Zero Day Wire

Alerts

Automated Attacks Hijacking FortiGate Firewalls via SSO Exploitation

A wave of automated attacks is actively compromising FortiGate firewalls through malicious SSO logins, with threat actors creating persistence accounts and exfiltrating device configurations within seconds of initial access. Arctic Wolf began tracking the campaign on January 15, 2026, and warns the situation remains developing. Attack Chain The intrusions follow

Threats

North Korea's Andariel Unveils New Malware Arsenal in 2025 Cyberattacks

While much of the security industry's attention has been fixed on North Korea's sprawling IT worker infiltration schemes, Pyongyang's traditional cyber espionage units have been far from idle. New research from WithSecure reveals that Andariel—a state-sponsored group linked to the RGB's

Alerts

Critical Code Injection Flaw in Orval Threatens JavaScript Supply Chain (CVE-2026-23947)

Developers using Orval to generate type-safe clients from OpenAPI specifications are being urged to update immediately after the discovery of a critical code injection vulnerability that threatens the JavaScript supply chain. The flaw, tracked as CVE-2026-23947, carries a CVSS score of 9.3 and allows attackers to execute arbitrary code

Alerts

Cisco Unified Communications Zero-Day Exploited in the Wild for Root Access (CVE-2026-20045)

Cisco has disclosed a critical zero-day vulnerability in its Unified Communications products that is being actively exploited in the wild, allowing unauthenticated attackers to execute arbitrary commands and gain root access on affected systems. The vulnerability, tracked as CVE-2026-20045, affects the web-based management interface of multiple Cisco UC products. Cisco&

Alerts

Google Chrome 144 Patches High-Severity V8 Race Condition (CVE-2026-1220)

Google has released a security update for Chrome addressing a high-severity vulnerability in the V8 JavaScript engine that powers the browser. The flaw, tracked as CVE-2026-1220, is a race condition in V8—the component responsible for executing JavaScript code. Race conditions occur when the timing of operations can be exploited

Threats

CISA, NSA Warn of Chinese BRICKSTORM Malware Targeting Government and IT Sectors

CISA, the NSA, and the Canadian Centre for Cyber Security have issued a joint malware analysis report warning that Chinese state-sponsored actors are using BRICKSTORM, a sophisticated backdoor designed for long-term persistence in VMware vSphere and Windows environments. The advisory, first published in December 2025 and updated with additional samples,

Alerts

Critical Zoom Flaw Allows Meeting Participants to Execute Code on Enterprise Servers (CVE-2026-22844)

Zoom has disclosed a critical command injection vulnerability affecting its enterprise hybrid meeting infrastructure that could allow a meeting participant to execute arbitrary code on backend servers. The vulnerability, tracked as CVE-2026-22844, carries a CVSS score of 9.9 and affects Zoom Node Multimedia Routers (MMRs)—the components responsible for

Alerts

Oracle January 2026 Critical Patch Update Fixes 336 Vulnerabilities Including CVSS 10.0 Fusion Middleware Flaw

Oracle has released its January 2026 Critical Patch Update (CPU), addressing 336 new security vulnerabilities across its enterprise software portfolio. Among the most severe is a maximum-severity flaw in Oracle Fusion Middleware that could allow attackers to seize complete control of affected servers without authentication. The Critical Flaw The vulnerability,

Threats

Microsoft Teams Gets External Domain Anomaly Detection to Combat Social Engineering Attacks

Microsoft is introducing the External Domains Anomalies Report for Teams, a security feature designed to help administrators identify suspicious external communications before they escalate into breaches. The tool, scheduled for global rollout in February 2026, addresses a critical gap as threat actors increasingly exploit Teams for social engineering campaigns. How

Threats

Iran's Cyber Forces Shift from Espionage to Infrastructure Pre-Positioning

Iranian state-sponsored hacking groups have significantly escalated their operations against U.S. and Israeli targets over the past year, shifting from opportunistic cyber espionage to sustained campaigns aimed at critical infrastructure, cloud environments, and supply chains. The shift reflects what security researchers describe as the full militarization of Iran'

Threats

North Korean Hackers Hide Multi-Stage Malware in npm Package Targeting Developers

North Korea's Lazarus Group is targeting software developers through fake job recruiters on LinkedIn, Fiverr, and UpWork, delivering a three-stage malware attack via a malicious npm package. Security researchers at OpenSourceMalware uncovered the campaign, which uses the package tailwindcss-forms-kit - disguised as a legitimate Tailwind CSS utility -

Threats

IntelBroker Unmasked: Notorious Hacker Revealed as 25-Year-Old Former UK Crime Agency Trainee

The identity behind one of the most prolific cybercriminal personas of recent years has been revealed. IntelBroker, the hacker who haunted major corporations and government agencies, is Kai Logan West - a 25-year-old British national and former National Crime Agency trainee. West was arrested in France in February 2025 and