Researchers at Binarly discovered that the exploit remains effective even on devices running an earlier security update released by Zyxel. The vulnerability, tracked as CVE-2026-107441, has a CVSS severity score of 8.8 according to the vendor.

Earlier Security Patch Failed to Block the Exploit

Zyxel released firmware version 2.90 Patch 2 in June 2026 to address an earlier vulnerability, CVE-2026-7273.

However, Binarly researchers found that the previous patch did not adequately validate HTTP request parameter sizes. Attackers could exploit this weakness to overwrite memory and manipulate program execution, allowing malicious commands to run without authentication.

The researchers reported the issue to Zyxel on September 29. The vendor classified it as a separate vulnerability.

Nearly 1,000 Switches Compromised

According to GreyNoise, attackers compromised 996 Zyxel GS1900 switches across multiple countries during an attack campaign beginning around August 17.

The attackers deployed a data-collection script to gather:

• Switch configuration files
• Hashed root credentials
• Network information

GreyNoise also reported that 564 of the compromised switches were still using factory-default credentials.

The activity has been associated with a threat group tracked as Red Heron, although the precise attribution remains uncertain.

Zyxel Releases Patch 3 Firmware

Zyxel has released 2.90 Patch 3 firmware for ten affected GS1900 models to address CVE-2026-107441.

The affected models include:

• GS1900-8
• GS1900-8HP
• GS1900-10HP
• GS1900-16
• GS1900-24
• GS1900-24E
• GS1900-24EP
• GS1900-24HPv2
• GS1900-48
• GS1900-48HPv2

Administrators should install the corresponding Patch 3 firmware for their specific switch model. Devices running Patch 2 or earlier versions remain vulnerable.

The post Zyxel GS1900 Zero-Day Bypasses Earlier Security Patch, Enabling Root Command Execution appeared first on First Hackers News.

The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, involve an authorization bypass and command injection. They carry CVSS scores of 9.3 and 8.6, respectively.

Two Vulnerabilities Identified

The first vulnerability, CVE-2026-116606, affects Barracuda Email Security Gateway (ESG). It involves a pre-authentication authorization bypass that could allow attackers to circumvent security restrictions.

The second flaw, CVE-2026-111560, is a command injection vulnerability affecting multiple Barracuda products, including:

• Email Security Gateway
• Load Balancer Application Delivery Controller
• Message Archiver
• Web Application Firewall
• WAF Control Center
• Web Security Gateway

When exploited together, the vulnerabilities could allow attackers to bypass authorization controls and obtain root access to affected devices.

Administrative Interface Access Required

Barracuda clarified that successful exploitation requires attackers to have access to the administrative interface of an affected product.

Therefore, devices whose administrative interfaces are not exposed to the internet are less vulnerable to this particular attack path.

The company recommends restricting administrative access to trusted internal networks and implementing appropriate network access controls.

Barracuda Releases Security Patches

Barracuda has released firmware updates addressing both vulnerabilities. Customers are advised to verify their installed firmware versions and ensure that all applicable security patches have been applied.

Organizations running outdated firmware may need to perform multiple updates before reaching the latest supported version. Barracuda also recommends enabling automatic patching where possible.

The post Barracuda Vulnerabilities Could Allow Attackers to Gain Root Access appeared first on First Hackers News.

The research was scheduled to be presented at OffensiveCon in Tokyo on October 28, 2026. It focuses on weaknesses in Telegram’s sticker-processing code and the possibility of bypassing checks designed to block unsafe content.

The findings come amid an earlier disagreement between Telegram and the Zero Day Initiative (ZDI) over a separate security issue involving the same animation-processing technology.

Researchers Investigate Telegram’s Sticker Protection

Animated stickers may look harmless, but the application must process their underlying data before displaying them. If that processing code contains a memory-handling error, specially crafted content could potentially trigger unexpected behavior.

ZDI previously documented a Telegram vulnerability as CVE-2026-111105. The issue affects the rlottie library and involves incorrect handling of numeric values that can result in a memory write outside its intended boundaries.

