A newly disclosed zero-day in GeoServer, the widely used open-source geospatial server, is already drawing exploitation attempts, according to watchTowr. The flaw is a SQL injection issue that can lead to remote code execution, and it remains unpatched, with no CVE assigned yet. It was first disclosed publicly by a researcher on August 12, and attackers commonly begin probing internet-facing servers as soon as such details appear. GeoServer instances are frequently exposed to the internet to serve mapping and location data, which makes an unpatched code-execution flaw in the platform an attractive and reachable target. Defenders should treat exposed instances as at risk until a fix ships.
Metabase warned that a critical zero-day in its open-source business intelligence platform was exploited in the wild for data theft. Scored 10.0 and tracked only as GHSA-vwf4-m7j8-wcjf with no CVE assigned, so scanners relying on the national database will not flag it, the flaw is an unauthenticated SQL injection in the password-reset endpoint. A remote attacker with no credentials injects SQL into the application database, gains administrator access, and can steal the stored credentials for every database the instance connects to, then read and export their data. Metabase Cloud was attacked from around August 3 and is already patched; self-hosted versions 1.58 and later must upgrade.
Incident response firm Volexity detailed how attackers chained two SonicWall SMA1000 flaws as zero-days weeks before the vendor disclosed them, reaching root and installing malware built specifically for the appliances. A previously unknown actor it tracks as UTA0533 began exploiting on June 22, nearly three weeks before the July 14 advisory. The chain starts with CVE-2026-15409 against the /wsproxy endpoint, letting an unauthenticated attacker open WebSocket tunnels to services meant to be reachable only from the appliance itself, then uses CVE-2026-15410 for command execution. With root, the actor could read stored credentials, capture traffic, and intercept credentials the appliance processes.
Less than an hour after Microsoft's July Patch Tuesday, the researcher known as Nightmare Eclipse published a proof-of-concept for LegacyHive, a Windows privilege-escalation flaw that works on fully updated systems. It abuses the Windows User Profile Service to let a standard user load another user's registry hive, including an administrator's, into their own profile, a useful stepping stone for an attacker who already has a foothold. There is no CVE, advisory, or patch. The public proof-of-concept was deliberately stripped down, needing extra credentials, but the researcher says the original had no such limits. Given this researcher's flaws have been weaponized quickly before, defenders should not wait for a fix.
Microsoft shipped its largest Patch Tuesday on record, fixing 622 vulnerabilities, more than triple June's previous high, and two of them are already being exploited. Both live bugs are privilege-escalation flaws in identity and collaboration infrastructure rather than flashy remote code execution: CVE-2026-56164 in on-premises SharePoint Server lets an unauthenticated attacker escalate over the network, and CVE-2026-56155 in Active Directory Federation Services lets an authenticated attacker gain higher privileges, both found by incident responders inside real attacks. A third zero-day, a BitLocker bypass needing physical access, was publicly disclosed but not exploited. The sheer volume, driven partly by AI-assisted bug finding, makes prioritizing by exploitation status, not severity score, essential this month.
The ShinyHunters data-theft wave against Oracle PeopleSoft, covered yesterday, now has a confirmed root cause: a zero-day. Oracle has issued an out-of-band emergency mitigation for CVE-2026-35273, a critical flaw (rated 9.8) in PeopleSoft PeopleTools that lets an unauthenticated attacker run code on the server over HTTP, with no login required. Google's Mandiant says the bug was exploited from May 27 to June 9, before any advisory existed, and notified more than 100 affected organizations, 68 percent of them universities. The exposed component is the Environment Management Hub. Affected versions are PeopleTools 8.61 and 8.62; a full patch is still pending.
The researcher known as Nightmare Eclipse has published a second unpatched Windows exploit in two days, this one defeating BitLocker disk encryption. Called GreatXML, it abuses the Windows Defender Offline Scan feature: any machine that has ever run an offline scan is left permanently vulnerable. An attacker with physical access copies a crafted unattend.xml file and a Recovery folder to the recovery partition, reboots into the Windows Recovery Environment with Shift plus Restart, and gets a privileged shell with full access to the encrypted drive, no login needed. Proof-of-concept code is public on GitHub, there is no patch yet, and Microsoft says it is investigating.
Microsoft's June 2026 Patch Tuesday is the largest on record, fixing more than 200 vulnerabilities (independent counts put the total above 206), including three publicly disclosed zero-days that are not yet being exploited. The standout is CVE-2026-45586, a Windows CTFMON elevation-of-privilege flaw that grants SYSTEM access, which matches the GreenPlasma bug a researcher dropped in protest of Microsoft's bug-bounty handling; a BitLocker bypass called YellowKey was also fixed. The update includes 33 critical flaws, most of them remote code execution, hitting Remote Desktop, Hyper-V, Office, and cryptographic services. Microsoft flagged 15 issues as more likely to be exploited soon.
Hours after Patch Tuesday, the researcher known as Nightmare Eclipse published a working exploit, dubbed RoguePlanet, for an unpatched Microsoft Defender flaw that opens a command prompt with full SYSTEM privileges on fully updated Windows 10 and 11. The bug is a race condition, so the exploit is hit or miss, but the researcher reports a 100 percent success rate on some machines. They posted the proof-of-concept on a self-hosted Git server after Microsoft had earlier taken down their GitHub and GitLab repositories. It is the latest in a string of Windows zero-days (BlueHammer, RedSun, YellowKey, GreenPlasma) the researcher has released in protest of Microsoft's disclosure practices.
Google has shipped an emergency Chrome fix for a zero-day in V8, the browser's JavaScript and WebAssembly engine, that attackers are already exploiting in the wild. The flaw (CVE-2026-11645, rated 8.8) is an out-of-bounds memory read and write that lets a malicious web page run code inside Chrome's sandbox, and can help defeat protections like ASLR to set up a fuller compromise. Google confirmed an exploit exists but withheld details until most users update. It is the fifth actively exploited Chrome zero-day of 2026. The fix is in Chrome 149.0.7827.102/103 for desktop; Chromium-based browsers like Edge and Brave need the same update.
TrustStrike Labs