Vulnerabilities
AI-Discovered Vulnerabilities Exploitation Accelerates
Five threat clusters exploited a critical remote code execution flaw in BeyondTrust products within a week of its disclosure, a vulnerability found
Latest Cybersecurity news
Threats
Former Air Force members sentenced for BEC
Two former US Air Force members stationed at Dover Air Force Base have been sentenced to a combined 189 months in prison for a business email compromise
Vulnerabilities
NetScaler CVE-2026-88772 Exploitation Deploys Root Malware
Attackers are actively exploiting a critical Citrix NetScaler zero-day, CVE-2026-88772, to gain root access and deploy custom WHIPSHOT and SLAPSHOT malware
Vulnerabilities
Xint DARPA AI Security Tool Exposes Critical Signal Flaws
A DARPA-backed AI security startup, Xint, identified three critical vulnerabilities in Signal's Android app during a one-hour scan.
Threats
Microsoft details China-linked NeedyMantis
Microsoft has publicly detailed the NeedyMantis malware framework, discovered during analysis of the May 2026 Daemon Tools supply chain attack.
More to read
Briefings
News
Facebook liable for 43 million data privacy
A New Mexico jury found Meta's Facebook liable for over 43 million violations of state consumer protection law, ruling it deceived users about data sharing
Vulnerabilities
NetScaler CVE-2026-88771 and CVE-2026-88772 Exploited
Two critical Citrix NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, are being actively exploited in zero-day attacks to deploy webshells
Threats
Bitget resumes withdrawals after $387.5 million North Korean
Bitget confirmed a $387.5 million crypto theft by suspected North Korean hackers, exploiting a backend wallet system.
Defence
Cloudflare Containers residual data
Cloudflare fixed a cross-tenant data leakage flaw in its Containers service after a researcher demonstrated that residual data from other customers could
Vulnerabilities
Citrix NetScaler zero-day remote code
Two unpatched remote code execution vulnerabilities in Citrix NetScaler ADC and Gateway appliances are under active exploitation, with no vendor patch or
Incidents
CISA Releases 2026 Election Infrastructure Security Plan
CISA has published a 13-page Election Infrastructure Security Plan 40 days before the November 2026 midterms, offering guidance against cyber and physical
Profiles
Actively Exploited Cves
Actively exploited in the wild
Application Allowlisting
Application Allowlisting · Application Whitelisting
Asset Inventory And Finding Shadow It
Security control failure · Enterprise IT security and governance
Attacks On Managed Service Providers
Attacks on Managed Service Providers · MSPs and their clients
Australia
Australia · 18th century
Backup And Recovery That Survives Ransomware
Recall · CVE-2024-30051
Breach Notification Timelines By Country
Breach Notification Timelines By Country · 24 to 72 hours
Breach Notification
Information security / Data protection · Organizations handling personal data
Data and guides
Also this week
News
Kiteworks issues global server shutdown
Kiteworks advised customers worldwide to shut down servers for a six-hour window on Saturday, September 26, based on credible threat intelligence from
Vulnerabilities
ShinyHunters Bypasses WAFs with URL Trick to Exploit Oracle
The ShinyHunters extortion gang is exploiting the Oracle PeopleSoft CVE-2026-35273 zero-day using a percent-encoded URL to bypass web application
Vulnerabilities
Salesforce Agentforce Zero-Click Vulnerabilities Enable Data
Zenity Labs disclosed three critical zero-click vulnerabilities in Salesforce Agentforce, collectively named SalesBleed, enabling silent data exfiltration
Regulation & compliance
Bipartisan Bill Proposes Voluntary Telecom Security Rules
Senators Mark Warner and Ted Cruz introduced the Telecommunications Cybersecurity and Resilience Act, creating a voluntary framework for telecom
Regulation & compliance
OnePlus OxygenOS root exploit disclosed
Researcher Rasmus Moorats chained two unpatched OnePlus software flaws to gain root access on an Android phone via a malicious app requiring no
Threats
Cofense Command Center Measures Employee Phishing Competency
Cofense has expanded its AI-driven Phishing Defense Platform with a new Competency Dashboard in its Command Center.
Browse sections
Common questions
What does Zero Day Room cover?
The vulnerability or campaign, and the patch or control that stops it, with an Asian regional focus. Vulnerabilities and Threats hold the offensive side as reported, Defence holds the mitigations, Regulation & compliance covers the legal duties, and Incidents follows breaches as they are disclosed.
Do you publish exploit code?
No. Coverage is defensive: pieces describe what has been disclosed, what is affected and what the vendor or advisory recommends, without proof of concept code or step by step exploitation.
Where do the advisories come from?
From vendor advisories, national cyber agencies, researchers and named publications, credited and linked in each piece. Severity ratings belong to whoever assigned them, and the vendor's own advisory is the version to patch against.
Is an incident reported here confirmed?
Only as far as the source says. Attribution and breach scope change repeatedly in the days after disclosure, and a piece reports who claimed what rather than settling it. Attacker claims are reported as claims.
Why is the source credited instead of a writer?
Nobody is bylined. Pieces are written with automated assistance from the source material, and the advisory or publication behind them is credited in place of an author.
How quickly does the site update?
As the sources publish, which for a widely exploited flaw means several pieces in a day as details change. Anything you are acting on should be checked against the current advisory rather than the summary.