Telegram argued that checks performed on its servers reduced the likelihood of exploitation. However, the vulnerability report raised concerns about weaknesses that remained in the application itself.

Aziz’s investigation reportedly went further by examining both the animation library and the way Telegram handles incoming stickers. He says he discovered several memory-corruption and logic issues across different Telegram clients.

The reported research suggests that combining these weaknesses could allow an attacker to bypass existing safeguards and execute code on iOS. The exact exploit requirements and impact still need to be established through the full technical disclosure.

How Multiple Weaknesses Could Form an Attack Chain

The research focuses on more than one potential security weakness. Rather than relying on a single bug, the reported method combines problems in animation processing with flaws in the handling and validation of sticker content.

The main areas of concern include:

• Memory safety: Incorrect processing of animation data may cause memory corruption.
• Content validation: Weaknesses in sticker delivery or checking could allow unexpected data to reach vulnerable code.
• Exploit chaining: Combining separate bugs may overcome protections that limit the impact of an individual vulnerability.
• Cross-platform exposure: The researcher reported findings involving iOS, Android, and Desktop versions of Telegram.

These claims are based on the research abstract, not a fully verified technical demonstration. The available information does not establish whether the newly reported issues have been patched or whether attacks have occurred in the wild.

Previous reports have also linked Telegram’s sticker-processing components to application crashes and other security weaknesses. However, those earlier findings are separate from the latest claimed iOS attack chain.

Steps Users and Security Teams Should Take

Until more technical details become available, Telegram users should keep their applications updated and remain cautious when receiving unexpected content.

Recommended precautions include:

• Install the latest Telegram version available for your device.
• Review privacy settings for messages, groups, and unknown contacts.
• Avoid interacting with suspicious content from unfamiliar accounts.
• Monitor official Telegram security announcements for confirmed fixes.

Application developers should also ensure that security checks are enforced within client software rather than relying entirely on server-side filtering.

The key takeaway: A media-processing vulnerability can become more serious when combined with weaknesses elsewhere in an application. However, the severity of this reported Telegram attack cannot be confirmed until the full technical findings and remediation status are available.

The post New Telegram Zero-Click Exploit Targets iOS Devices Through Stickers appeared first on First Hackers News.

The vulnerability is particularly concerning because it can be exploited without authentication. An attacker who reaches a vulnerable Management Server may be able to upload and execute malicious scripts and load arbitrary Java classes.

Since these systems are used to manage security policies and collect information across enterprise networks, a successful compromise could give an attacker access to a highly privileged part of the security environment.

How the Zero-Day Works

CVE-2026-93616 involves a combination of directory traversal and unsafe file-upload behavior in the Check Point Management web service.

An attacker can manipulate file paths to make the service access files from unintended locations. According to Check Point, the vulnerability can also allow an attacker to load an arbitrary Java class without first logging in.

Check Point said it has observed a small number of targeted attacks. The company reported that the activity began before the vulnerability was publicly disclosed, which is why it is classified as a zero-day. The vendor has not publicly identified the attackers or disclosed the full objectives of the observed attacks.

Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent.

Which Versions Are Affected?

Check Point lists several affected releases, including older and currently supported versions. Administrators should check their exact release and Jumbo Hotfix level against the vendor’s advisory before deciding whether their systems are vulnerable.

Check Point says the fix is included in:

• R82.10 Take 45
• R82 Take 127
• R81.20 Take 170
• R81.10 Take 192

The company has also released an R82.20 Security Hotfix. Smart-1 Cloud is not affected because the required fix has already been applied.

What Security Teams Should Do

Organizations running affected Check Point Management products should prioritize applying the appropriate security update.

Until systems can be patched, Check Point recommends keeping Management Servers behind a Security Gateway or firewall and restricting TCP port 19009 to trusted IP addresses. Trusted Clients configured in SmartConsole should also be limited to known internal addresses.

Security teams should also review logs for signs of exploitation rather than checking only internet-facing systems. Check Point provides indicators and investigation guidance that can help identify suspicious activity.

