TheNde
Security· · 2 min

Zero-Day Exploits on the Rise.

Today’s cybersecurity landscape is buzzing with vulnerabilities, new malware, and a surge in phishing attacks. Key players like Palo Alto Networks and Ivanti are in the spotlight due to serious zero-day exploits. Meanwhile, innovative startups like Boost Security are securing funding to tackle SDLC threats head-on.

In brief
  1. Zero-Day Exploits on the Rise
  2. Malware Madness: New Threats Emerge
  3. Phishing: A New AI-Driven Playbook
01 · Security

Zero-Day Exploits on the Rise

Palo Alto Networks under fire for zero-day exploits.
Palo Alto Networks under fire for zero-day exploits.

Palo Alto Networks is reeling from a zero-day vulnerability that’s been actively exploited for weeks. Tracked as CVE-2026-0300, it allows remote code execution. This exploit highlights the ongoing threat from state-sponsored hackers, particularly those believed to be linked to China.

Ivanti is also sounding the alarm, warning of a high-severity vulnerability in its EPMM software. This flaw is under active exploitation, allowing attackers with admin credentials to execute arbitrary code. Both incidents underscore a growing trend of zero-day vulnerabilities being targeted effectively in the wild.

02 · Security

Malware Madness: New Threats Emerge

Fake Claude AI site spreads malware.
Fake Claude AI site spreads malware.

A fake Claude AI site has surfaced, delivering the Beagle malware to unsuspecting users. This clever ruse demonstrates how threat actors are leveraging well-known brands to spread malicious software.

Meanwhile, reports of the PCPJack worm are on the rise, exploiting multiple vulnerabilities to steal credentials across cloud systems. This worm could indicate a new wave of credential theft targeting cloud infrastructures.

03 · Security

Phishing: A New AI-Driven Playbook

Vercel abused for phishing campaigns.
Vercel abused for phishing campaigns.

Researchers have noticed a spike in phishing campaigns utilizing Vercel, a platform that enables users to create convincing fake websites. These low-skill attackers are harnessing generative AI to craft realistic phishing pages with minimal effort.

As cybercrime evolves, traditional defenses are being bypassed. Organizations need to rethink their security strategies to counteract these innovative threats effectively.

04 · Security

New Developments in Cybersecurity Funding

Boost Security secures funding to combat SDLC vulnerabilities.
Boost Security secures funding to combat SDLC vulnerabilities.

Boost Security just raised $4 million to enhance its SDLC defense platform, bringing its total funding to $16 million. The company aims to secure developer endpoints and the software supply chain through AI-driven solutions.

This influx of capital highlights the increasing demand for robust security measures as software vulnerabilities continue to rise amidst a growing development landscape.

Key numbers
$4M

Boost Security raised this amount to enhance its defense platform against software supply chain threats.

Source
60%

This percentage of passwords can be cracked in under a minute according to recent research.

Source
18 months

Two U.S. nationals were sentenced to this time for operating 'laptop farms' aiding North Korean IT workers.

Source
Top stories
Bleeping Computer

Palo Alto Networks Firewall Zero-Day Exploited

A critical zero-day vulnerability in Palo Alto's PAN-OS has been exploited by suspected state-sponsored hackers. The flaw allows for unauthenticated remote code execution, and remediation efforts are underway after weeks of exploitation.

Bleeping Computer

Ivanti EPMM Vulnerability Under Active Exploitation

Ivanti has issued a warning regarding a high-severity RCE vulnerability in its Endpoint Manager Mobile software. This flaw, tracked as CVE-2026-6973, is actively being exploited in the wild, and users are urged to patch their systems immediately.

Quick links
  1. Daemon Tools Developer Confirms Trojanized SoftwareThe developer of Daemon Tools has confirmed that its software was compromised and has released a malware-free version. — Infosecurity Magazine
  2. ClickFix Attacks Target Australian InfrastructureAustralia's cybersecurity center warns of ClickFix attacks that trick users into executing malicious commands leading to Vidar Stealer infections. — Bleeping Computer
  3. Gemini CLI Vulnerability Could Have Led to Supply Chain AttackA critical vulnerability in Gemini CLI could have allowed attackers to exploit it for a supply chain attack. — Security Week
  4. Researchers Spot Uptick in Vercel for PhishingCofense warns of low-skilled threat actors using Vercel to create convincing phishing campaigns with ease. — Infosecurity Magazine
  5. Crypto Gang Member Sentenced for $230 Million HeistA member of a cryptocurrency gang received a 6.5-year sentence for his involvement in a massive digital heist. — Bleeping Computer
  6. Smart Glasses for Authorities Under DevelopmentICE is reportedly developing smart glasses integrated with facial recognition technology for law enforcement. — Schneier on Security
  7. Day Zero Readiness: Breaking Incident Response GapsA new report discusses the operational gaps that hinder effective incident response in cybersecurity. — The Hacker News