BeyondTrust says a suspected China-nexus actor has exploited Remote Support flaw CVE-2026-102764 since late August. SaaS customers were patched on October 8, but self-hosted installs without automatic updates must be updated by hand.
Perspective Coverage
8 publishers
- Builder
- Builder 16%
- Operator
- Operator 67%
- Investor
- Investor 17%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence76
buildOne report1 publisher Researcher reports an actively exploited root RCE in Cisco's Secure Email Gateway
Satyam Rastogi reports that Cisco patched a Secure Email Gateway zero-day that let unauthenticated attackers run commands as root, exploited before the fix. The post gives no CVE or fixed version, so SEG operators have the warning but no build to patch to.
Reality
- Evidence25
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence35
buildOne report1 publisher Windows Shell zero-day CVE-2026-96951 strips the tag that SmartScreen and Protected View read
Microsoft's October Patch Tuesday fixes CVE-2026-96951, an exploited Windows Shell zero-day rated CVSS 8.8 that strips Mark-of-the-Web from files. A dev.to analysis counts it as the third such bypass this year.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence45
One exploited Windows Shell flaw sits among Microsoft's record 1,413 October fixes
Microsoft's October Patch Tuesday fixes a record 1,413 flaws, including Windows Shell zero-day CVE-2026-96951 that attackers already exploit. Malwarebytes reports Microsoft expects AI to bring more fixes each month, so triage has to key on exploitation.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence55
Researchers at Pwn2Own Ireland 2026 collected $1,262,000 for exploiting 98 zero-day flaws across seven product categories in three days. Every exploit had to work on current firmware, so owners of those products have to wait for vendor fixes.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+10
- Incentives45
- Confidence72
Pwn2Own Ireland's second day pays $232,500 for 45 zero-days in fully patched devices
Researchers exploited 45 unique zero-days on day two of Pwn2Own Ireland 2026 for $232,500, hacking Samsung's Galaxy S26 three times. Every target ran its latest firmware, so each win is a working code-execution bug in the build owners run today.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence60
Citrix patches two NetScaler zero-days that attackers used before any fix existed
Citrix shipped fixes on September 27 for NetScaler flaws CVE-2026-88771 and CVE-2026-88772, both rated 9.5 and exploited on unpatched appliances. Exploitation began before the fix, at a date Citrix has not given, so affected appliances need an intrusion check as well as an upgrade.
Reality
- Evidence66
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence62
Apple patched CoreGraphics flaw CVE-2026-86950 in iOS 26.7.1 after a report that it may have been exploited against targeted iPhone users. iPhone fleets still on iOS 26 have the strongest case for forcing that update before the next scheduled patch window.
Perspective Coverage
9 publishers
- Builder
- Builder 31%
- Operator
- Operator 65%
- Investor
- Investor 4%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+15
- Incentives25
- Confidence74
CISA gives federal agencies until October 2 to patch Apple's exploited CoreGraphics flaw
CISA added Apple's CoreGraphics zero-day CVE-2026-86950 to its KEV catalog, giving federal agencies until October 2, 2026 to patch. Only federal civilian agencies are bound by that date. Every other Apple fleet sets its own deadline for a bug Apple links to targeted attacks.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence62
One unauthenticated request to Zammad's /ws endpoint leaks every active user's session cookie
Horizon3 reproduced CVE-2026-102489 and showed one unauthenticated request to Zammad's /ws endpoint reflects every active user's session cookie. A leaked admin cookie opens the second half of the chain, remote code execution.
Reality
- Evidence55
- Adoption52
- Hype gap+12
- Incentives65
- Confidence55
Pwn2Own Ireland teams logged 32 zero-days and over $368,000 in prizes on October 6, breaking LiteLLM, OpenAI Codex and Oracle's AI database. Vendors now have 90 days to ship fixes before the Zero Day Initiative publishes the details.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence62
Pwn2Own Ireland's first day puts LiteLLM and OpenAI Codex among 32 exploited zero-days
Pwn2Own Ireland 2026 researchers exploited 32 zero-days on day one for $388,500, including LiteLLM flaws and an OpenAI Codex argument injection. Vendors now have 90 days to ship fixes before ZDI publishes details, and the report describes contest exploits only.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence55
DIVD, the Dutch volunteer disclosure group, was breached through two chained zero-days in its own Zammad helpdesk that took an attacker to root in seconds. Zammad claims over 2,000 customers, and DIVD wants every older install upgraded to version 7 or taken offline.