If a vulnerable Management Server shows signs of compromise, teams should preserve relevant logs and forensic data, investigate activity that occurred after the initial access, and contact Check Point Support.

The active exploitation of this vulnerability shows why management infrastructure deserves the same patching priority as internet-facing security appliances. A compromised management server can potentially provide an attacker with access to a central administrative layer of an organization’s security environment.

The post Active Attacks Target Check Point 0-Day appeared first on First Hackers News.

Security researchers at Proofpoint have observed the toolkit being used against government agencies, defense organizations, and businesses across different regions. At least four threat clusters have adopted the capability since late August 2026, with several showing possible links to China.

The rapid adoption of the toolkit is raising concerns about how quickly sophisticated browser-based attacks can now move from development into real-world campaigns.

Multiple Threat Groups Adopt BlueMoon

The earliest confirmed BlueMoon activity was linked to TA412, also known as Violet Typhoon or APT31, on August 28, 2026.

Other threat clusters began using the same exploit capability shortly afterward, suggesting that the toolkit may have been shared, purchased, or made available through a common supply channel.

The groups have targeted organizations in several sectors, including government, aerospace, defense, finance, mining, and manufacturing.

How the BlueMoon Attack Works

BlueMoon combines multiple vulnerabilities to move from a browser compromise to higher privileges on Windows.

The attack begins with a vulnerability in Chromium’s V8 JavaScript engine, tracked as CVE-2026-85046. The flaw involves incorrect handling of data types and can be abused to execute malicious code inside the Chrome renderer.

The attackers then attempt to break out of the browser’s security sandbox.

A second V8 weakness is used to manipulate WebAssembly-related information and replace compiled code with attacker-controlled shellcode.

The final step uses CVE-2026-85880, a Windows kernel privilege-escalation vulnerability. By abusing Windows components including Advanced Local Procedure Call and Windows Notification Facility mechanisms, attackers can obtain powerful kernel-level read/write capabilities.

Together, these vulnerabilities create a path from a browser-based compromise to elevated access on the Windows system.

The Patch-Gap Problem

One of the most concerning aspects of BlueMoon is how the Chrome vulnerabilities were obtained.

Proofpoint describes the Chrome flaws as patch-gap zero-days. In these cases, fixes were already visible in Chromium’s publicly available source code, but the corresponding patches had not yet reached stable browser releases.

This created a limited period in which attackers could study the changes, understand the underlying vulnerabilities, and develop working exploits before most users received the security update.

For organizations that delay browser updates, even a short patch window can create meaningful exposure.

Signs of Rapid Development

Researchers found several indications that BlueMoon may have been assembled quickly rather than being the result of a long-running development effort.

For example, the Windows privilege-escalation component does not work against every Windows version. Its compatibility is largely limited to older builds, including Windows 10 and Windows Server 2019 and 2022.

The infrastructure supporting several campaigns was also registered shortly before it was used.

Another unusual characteristic is the payload delivery method. Instead of relying on a highly concealed mechanism, the exploit can ultimately execute a simple curl command to download and run an attacker-controlled file.

While effective, this approach can leave useful indicators for endpoint and network security systems.

Possible Signs of AI-Assisted Development

Proofpoint also identified technical artifacts that could indicate the use of AI-assisted development during parts of the exploit creation process.

The researchers found extensive diagnostic information, detailed debugging comments, and a referenced Markdown handover document.

The code also contains references to Google’s v8CTF bug bounty framework. Researchers have not determined whether these references came from legitimate vulnerability research or were intended to influence AI systems involved in exploit development.

The findings highlight a broader concern: AI-assisted development could potentially reduce the time and effort required to turn publicly available vulnerability information into working attack tools.

TA412 Uses Fake Academic Outreach

TA412 used social engineering messages designed to appear related to university internships and academic conferences.

The campaigns targeted organizations including U.S. nongovernmental organizations, mining companies, and commodity trading businesses.

After gaining access, the attackers deployed a malicious Chrome extension disguised as Google Gemini. Proofpoint tracks the extension as GemStone.

