ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Keywords match titles. Record type separates incidents, intel, and research from CVEs.

  1. Research · Oct 10, 2026 · Krebs on Security

    FBI Arrests Co-Founder of Cybersecurity Firm Linked to ShinyHunters

    The FBI has arrested a co-founder of a Canadian cybersecurity firm as part of an investigation into the ShinyHunters hacking group, which recently compromised sensitive FBI data.

    What changed

    The FBI has taken significant action by arresting an executive from a cybersecurity firm involved in ransomware negotiations. This arrest is part of a broader investigation into the ShinyHunters group, which has been implicated in the theft of sensitive information from the FBI.

    This development raises concerns about the security practices of firms involved in negotiating with ransomware groups and their potential vulnerabilities.

    Who is affected

    The arrest may have implications for various stakeholders in the cybersecurity landscape, particularly those involved in ransomware negotiations.

    Key affected parties include:

    • Canadian cybersecurity firms involved in ransomware negotiations.
    • Organizations that may rely on these firms for incident response and threat mitigation.
    • Government agencies, including the FBI, which are directly impacted by data breaches.
    • Companies that have been targeted by the ShinyHunters group or similar hacking collectives.

    What to do

    Organizations should review their cybersecurity protocols and ensure that their incident response strategies are robust against ransomware threats.

    It is advisable to stay informed about the ongoing investigation and assess any potential risks associated with third-party cybersecurity firms.

    • Enhance monitoring of third-party vendors and their security practices.
    • Conduct thorough risk assessments related to ransomware negotiations.
    • Implement stronger data protection measures to safeguard sensitive information.

    Original report

  2. Research · Sep 30, 2026 · ZeroDay Catalog

    Critical Vulnerabilities Identified in Zammad Session Management

    Zammad GmbH has reported critical session fixation and privilege management vulnerabilities, now acknowledged by CISA as actively exploited.

    What changed

    Zammad GmbH has disclosed two significant vulnerabilities in its Zammad product, specifically a session fixation vulnerability (CVE-2026-102489) and an improper privilege management vulnerability (CVE-2026-102490). These vulnerabilities have been added to CISA's Known Exploited Vulnerabilities Catalog due to evidence indicating active exploitation in the wild.

    • CVE-2026-102489: Session Fixation Vulnerability
    • CVE-2026-102490: Improper Privilege Management Vulnerability
    • Both vulnerabilities pose a risk of unauthorized access and privilege escalation.

    Who is affected

    Organizations utilizing Zammad for customer support and ticketing systems are at risk due to these vulnerabilities. The potential impact could compromise sensitive user data and system integrity.

    • Zammad GmbH's Zammad product users
    • Businesses relying on Zammad for customer service operations
    • IT departments managing Zammad installations
    • Any organization that integrates Zammad with other systems

    What to do

    Immediate action is recommended for all users of Zammad to mitigate the risks associated with these vulnerabilities. Organizations should prioritize updates and apply security patches as they become available.

    • Monitor CISA and Zammad's official channels for updates and patches.
    • Conduct a security audit of Zammad implementations to assess exposure.
    • Implement additional security measures, such as session management best practices.
    • Educate staff on the risks associated with session fixation and privilege management.

    Original report