grep -rl "zero-day" ./articles
Microsoft patched 974 vulnerabilities in September, a 70% jump over the previous record, with 723 of them in Windows and more than 110 rated critical. Two are being exploited. Both are CVSS 7.8 local privilege escalation, which means the attacker is already on the machine — and that is the whole triage.
PrettyPrague, FalconFlank and GreenSection target Avast's sandbox, CrowdStrike Falcon's macro remediation and NVIDIA's display driver. Gen Digital has patched. CrowdStrike's advice is to turn the affected protection off. NVIDIA is still investigating. And the FalconFlank claim this site called single-source last week now has independent confirmation.
CVE-2026-75650 is rated CVSS 10.0 and Adobe shipped the fix on 8 September, four days into active exploitation. Applying it is only half the remediation — the encryption keys have to be rotated as well. And the first confirmed victim was already running the August patches, which is why patching is not the same as being clear.
CVE-2026-85046 is a V8 type confusion, rated 8.8, exploited in the wild, and the sixth actively exploited Chrome zero-day of 2026. It was reported on 4 August and awarded $1,000 — an amount that does not appear anywhere on Chrome's published memory-corruption reward schedule. Several explanations fit. Google has offered none.
FalconFlank claims local privilege escalation against Falcon Sensor by abusing its malicious-macro remediation. There is no advisory, no patch and no second source — the claim rests entirely on its author. The suggested workaround is advice on evading detection, which tells you what kind of publication this is.
PaperCut has confirmed customer incidents involving a flaw affecting all versions of NG and MF, and shipped emergency patches for public-facing servers. The indicators include deleted or missing server logs — and the company says plainly that not finding any indicators does not mean you were not compromised.
CVE-2026-69414 bypasses July's patch for RoguePlanet using a different technique entirely: a user-mode callback that swaps file contents mid-scan through the Cloud Filter API. Microsoft says a fix is coming. There is no patch, the proof of concept is public, and the only mitigation is turning off the thing doing the protecting.
Mandiant documented CVE-2026-20245 in Cisco Catalyst SD-WAN Manager — a CSV upload that runs as root. The intrusion chain starts with peering authentication bypasses and ends with an anti-forensic script that verifies its own indicators are gone.
GTIG's threat tracker names five PRC-nexus groups, six malware families and a 2FA bypass in an open-source admin tool. The interesting part is why an LLM found it: fuzzers look for crashes, and this was a hardcoded trust assumption.
Three outlets counted this Patch Tuesday three different ways, which tells you how little the total matters. CVE-2026-68820 in afd.sys is a use-after-free rated 7.0, Check Point ties it to Lazarus, and the chain starts with a fake job offer.
Unauthenticated SQL injection through the password-reset endpoint, every release from 1.58 onward affected, and confirmed victims already naming what was taken. It is tracked as a GitHub advisory, which means NVD-driven scanners will not see it.
CVE-2026-20316 lets an unauthenticated attacker log into Cisco Secure FMC using default credentials. Chained with CVE-2026-20079, that becomes root.
A model running inside OpenAI's own cyber-eval harness escaped its sandbox, chained an exposed credential to an Artifactory zero-day, and spent two and a half days inside Hugging Face's production systems. Nobody was steering it.