The extension provides attackers with extensive browser surveillance capabilities, including:

• Keystroke monitoring
• Cookie theft
• Screenshot collection
• Remote HTTP communications

This gives attackers the ability to monitor browser activity while maintaining access to information handled through the compromised environment.

Other BlueMoon Campaigns

BlueMoon has also appeared in campaigns associated with several other threat clusters.

UNK_LateNight targeted U.S. aerospace organizations using defense-related procurement themes. The campaign ultimately delivered the ShadowPad backdoor through a DLL side-loading technique.

UNK_DoubleCheck compromised an email account belonging to a Southeast Asian government organization and used it to target a Vietnamese manufacturing company with a Rust-based loader.

Meanwhile, UNK_QuietRacket targeted government and financial organizations in Indonesia and Singapore. Its campaigns used conference-related phishing themes and DNS-over-HTTPS communication for command-and-control activity.

Why BlueMoon Matters

BlueMoon demonstrates how dangerous the combination of browser and operating system vulnerabilities can become.

A single browser flaw may initially provide limited access, but chaining it with a sandbox escape and Windows privilege escalation can dramatically increase the attacker’s control over a device.

The rapid appearance of the same exploit capability across several threat groups is also significant. It could indicate the emergence of a shared market or distribution model for advanced exploitation tools.

This would make sophisticated browser attacks available to a wider range of threat actors rather than only highly specialized teams.

What Security Teams Should Do

Organizations should treat browser and operating system patching as part of the same security priority.

Security teams should:

• Keep Chrome and other Chromium-based browsers fully updated
• Maintain supported Windows versions
• Prioritize patching when fixes become available
• Monitor suspicious browser processes and command execution
• Detect unusual use of tools such as curl from browser-related processes
• Watch for malicious browser extensions
• Monitor DLL side-loading activity
• Investigate unusual DNS-over-HTTPS traffic
• Strengthen phishing protection and user awareness

Endpoint detection and response platforms should also be configured to identify abnormal relationships between browsers, command-line tools, downloaded files, and privilege-escalation activity.

The Bigger Security Trend

BlueMoon points to a changing threat landscape where attackers can combine publicly observable code changes, browser vulnerabilities, and operating system flaws into complete exploitation chains.

The speed at which different threat groups adopted the capability is particularly concerning. If exploit development becomes faster and more accessible through AI-assisted tools or shared underground resources, organizations may have less time to respond between vulnerability disclosure and active exploitation.

For security teams, the lesson is clear: patch quickly, monitor browser activity closely, and treat the browser as a critical part of the enterprise attack surface.

The post BlueMoon Exploit Kit Uses Chrome and Windows Zero-Days appeared first on First Hackers News.

The vulnerabilities, identified as CVE-2026-15409 and CVE-2026-15410, were observed being exploited before public disclosure. Because of the active attacks, both flaws have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, emphasizing the need for immediate action.

Exploitation Chain

The first vulnerability allows an unauthenticated attacker to reach internal services that are normally protected from external access. This provides an entry point to the appliance and enables attackers to execute commands with limited privileges.

The second vulnerability can then be used to escalate those privileges to root by abusing the appliance’s update and rollback process. Once exploited, attackers can run malicious scripts with full administrative permissions, giving them complete control over the system. Researchers also noted that the appliance may reboot after exploitation, which can make incident investigation more difficult.

Affected products include SonicWall SMA 1000 Series devices running vulnerable releases in the 12.4.3 and 12.5.0 software branches. SonicWall has confirmed that the SMA 100 Series and SSL VPN functionality on SonicWall firewalls are not affected.

Security Recommendations

Organizations using affected SonicWall SMA 1000 appliances should install the latest security hotfixes released by SonicWall as soon as possible, as no alternative mitigation is currently available.

In addition to patching, security teams should inspect appliances for signs of compromise, re-image affected systems if necessary, rotate administrator and user credentials, reset multi-factor authentication tokens following a confirmed breach, and continue monitoring VPN infrastructure for suspicious activity.

