ZeroDay News · Cybersecurity news, CVE tracking and threat intelligence.
About the publication →Introducing Web Search API via AI Gateway
Cloudflare has confirmed that its AI Gateway, a service designed to help developers manage and observe their AI applications, was affected by a security incident involving a critical vulnerability. The company disclosed that the vulnerability, identified as CVE-2023-50387, allowed unauthorized access to sensitive data within the AI Gateway.
Read the brief →
Latest News
view all →
Canadian cybersecurity executive arrested in federal extortion case
A Canadian cybersecurity executive was arrested in Pennsylvania on Thursday, facing federal charges of conspiracy to commit extortion. Edward Dubrovsky, 54, a co-founder and former Chief Operating Officer of CYPFER, a firm specializing in ransomware negotiation, is charged with conspiring to threaten the confidentiality of information for extortion and conspiring to commit Hobbs Act extortion,…
Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management
AI SPERA, the company behind the cyber threat intelligence platform Criminal IP, has announced AITEM (AI-Powered Threat Exposure Management), an expansion of its Attack Surface Management (ASM) offerings. AITEM aims to move beyond traditional asset discovery to provide a more comprehensive approach to understanding, prioritizing, and responding to security exposures. The platform is scheduled…
AI Is Getting Really Good at Messing With Cybercriminals
Anti-cybercrime initiatives are increasingly deploying artificial intelligence to disrupt scammers by engaging them with lifelike bots, which the criminals mistake for genuine victims. This strategy aims to waste scammers' time and resources while gathering intelligence on their operations.
FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe
The Federal Bureau of Investigation (FBI) has reportedly arrested Edward Dubrovsky, a co-founder of the ransomware negotiation firm Cypfer and currently associated with CyberSteward. The arrest is said to be part of the ongoing ShinyHunters investigation, specifically in connection with an incident involving FBI job applicant data.
The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
A new report highlights a significant blind spot in enterprise security architectures concerning the proliferation of third-party AI agents. The forthcoming 2026 State of Agent Security Report indicates that current security models, often designed to protect AI systems directly chosen and deployed by an organization, frequently fail to account for AI capabilities embedded within third-party…
Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
A former core infrastructure engineer has been sentenced to prison for an attempted cyber extortion plot against an industrial firm. The engineer reportedly deleted administrative accounts and reset hundreds of user passwords, subsequently demanding a ransom of 20 Bitcoin to prevent further disruption to the company's servers.
FBI Arrests Founder of Ransomware Negotiation Firm
Federal agents have arrested a Canadian cybersecurity professional in Pennsylvania, linking him to an ongoing investigation into the ShinyHunters hacking group. Edward Dubrovsky, co-founder of the Canadian firm CyberSteward, was taken into custody on October 8, facing charges of conspiracy to threaten to impair the confidentiality of information with intent to extort money, and interference…
ASOS Breach Reveals the Risks in Customer-Facing SaaS
A recent security incident involving the British online fashion retailer ASOS has brought to light the inherent risks associated with customer-facing Software-as-a-Service (SaaS) platforms. The breach reportedly showcased how the compromise of a single user identity could serve as an initial access vector, subsequently allowing attackers to achieve broad penetration into a company's internal…
Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
A new malvertising campaign, dubbed "Adception" by security researchers at Push Security, is leveraging Google Ads and Bing redirects to distribute fake Claude installers that deploy "ClickFix" attacks. The campaign was identified after researchers observed malicious Google ads targeting users searching for "claude mac."
The Briefs
view all →
AI Fuels Cybersecurity Mergers and Acquisitions
AWS AgentCore security undone by prompt requesting credentials
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
Germany Arrests Suspected Qilin Ransomware Leader After Japan Detention
Exploited before disclosure
CVE tracker →vulnerabilities were called exploited by a KEV catalogue on or before the day they were published, in the last seven days, across 8 vendors. There was no patch window at all.
- CVE-2026-76519Cisco Secure Email Gatewaysame day3 of 31.7%
- CVE-2026-0322Palo Alto Networks PAN-OSsame day3 of 31.1%
- CVE-2026-110447Collabora Online - Built-in CODE Serversame day1 of 31.2%
- CVE-2026-103671Unattributedsame day1 of 30.22%
- CVE-2026-104935Ivanti Connect Securesame day3 of 326.0%
- CVE-2026-96951Microsoft Windowssame day3 of 31.5%
- CVE-2026-91136Divi Essential Divi Plus1d before1 of 31.8%
- CVE-2026-97670theme-fusion avada_builder1d before1 of 30.43%
1 more this week in the CVE tracker.
Top Stories
CVE tracker →
Japan confirms arrest of Russian Qilin operative, extradition to Germany
Introducing Clef-omni with full multimodality, plus a faster Clef and a cheaper Clef-flash
MonsterCloud CEO Zohar Pinhasi Accused of Paying Hackers, Defrauding Victims
FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack
FBI Arrests Suspected ShinyHunters Operative
More Coverage
Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto
FBI arrests another suspected ShinyHunters hacker after agency breach
Leader of vast money mule operation that laundered cybercriminal proceeds pleads guilty
Hundreds of thousands impacted by data breach at biosensor firm iRhythm
FBI touts another ShinyHunters arrest in response to data breach
Germany arrests alleged core Qilin ransomware member after extradition
Wikimedia Says Rogue AI Agents Abused its Platforms
Belarusian hacktivists admit to 2023 breach of Russian state healthcare network
AI Training Critical as Governance Challenges Grow
Product showcase: SimpleLogin keeps your email address private with aliases
US Disrupts Chinese State-Sponsored Hacking Tools
Citrix warns admins to patch new NetScaler RCE flaw immediately
Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security
Major AI Firms Pledge Data Protection Changes Following UK Privacy Watchdog Push
Co-creator of Empire Market dark web marketplace given 40-year sentence
Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland
Thousands of wind and solar park systems sit exposed on the internet across Europe
PCI SSC calls for human approval of AI agent actions involving cardholder data
ICE Agent at NYC Shooting Has History of Alleged Violence and Illegal Arrests
