ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Oct 16, 2026 · Zero Day Initiative

    Critical Remote Code Execution Vulnerability in LibreOffice

    A significant remote code execution vulnerability has been identified in LibreOffice, requiring user interaction for exploitation.

    What changed

    A new vulnerability has been discovered in LibreOffice related to PDF file parsing, classified as an out-of-bounds write issue. This flaw allows remote attackers to execute arbitrary code on affected systems, posing a serious security risk.

    The vulnerability has been assigned a CVSS score of 7.8, indicating its high severity. Users must be cautious, as exploitation requires them to open a malicious file or visit a compromised webpage.

    Who is affected

    The vulnerability impacts users of LibreOffice across various platforms, making it a widespread concern for organizations relying on this software.

    Specifically, the following groups are at risk:

    • All users of LibreOffice versions that include the vulnerable PDF parsing functionality.
    • Organizations that utilize LibreOffice for document management and collaboration.
    • Individuals who frequently open PDF files from untrusted sources.

    What to do

    It is crucial for users and administrators to take immediate action to mitigate the risks associated with this vulnerability. Regular updates and security patches should be prioritized.

    Recommendations include:

    • Update LibreOffice to the latest version as soon as patches are available.
    • Educate users about the risks of opening files from unknown or untrusted sources.
    • Implement security measures such as email filtering and web protection to block malicious content.

    Original report

  2. Oct 15, 2026 · Infosecurity Magazine

    Critical Vulnerabilities Discovered in LiteLLM Gateway Tool

    Two high-risk vulnerabilities have been identified in LiteLLM, a tool widely used for connecting AI applications to major providers, posing significant risks to enterprises.

    What changed

    Recent assessments have revealed two critical vulnerabilities, CVE-2026-35029 and CVE-2026-59823, in the LiteLLM gateway tool. These vulnerabilities could potentially allow unauthorized access and manipulation of data transmitted between AI applications and service providers.

    Enterprises utilizing LiteLLM for integration with AI platforms such as OpenAI and Anthropic are particularly at risk, as these flaws compromise the security of sensitive information.

    Who is affected

    The vulnerabilities impact a range of organizations and products that rely on LiteLLM for AI application connectivity. Enterprises using this tool must be vigilant.

    Specifically, the following groups are at risk:

    • Organizations leveraging LiteLLM for AI integration.
    • Developers and IT teams managing AI applications connected to OpenAI.
    • Businesses utilizing LiteLLM to interface with Anthropic's services.
    • Any enterprise relying on LiteLLM for data transmission between AI systems.

    What to do

    Organizations should prioritize immediate assessment of their LiteLLM implementations to identify exposure to these vulnerabilities. It is crucial to apply any available patches or mitigations as soon as they are released.

    Additionally, monitoring for unusual activity and reviewing security protocols related to AI application connectivity is recommended.

    • Conduct a vulnerability assessment of LiteLLM deployments.
    • Implement security patches as they become available.
    • Enhance monitoring for suspicious activities related to AI integrations.
    • Review and strengthen security policies governing data transmission.

    Original report