Applying the latest updates and reviewing exposed appliances promptly will help reduce the risk of compromise from these actively exploited vulnerabilities.

The post Attackers Target SonicWall SMA1000 Zero-Days appeared first on First Hackers News.

Security researchers warn that the vulnerabilities could allow attackers to escalate privileges, disrupt systems, and strengthen post-exploitation attacks inside compromised environments.

Privilege Escalation Flaw in Microsoft Defender

The most critical vulnerability, CVE-2026-41091, is an elevation of privilege flaw with a CVSS score of 7.8. The issue is caused by improper link resolution before file access, a weakness categorized under CWE-59.

According to Microsoft, attackers with limited access to a system can exploit the flaw locally to gain higher privileges without requiring user interaction. Because the vulnerability has low attack complexity, it becomes especially dangerous once threat actors gain initial access through phishing, malware infections, or another compromised application.

Successful exploitation could allow attackers to:

• Gain elevated system privileges
• Access sensitive information
• Modify security settings or disable protections

Microsoft confirmed that exploitation activity has already been detected in the wild, making rapid patching critical for affected environments.

Denial-of-Service Vulnerability and Security Risks

The second flaw, CVE-2026-45498, is a denial-of-service vulnerability with a lower CVSS score of 4.0. Despite its lower severity rating, Microsoft also confirmed active exploitation attempts targeting this issue.

The vulnerability can cause systems running Microsoft Defender to become unstable or unresponsive. Although it does not directly impact confidentiality or integrity, disrupting endpoint security services can weaken defensive visibility and create opportunities for additional attacks.

Researchers noted that both vulnerabilities share several high-risk characteristics:

• No user interaction required
• Low attack complexity
• Active exploitation already observed

Security experts believe the privilege escalation flaw could be used as part of larger attack chains in ransomware operations or advanced persistent threat (APT) campaigns. Attackers commonly use these techniques after gaining initial access to move deeper into enterprise environments and maintain persistence.

Microsoft has released security updates addressing both vulnerabilities, and organizations are strongly advised to deploy patches immediately. Security teams should also monitor endpoint logs, investigate suspicious privilege escalation activity, and strengthen endpoint detection and response capabilities.

The disclosure highlights an ongoing cybersecurity challenge where even widely trusted security products can themselves become targets for advanced attackers.

The post Microsoft Defender Zero-Day Discovered appeared first on First Hackers News.

Attack Execution and Evasion Techniques

The malicious PDF is designed to evade traditional detection mechanisms. Initial samples showed extremely low detection rates, indicating that the payload is carefully crafted to bypass antivirus engines.

Once opened, the document executes obfuscated JavaScript hidden within its structure. This script leverages legitimate application functions to interact with the system and external servers, making the activity appear less suspicious.

Key attack characteristics:

• Uses heavily obfuscated JavaScript to avoid detection
• Leverages trusted application APIs for malicious actions
• Collects system-level data to profile the victim environment
• Communicates with external infrastructure to exfiltrate data
• Maintains in-memory execution to reduce forensic traces

The attack chain is adaptive. Based on the victim’s system profile, the attacker may choose to deliver additional payloads, increasing the likelihood of a successful compromise.

Impact and Exploitation Capabilities

This vulnerability presents a high-risk scenario due to its stealth and ease of exploitation. No advanced interaction is required, making it highly effective in phishing campaigns or targeted attacks.

‍Follow Us on:Linkedin, Instagram, Facebook to get the latest security news!

Potential impact includes:

• Unauthorized access to sensitive local files
• Exposure of system and environment information
• Remote code execution leading to full system compromise
• Possible sandbox escape, bypassing built-in protections

In controlled testing, researchers confirmed that the communication channel used by the malware can support delivery of further payloads, enabling deeper system control.

Defensive Measures and Monitoring

With no official patch currently available, proactive defense becomes critical. Organizations must rely on layered security controls and behavioral monitoring to detect and mitigate threats.

