCloud zero-days to the Pentagon Defense Manpower Data Center breach, the Gyazo compromise, the Keio ransomware attack and the disputed ShinyHunters FBI-jobs claim. Each item carries a verification status (confirmed, claimed, reported or rumoured) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

CVE-2026-88771: a 9.5 unauthenticated command injection in Citrix NetScaler, exploited as a zero-day. Fixed builds and what patching alone misses.

Citrix NetScaler keeps getting mass-exploited — Shitrix, CitrixBleed, CitrixBleed 2 and new zero-days. The durable reason, the CVE timeline, and the fix.

ShinyHunters claims a PeopleSoft zero-day on apply.fbijobs.gov let it steal 2–3TB from FBI GovCloud. What’s confirmed, what isn’t, and what to do now.

A local zero-day in Meta’s Muse Mac client lets unprivileged malware hijack prompts, steal the agent’s auth, and pivot to a linked iPhone.

CVE-2026-76460 is a CVSS 10.0 authentication bypass in Cisco ISE, under active exploitation with no workaround. Affected versions, patches, and detection.

An independent, defensive roundup of August 2026’s biggest cyber incidents: the BeyondTrust Remote Support zero-day (CVE-2026-102764) exploited by a China-nexus actor from late August, the McKesson and Manchester Airports Group breaches, a record 997 ransomware claims, social-engineering hits on Apollo, RingCentral and Carhartt, OT attacks on energy and water, and the AI angle. Each item carries a status label (Confirmed / Claimed / Reported) and a subjective 1–10 severity read.

Researchers say Kimi K3 agents chained a Redis streams double-free with a RedisBloom heap overflow into working authenticated RCE, with one exploit produced in 27 minutes. Redis shipped seven security releases in response. The claims are self-reported — but the patches are real.

An independent, attributed roundup of the major cybersecurity incidents of June 2026 — from the Oracle PeopleSoft zero-day (CVE-2026-35273) that ShinyHunters used against 100-plus universities and Microsoft’s record ~206-CVE Patch Tuesday to breaches at iRhythm, Novo Nordisk, Tata Electronics and Kodak and a wave of npm supply-chain compromises. Each item carries a verification status (confirmed, claimed or reported) and a clearly-labelled subjective editorial severity, with a defensive takeaway.