Perspective Coverage
9 publishers
- Builder
- Builder 31%
- Operator
- Operator 58%
- Investor
- Investor 11%
Reality
- Evidence70
- Adoption40
- Hype gap+25
- Incentives45
- Confidence65
PeopleSoft zero-day claim behind the FBI breach rests on ShinyHunters' word alone
ShinyHunters says a second PeopleSoft zero-day let it steal data on every FBI employee, a claim neither the FBI nor Oracle has confirmed. Two suspects have since been arrested, and PeopleSoft customers are still judging their own exposure from analysts' advice.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+40
- Incentives60
- Confidence35
Cisco says attackers are exploiting CVE-2026-76504, a 9.8-rated flaw that gives unauthenticated requests admin access to the Catalyst SD-WAN Manager API. Every configuration is affected, leaving exposed on-premises Managers needing an out-of-cycle upgrade and a check for earlier intrusion.
Perspective Coverage
12 publishers
- Builder
- Builder 14%
- Operator
- Operator 76%
- Investor
- Investor 10%
Reality
- Evidence85
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence80
buildOne report1 publisher DIVD says an AI agent chained two Zammad zero-days to root on its helpdesk host
DIVD says an attacker chained two unpublished Zammad bugs from an unauthenticated web session to root on its helpdesk host. Its claim that an autonomous AI agent did it is still a first-party assessment with no independent confirmation yet.
Reality
- Evidence55
- Adoption35
- Hype gap+30
- Incentives55
- Confidence55
buildOne report1 publisher Patching NetScaler to 14.1-73.37 leaves planted webshells and persistence in place
Attackers using two NetScaler zero-days since early September left webshells that patching to 14.1-73.37 or 13.1-64.23 does not remove. Operators have to search every appliance for those traces, patched or not, and move OT remote access onto a jump host of its own.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence60
buildOne report1 publisher Chained Zammad CVEs took DIVD from hijacked session to root in seconds
DIVD said attackers chained two Zammad zero-days on its own internet-facing server and went from a hijacked session to root in seconds. It assessed that an AI agent was involved and says upgrading to version 7 is not a complete fix for both flaws.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives35
- Confidence50
Bitget says attackers stole $387.5 million after exploiting zero-days in two third-party security appliances. Investigators say the appliances' privileged access led the attacker to its production wallet server.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives60
- Confidence60
FBI memo tells every employee to treat their personal data as stolen after the FBIjobs.gov breach
FBI told staff in an internal memo to assume hacking group ShinyHunters stole data on every employee after a claimed 2 to 3 terabyte breach of FBIjobs.gov. Until the bureau confirms the scale, staff and the job applicants the hackers say are also in the files have reason to treat their home addresses as exposed.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+15
- Incentives70
- Confidence40
Earlier coverage
- Two NetScaler zero-days under active attack justify an outage outside the patch cycle
Leadership · September 29, 2026 · Confirmed2 publishers
- ShinyHunters calls its FBI ultimatum a marketing campaign
Security · September 28, 2026 · One report1 publisher
- CISA wants NetScaler owners to check for intruders before installing Citrix's zero-day fixes
Product · September 28, 2026 · Confirmed2 publishers
- Attackers are exploiting two unpatched NetScaler RCE flaws, watchTowr says
Security · September 27, 2026 · Confirmed3 publishers
- Kiteworks asks customers to power down for nine hours to guard against zero-day attacks
Invest · September 27, 2026 · Confirmed3 publishers
- GeoServer flaw has no CVE, no patch, and hundreds of probes: triage exposure now
Security · August 15, 2026 · Confirmed2 publishers
- Dream Job now ships a kernel exploit: Lazarus pairs recruiter lures with a fresh AFD zero-day
Security · August 14, 2026 · Confirmed4 publishers
- Kiteworks tells customers to shut down even internal file-sharing servers for six hours
Security · September 25, 2026 · Confirmed5 publishers
- OpenAI grades its own unreleased Astra model Critical for autonomous zero-day discovery
Invest · September 2, 2026 · Confirmed5 publishers
- OpenAI gates a 100% ExploitBench model behind refusals it plans to loosen in weeks
Security · September 4, 2026 · Confirmed4 publishers
- Fully patched Magento stores are being backdoored four days ahead of Adobe's next security release
Security · September 5, 2026 · Confirmed7 publishers
- CVE-2026-86218 gives unauthenticated attackers code execution on N-able N-central consoles
Security · September 7, 2026 · Confirmed7 publishers
- Microsoft's record 964-fix Patch Tuesday overwhelms with sheer volume
Leadership · September 9, 2026 · Confirmed2 publishers
- Attackers are exploiting a medium-rated V8 write in Chrome's 230-fix release
Security · September 10, 2026 · Confirmed5 publishers
- ShinyHunters reportedly pivoted from a recruiting server to FBI agent records
Product · September 22, 2026 · Confirmed3 publishers
- ShinyHunters pins its claimed FBI breach on an unpatched PeopleSoft RCE
Security · September 23, 2026 · Confirmed14 publishers