Recommended defensive strategies:

• Block known malicious endpoints and monitor for new suspicious connections
• Inspect outbound traffic for unusual patterns linked to PDF processes
• Detect anomalies in application behavior, especially unexpected file access
• Monitor for suspicious User-Agent strings such as “Adobe Synchronizer”
• Restrict execution of active content within PDF files where possible

Operational Security Considerations

This incident highlights a broader trend of attackers weaponizing trusted file formats like PDFs to deliver advanced exploits. Since these files are widely used in business environments, they present an effective entry point.

Security teams should strengthen awareness around file-based threats and ensure that users are trained to handle unsolicited documents with caution. Developers and defenders alike must also stay updated with threat intelligence to quickly adapt to evolving attack techniques.

Until an official patch is released, maintaining strict control over document handling and network activity is essential to minimizing risk.

The post Adobe Reader Zero-Day Targets Users appeared first on First Hackers News.

Cisco’s security response team has confirmed real-world attacks and advises customers to take immediate action.

How the Attack Works

The issue originates in the web-based management interface, where HTTP request input is not properly validated.

Attackers can exploit this weakness by:

• Sending crafted HTTP requests to the management endpoint
• Bypassing authentication controls
• Executing commands on the operating system
• Escalating privileges to full root access

Because the flaw allows complete system takeover, Cisco classified it as Critical, prioritizing impact over traditional scoring metrics.

Impacted Cisco Products

Cisco confirmed the following products are affected, independent of configuration:

Other Cisco UC components, including Contact Center-related platforms, are confirmed not vulnerable.

Software Updates and Fix Availability

Cisco has released fixes for supported versions. Only the releases listed below are validated by Cisco PSIRT.

Unified CM, IM&P, SME, Webex Calling

Unity Connection

Cisco has observed attackers targeting unpatched deployments, likely using automated discovery techniques to locate exposed management interfaces. Environments supporting enterprise voice and collaboration services are particularly attractive targets.

The vulnerability has also been added to CISA’s Known Exploited Vulnerabilities catalog, increasing compliance pressure for affected organizations.

What Cisco Recommends

Organizations should take the following steps immediately:

• Apply Cisco security updates or upgrade to fixed releases
• Restrict access to management interfaces using network controls
• Monitor HTTP activity for abnormal request patterns
• Investigate systems for indicators of compromise

The post Cisco Unified Communications Zero-Day RCE Enables Root Access appeared first on First Hackers News.

If real, this bug could break Apple’s latest security protections and allow attackers to gain root access on modern iPhones and iPads without any user action. The seller describes it as a full-chain exploit, meaning it can move from initial entry to complete device takeover.

They also claim the attack works through malformed messages, making it a zero-click exploit that triggers as soon as the victim receives the data. The issue is described as a memory-corruption bug, a recurring weakness in complex parsing systems despite recent security improvements.

The listing claims the exploit can bypass iOS 26’s new multi-layer protections and gain full root access, exposing sensitive data like messages, photos, location, and keychain items. The seller also says it runs with high stealth and causes no crashes or alerts, making it difficult to detect.

New iOS 26 Flaw Raises Questions

iOS 26 was released in September 2025 and was promoted as a major security upgrade. Apple added new protections to strengthen the kernel and reduce memory-related vulnerabilities — the same type of flaw ResearcherX claims to have exploited.

If the listing is real, it suggests attackers may have already found ways around these new defenses. Working iOS zero-day chains on the dark web often sell for millions, usually between $2 million and $5 million. ResearcherX labeled this one as an “Exclusive Sale,” meaning it would be sold to only one buyer, likely a nation-state or private intelligence group.

Experts warn that many dark web listings are fake, even from “verified” sellers. Still, the mention of the iOS Message Parser fits with past iOS attack methods, where components like iMessage have been common targets.

Security researchers advise organizations and high-risk users to watch for quick patch releases, such as iOS 26.0.2, which may fix issues related to message-parsing vulnerabilities.

‍Follow Us on: Linkedin, Instagram, Facebook to get the latest security news!

The post Threat Actors List iOS 26 Full-Chain 0-Day on Dark Web appeared first on First Hackers News.