zero day8 articles
China's Armory Castle Hackers Quietly Owned BeyondTrust Servers for Weeks Before Anyone Noticed
A China-linked cyber espionage group called Armory Castle exploited a critical zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support in late August 2026, gaining unauthorised access to self-hosted appliances through an improper origin validation flaw in an internal messaging component. Following successful exploitation, the group deployed a PHP web shell, stole credentials, escalated privileges, moved laterally to downstream systems, and used a custom SOCKS5 proxy tool to tunnel traffic while systematically deleting logs to evade detection. BeyondTrust has since patched the flaw for SaaS customers and released a manual update for self-hosted users, urging that any internet-facing appliance running a vulnerable version during the exploitation window be treated as potentially compromised.
StyleSmuggler: Rust-Powered Backdoor Hits Adobe Commerce Stores via Unpatched Zero-Day
A zero-day vulnerability dubbed **StyleSmuggler** is being actively exploited in Adobe Commerce and Magento e-commerce platforms, allowing attackers to inject PHP code into Magento's template system and achieve remote code execution. The two-stage attack triggers a failed payment report to inject the code, then executes it via a payment failure email — requiring no user interaction. Successful attacks deploy a Rust-written backdoor that disguises itself as a legitimate system process and communicates with a command-and-control server, with exploitation observed since September 4; Adobe patches were expected on September 8, though it was unclear whether StyleSmuggler would be addressed.
SonicWall Zero-Days Sat Unpatched for Weeks While Hackers Quietly Planted Custom Malware
Two SonicWall zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) in SMA1000 appliances were exploited by a threat actor tracked as UTA0533 for several weeks before patches were released in July, with attacks beginning as early as June 22. The attackers deployed custom malware called KnuckleBall, which injected a Java webshell and an open-source proxy into legitimate processes, granting root access to credentials and network traffic. While SonicWall has since issued hotfixes and CISA has added the flaws to its Known Exploited Vulnerabilities catalog, the group's identity and motivation remain unclear, though the attack's sophistication suggests possible state-sponsored activity.
Estée Lauder Confirms Employee Data Stolen in Oracle EBS Zero-Day Attack
Estée Lauder has begun notifying employees that their personal data was stolen from its Oracle E-Business Suite (EBS) system in August 2025, when the Cl0p cybercrime group exploited a zero-day vulnerability (CVE-2025-61882) enabling unauthenticated remote code execution. The compromised data includes sensitive information such as Social Security numbers, passport numbers, bank account details, health information, and payroll data. The company is offering affected individuals 24 months of free identity monitoring and has notified law enforcement, though it has not disclosed how many people were impacted.
Unknown Threat Actor Chained SonicWall Zero-Days to Root Before Anyone Knew They Existed
A previously unknown threat actor (UTA0533) exploited two zero-day vulnerabilities — CVE-2026-15409 and CVE-2026-15410 — in SonicWall SMA 1000 series VPN appliances before patches were publicly released, chaining them together to achieve root-level access on compromised devices. The attacker deployed custom malware, including a web shell and HTTP proxy tool, modified startup scripts for persistence, and used packet capture utilities to steal LDAP credentials. While UTA0533 demonstrated advanced capability in compromising the appliances, evidence suggests they had limited success in moving laterally to other systems on the network.
Microsoft Threatened a Security Researcher With Criminal Charges. It Did Not Go Well.
An anonymous security researcher known as "Nightmare-Eclipse" published six zero-day exploits for unpatched Windows vulnerabilities after claiming Microsoft failed to address the reported bugs, prompting Microsoft's Security Response Center to condemn the actions and hint at potential criminal prosecution. This sparked widespread backlash from the cybersecurity community, with prominent researchers arguing that threatening legal action against security researchers discourages responsible disclosure and pushes researchers toward selling vulnerabilities to malicious actors instead. Microsoft subsequently walked back its position, clarifying it had no intention of pursuing action against researchers conducting legitimate security research.
KnowledgeDeliver Zero-Day Let Attackers Walk In With Keys They Already Had
Threat actors exploited a zero-day vulnerability (CVE-2026-5426) in KnowledgeDeliver, a widely used LMS, by leveraging hardcoded machineKey values in its ASP.NET configuration to mount ViewState deserialization attacks and deploy Godzilla web shells. The attackers used the web shells to modify system permissions, inject malicious scripts, and ultimately install a targeted Cobalt Strike backdoor, as reported by Mandiant. All KnowledgeDeliver deployments prior to February 24, 2026 are potentially at risk, and organisations are advised to rotate machine keys, restrict LMS access, and monitor for signs of intrusion.
One Researcher Is Making Microsoft's Life Very Difficult, Six Weeks Running
A security researcher known as "Nightmare Eclipse" has disclosed six Windows vulnerabilities over six weeks, including three new ones — YellowKey, GreenPlasma, and MiniPlasma — revealed shortly after Microsoft's May 2026 Patch Tuesday. These flaws target core Windows security components, enabling attacks such as BitLocker bypass, privilege escalation to SYSTEM, and exploitation of a vulnerability Microsoft believed it had patched in 2020. Microsoft has only officially patched one of the six flaws so far, and experts warn that the researcher's deliberate timing — releasing disclosures immediately after Patch Tuesday — maximises the window of exposure before the next patch cycle.