ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Oct 16, 2026 · SecurityWeek

    Emerging Threats: ICS-Sniper Attack and XWorm Malware Operators Targeted

    Recent developments highlight significant threats including the ICS-Sniper attack and efforts to combat XWorm malware operators, alongside a lucrative Chrome exploit.

    What changed

    Recent reports have surfaced detailing an ongoing ICS-Sniper attack, which poses a serious risk to industrial control systems. Additionally, efforts to dismantle XWorm malware operations are underway, reflecting a proactive approach to cybersecurity.

    A notable Chrome exploit has emerged, with a bounty of $250,000 offered for its discovery, indicating the high stakes involved in browser security.

    • Increased focus on protecting industrial control systems from targeted attacks.
    • Heightened awareness and response to the XWorm malware threat.
    • Significant financial incentives for identifying critical vulnerabilities in widely-used software.

    Who is affected

    Various sectors are at risk due to these emerging threats, particularly those relying on industrial control systems and web browsers.

    Organizations using Chrome are particularly vulnerable to the newly identified exploit, necessitating immediate attention.

    • Industrial control system operators facing ICS-Sniper attacks.
    • Organizations utilizing Chrome that may be impacted by the new exploit.
    • Cybersecurity teams tasked with monitoring and responding to malware threats like XWorm.

    What to do

    Organizations should prioritize the assessment of their industrial control systems and implement robust security measures to mitigate the risks associated with ICS-Sniper attacks.

    For Chrome users, it is advisable to stay updated with the latest patches and security advisories to protect against the newly discovered exploit.

    • Conduct a thorough review of ICS security protocols and incident response plans.
    • Ensure that all software, particularly web browsers, are up-to-date with the latest security patches.
    • Monitor threat intelligence sources for updates on XWorm malware and related vulnerabilities.

    Original report

  2. Oct 16, 2026 · Help Net Security

    Malware Exploits Typos in Arch Linux AUR Package Installation

    Recent findings reveal that malicious packages in the Arch Linux AUR can exploit user typos, potentially granting attackers root access to systems.

    What changed

    Malicious actors have taken advantage of typographical errors during the installation of AUR helpers like yay and paru. Users who inadvertently mistype these commands may unknowingly install compromised packages that grant root privileges to attackers.

    Who is affected

    This vulnerability primarily impacts users of Arch Linux and its derivatives who utilize the Arch User Repository (AUR) for software installation.

    The following groups are particularly at risk:

    • Arch Linux users who rely on AUR helpers like yay and paru.
    • Developers and maintainers of packages in the AUR.
    • Organizations using Arch Linux for development or production environments.
    • General users who may install packages from unverified sources.

    What to do

    Users are advised to exercise caution when installing packages from the AUR and to verify the authenticity of the packages before installation. It is recommended to double-check command inputs to avoid typos.

    Additionally, consider implementing the following measures:

    • Regularly audit installed packages for any unauthorized changes.
    • Utilize security tools to monitor for unusual activity on systems.
    • Stay informed about updates and advisories from Arch Linux and related communities.

    Original report