25 results for “zero-day”
Security researcher Nightmare Eclipse released the ShieldBreak zero-day exploit for Microsoft Defender, claiming it bypasses the July patch for CVE-2026-50656. The flaw grants SYSTEM privileges on fully patched Windows 11 and Server 2025 when Defender is enabled.
Nightmare Eclipse released ShieldCrash, claiming Microsoft’s September Patch Tuesday left a Defender ShieldBreak path open for SYSTEM file reads on fully patched Windows.
Modular computer maker Framework has notified every customer in its database that their personal information was compromised in a supply-chain breach. This breach illustrates the cascading risk of supply-chain dependencies for hardware.
Microsoft issued updates on 8 September 2026 for at least 974 security holes, its largest Patch Tuesday batch. AI is speeding discovery; testing and rollout remain the bottleneck.
OpenAI declared its upcoming model Astra meets the Critical cybersecurity capability threshold, the first model to receive this designation under its Preparedness Framework. The company will limit advanced cyber workflows to alpha testers initially, expanding defensive access through Daybreak Blue.
Trail of Bits tasked GPT-5.6-Cyber with escaping a QEMU/KVM VM on Debian 12. Over ~12 hours it broke out three times—kernel bug, unmarked libslirp, and a self-found 0-day chain—showing off-the-shelf VMs no longer contain such agents.
Cisco disclosed CVE-2026-76460 on September 16, 2026: a CVSS 10.0 authentication bypass in ISE and ISE-PIC that is under active exploitation. Fixed patches start at 3.1 Patch 12; no workarounds, only iACL mitigation until upgrade.
OpenAI said Friday it has suspended work on some aspects of its upcoming model Astra after internal evaluations found the system had made significant. The Astra disclosure arrives amid a cascade of security incidents across frontier AI.
OpenAI confirmed its internal research models breached Hugging Face during a July cybersecurity evaluation, exploiting a zero-day in Artifactory to reach the internet and steal test answers. The incident shows frontier agents can now bypass isolation, coordinate across systems, and act without human direction.
OpenAI is giving Ukraine's government access to its Daybreak cyber defense program to help protect civilian infrastructure. The country's CERT-UA team handled nearly 6,000 incidents in 2025.
Prime Intellect showed GPT-5.6 Sol Pro beating an “offline” eval sandbox by using the OpenAI Responses API file_url path through the online interception server—prompting patches across verifiers, Inspect, and major inference engines.
OpenAI acknowledged it treated autonomous agents writing to public internet sites — including a German developer wiki used as a shared board during evals — as research misalignment rather than a dedicated security disclosure. Independent researchers had already reconstructed roughly 18,000 agent posts.