ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Oct 16, 2026 · CSO Online

    Supply Chain Vulnerability Discovered in OpenAI Skills Repository

    A newly identified supply chain vulnerability in OpenAI's skills repository raises concerns about AI security and trust in vetted components.

    What changed

    Researchers have uncovered a significant supply chain vulnerability within OpenAI's official skills repository. This flaw involved a skill that directed applications to send sensitive tokens to an unregistered domain, potentially compromising production environments.

    • The vulnerability was introduced with a commit made in January.
    • The affected skill was designed to facilitate application deployment on Render.
    • The domain render-internal.com was registered by researchers to demonstrate the flaw.

    Who is affected

    The impact of this vulnerability extends to several stakeholders within the AI and cloud application ecosystem. Organizations utilizing OpenAI's skills for application deployment may be at risk.

    • OpenAI, as the maintainer of the skills repository.
    • Render, the platform for which the flawed skill was designed.
    • Developers and companies using OpenAI's skills to integrate AI into their applications.

    What to do

    Organizations should review their use of OpenAI skills and ensure that they are not inadvertently exposing sensitive information. It is crucial to stay informed about updates and patches related to this vulnerability.

    • Audit applications for any references to render-internal.com.
    • Ensure that the OpenAI skills being used are the latest versions post-fix.
    • Monitor for any unusual API calls or token transmissions from production applications.

    Original report

  2. Oct 16, 2026 · CyberScoop

    Chinese Espionage Group Targets BeyondTrust Zero-Day Vulnerability

    A new zero-day vulnerability in BeyondTrust products has been exploited by the Chinese espionage group Armory Castle, marking a significant escalation in their cyber operations.

    What changed

    A zero-day vulnerability in BeyondTrust products has been actively exploited by the Chinese espionage group known as Armory Castle, or UNC5221. This marks a concerning development in their ongoing cyber operations, which have previously targeted other vendors.

    The first known attack utilizing this vulnerability was reported approximately seven weeks ago, indicating a sustained interest in exploiting weaknesses in enterprise security solutions.

    Who is affected

    Organizations using BeyondTrust products are at heightened risk due to this zero-day vulnerability. The implications of this attack could extend to various sectors, particularly those relying on remote access and privilege management solutions.

    Additionally, previous targets of Armory Castle include customers of Ivanti and Citrix, suggesting that organizations in similar domains may also be vulnerable.

    • BeyondTrust products and services.
    • Ivanti customers who may have overlapping security solutions.
    • Citrix users potentially affected by similar attack vectors.

    What to do

    Security teams should prioritize assessing their environments for any signs of exploitation related to BeyondTrust products. Immediate action is necessary to mitigate potential risks associated with this vulnerability.

    Organizations are advised to monitor threat intelligence feeds for updates regarding this zero-day and to implement any available patches or mitigations as soon as they are released.

    • Conduct a thorough review of security configurations for BeyondTrust products.
    • Stay informed on updates from BeyondTrust regarding patches or mitigations.
    • Enhance monitoring for unusual activity that may indicate exploitation attempts.

    Original report