Vulnerabilities on Zero Day Room: Actively exploited CVEs, Critical severity this month, Microsoft, Cisco, Fortinet and Ivanti.
Anthropic has expanded its Cyber Verification Program, offering vetted cybersecurity professionals reduced safeguards on advanced AI models like Claude Opus 5.5 for vulnerability discovery. The move follows Project Glasswing's identification of over 129,000 verified software vulnerabilities.
LibreOffice and Apache OpenOffice contain a critical vulnerability allowing malicious spreadsheets to execute arbitrary Java code without macro warnings.
GitHub and Microsoft have released ReviewBench, an open benchmark for evaluating AI code review tools using 219 real-world pull requests.
A new Linux backdoor named ClingSTUN hijacks internet-facing IoT devices by exploiting two dozen known, unpatched vulnerabilities.
Microsoft confirms the optional September 2026 KB5124010 preview update for Windows 11 causes crashes in some games and applications that use AC-3 audio decoding.
Fortra has released patches for eight vulnerabilities in its BoKS Privileged Access Manager, three of which are critical.
GitLab has patched a critical 9.9-rated RCE vulnerability, CVE-2026-90970, in its self-hosted AI Gateway.
Cisco Talos details a China-nexus threat actor, UAT-11587, using a Rust-based backdoor called Antino that leverages Microsoft 365 services for covert communications.
Five threat clusters exploited a critical remote code execution flaw in BeyondTrust products within a week of its disclosure.
Attackers are actively exploiting a critical Citrix NetScaler zero-day, CVE-2026-88772, to gain root access and deploy custom WHIPSHOT and SLAPSHOT malware.
A DARPA-backed AI security startup, Xint, identified three critical vulnerabilities in Signal's Android app during a one-hour scan.
Two critical Citrix NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, are being actively exploited in zero-day attacks to deploy webshells.
Two unpatched remote code execution vulnerabilities in Citrix NetScaler ADC and Gateway appliances are under active exploitation.
Zenity Labs disclosed three critical zero-click vulnerabilities in Salesforce Agentforce, collectively named SalesBleed.
F5 has released hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in BIG-IP APM. The flaw, a heap-based buffer overflow with a CVSS score of 9.8, allows unauthenticated remote code execution on systems where APM serves as an OAuth authorization server.
Check Point has disclosed that a critical zero-day vulnerability in its Security Management Server was exploited in targeted attacks in July.
Siemba has launched automated testing for insecure direct object reference (IDOR) vulnerabilities in REST, GraphQL, and SOAP APIs.
The U.S. Cybersecurity agency CISA has mandated patching for three actively exploited Linux kernel vulnerabilities.
A malicious npm campaign impersonating a legitimate library evades GitHub's latest security measures by hiding malware in runtime code, not install scripts.
A critical vulnerability in SAP's Extended Passport processing allows unauthenticated attackers to achieve remote code execution.
The U.S. Cybersecurity and Infrastructure Security Agency has released new guidance for critical infrastructure operators on deploying decoy systems.
A new exploit kit called BlueMoon, which chains three recent zero-day vulnerabilities in Chrome and Windows, has been rapidly adopted by multiple Chinese threat groups.
GitLab has patched a maximum-severity path traversal flaw, CVE-2026-85706, which allows unauthenticated file reads.
CISA has revised its Insider Threat Mitigation Guide with new case studies and guidance addressing hybrid work, AI deception, and employee separations.
Acting CISA Director Nick Andersen warns that decades of bad decisions and overwhelming technical debt have left the U.S.
Akeyless has released Agentic Runtime Authority, a real-time enforcement layer that blocks unauthorized AI agent actions in production environments.
Zhuque Lab at Tencent has released AI-Infra-Guard, an open-source scanner that checks AI infrastructure services against known CVEs.
Adobe has released patches for over 170 security flaws, including an urgent fix for a critical, actively exploited zero-day in Adobe Commerce and Magento.
Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities, including two Windows zero-days under active exploitation. The U.S.
A threat cluster tracked as PREY-0058 is using fake IT calls and proxy sign-ins to steal data from executives for extortion, according to Arctic Wolf.
CERT Polska discovered six RouterOS vulnerabilities, two of which allow unauthenticated full device control via SSH.
North Korean-aligned threat actors have deployed a new Linux espionage toolkit targeting automotive and media organizations in South Korea.
Anthropic is locking users out of Claude accounts due to login sessions compromised by infostealer malware. Separately, nearly 22,000 Microsoft Exchange servers remain unpatched against a critical flaw, CVE-2026-62911.
Anthropic's Claude Mythos Preview AI identified over 23,000 potential vulnerabilities in open-source projects.
The FulcrumSec threat group claims to have leaked 550GB of stolen customer data from the Manchester Airports Group.
Attackers are exploiting an unpatched critical vulnerability in Magento Open Source and Adobe Commerce, installing persistent backdoors.
A critical vulnerability in the Elementor Pro WordPress plugin is being exploited to upload malicious PHP files, allowing attackers to compromise websites.
OpenAI announced a $1 billion subsidy program on September 3, 2026, to provide its Daybreak AI security platform to under-resourced critical infrastructure.
JetBrains disclosed a breach of its Cadence cloud service, where attackers exploited a critical TeamCity flaw to steal AWS credentials and user data.
Threat actors have launched numerous exploit attempts against critical remote code execution flaws in the WordPress plugins Super Forms and Elementor.
OpenAI has committed $1 billion to subsidize access to its Daybreak cyber models for critical sectors including water, electricity and local governments.
OpenAI is providing $1 billion in credits for its Daybreak cybersecurity models to support defenders in critical infrastructure sectors like water and power.
September 2026's Patch Tuesday follows a record-breaking August with 398 CVEs patched. Experts highlight actively exploited SharePoint and Exchange flaws, while Microsoft works on a fix for the 'ShieldBreak' Defender vulnerability.
Cisco patches a critical 9.8-rated vulnerability (CVE-2026-20212) in ten Nexus 9000 switch models.
Google, Anthropic, and OpenAI have each announced new AI models and access programs focused on cybersecurity. Google's Gemini 3.8 Flash Cyber is offered to trusted defenders, Anthropic detailed safeguards for its Claude models, and OpenAI said its Astra model meets a 'Critical' capability threshold for autonomous cyber operations.