CVE-2026-33824: Remote Code Execution in Windows IKEv2 - the folks from TrendAI Research break down this wormable bug that was patched last week. The show root cause & offer detection guidance. Read the details as www.zerodayinitiative.com/blog/2026/4/...

Microsoft released an OOB update for ASP.NET, but I'm not sure why. There are no active exploits, and they put exploitation as less likely. Why not hold until Patch Tuesday? What do they know that they aren't saying? In any case, read this to tell if you're affected github.com/dotnet/annou...

Ya hit the ball. Ya throw the ball. Ya catch the ball. Some days it rains.

Back in my happy place. Go Sounds!

The April release is so large, it gets not one but TWO bugs of the month. Not surprisingly, they are the two wormable bugs in the release affecting TCP/IP and IKE. Enjoy CVE-2026-33824 and CVE-2026-33827. youtube.com/shorts/aC5tk...

Oh my... #Microsoft just dropped 160+ patches. Looks like one is under active attack. Let me dive in and see what's there.

Wow - #Adobe released a patch for CVE-2026-34621 (Acrobat Reader) at some point yesterday. They say it's being exploited in the wild. I hate Friday afternoon patches. They often get overlooked. Patch now. helpx.adobe.com/security/pro...

Inherent flaws in node.js remain unpatched. Bobby Gould and Michael DePlante detail the problem and how the burden of security silently falls on app developers. www.zerodayinitiative.com/blog/2026/4/...

Serious question. Would people like to see a table like this generated for every macOS security update release? I currently cover Adobe and Microsoft, but I can add Apple if there's an audience for it.

After mountains of delays, I made it to Charlotte at 2am with a 6 1/2 hour layover. It’s the first time flying through here where my gates are right next to each other. 🤪

👀👀👀 https://www.zerodayinitiative.com/advisories/upcoming/

The best way to wind down after #RSAC - opening night!

The amount of Waymo taxis in San Francisco is staggering and frightening. Never say never, but it will be a long time before I get in a Johnny Cab.

Heading to @rsaconference.bsky.social and I’m likely going to miss my connection in Chicago because they can’t get the cargo door open. I hate traveling. Sigh

NEW: Federal Cyber Experts Thought Microsoft’s Cloud Was “a Pile of Shit.” They Approved It Anyway. A program created to protect the government against cyber threats authorized a sprawling Microsoft cloud product, despite the company’s inability to fully explain how it protects sensitive data.

Announcing #Pwn2Own Berlin 2026! We've got 10 categories for targets, including an expanded #AI target list. We have 4 AI categories - including coding agents (looking at you #Claude). More than $1,000,000 in cash & prizes available. Read the details at www.zerodayinitiative.com/blog/2026/3/...

Happy Patch Tuesday! The latest security patches from #Adobe and #Microsoft are here. Thankfully, no bugs are listed as being under attack, but there's still some interesting ones in the mix. Join @dustinchilds.bsky.social as he breaks down the March release www.zerodayinitiative.com/blog/2026/3/...

[ZDI-26-124|CVE-2025-15060] claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability (CVSS 9.8; Credit: Peter Girnus of Trend Research) zerodayinitiative.com/advisories/Z...

NEW: Former L3Harris boss Peter Williams was sentenced to seven years in prison for stealing sensitive company hacking tools, and then selling them to a Russian broker. Williams, aka Doogie, previously pleaded guilty to stealing and selling eight trade secrets to Russian broker Operation Zero.

Heading to the #[un]prompted conference next week? Be sure to catch @gothburz.bsky.social's talk on "FENRIR: AI Hunting for AI Zero-Days at Scale" His talk shows how we're FENRIR has detected over 100+ CVEs since mid-2025. Don't miss it. unpromptedcon.org

CVE-2026-20841: Arbitrary Code Execution in the Windows Notepad - The TrendAI Research team takes a deep dive into this recently patched file parsing bug to show you root cause, source code walk through, and provide detection guidance. Read the details at www.zerodayinitiative.com/blog/2026/2/...

Microsoft report six(!) exploits in the wild while Adobe has a small (and relatively quiet) month. Join @dustinchilds.bsky.social from Tokyo as he breaks down the release and shows you what to watch for. www.zerodayinitiative.com/blog/2026/2/...

A small release from @adobe.com but 6 (yes six!) actively exploited bugs from #Microsoft. I'll have my full thoughts out soon, but get ready for some emergency patching. #PatchTuesday

CVE-2025-6978: Arbitrary Code Execution in the #Arista NG Firewall - our researchers took a deep dive into this recently patched RCE to provide root cause and detection guidance. Read all the details at www.zerodayinitiative.com/blog/2026/2/...

Patches are now available for Office 2016 and 2019. Get to updating them there systems!

Wrapping up Day Two of #Pwn2Own Automotive - we saw some amazing research demonstrated today, some of which had never been seen in public before! Join @dustinchilds.bsky.social as he summarizes the highlights and previews the final day. youtu.be/xKZtfblNrHc

Wow - Office security feature bypass patched OOB after active exploitation detected. Path now - CVE-2026-21509. At least the Preview Pane isn't an attack vector. msrc.microsoft.com/update-guide...

We landed in DFW at 2:30pm, but thanks to bad weather and @americanair.bsky.social incompetence, here it is 9:30 and we have left customs. Still waiting on bags. *sigh*

Boom! or shall I say Doom? Game On! Aapo Oksman, Elias Ikkelä-Koski and Mikael Kantola of Juurin Oy exploit the Alpitronic HYC50 with a TOCTOU bug - and installed a playable version of Doom to boot. They earn $20,000 and 4 Master of Pwn points. #Pwn2Own #P2OAuto

The a highlight from Day 2 of #Pwn2Own Automotive, the team from @synacktiv.com is at it again. This time, they leverage NFC(!) to exploit the #Autel MaxiCharger with a stack-based buffer overflow. Amazing! We've never seen an NFC exploit like this one before. youtube.com/shorts/eGAMc...

Me too....

Verified! Fuzzware. io (@ScepticCtf, @diff_fusion, @SeTcbPrivilege) chained two vulnerabilities (CWE-306, CWE-347) to achieve code execution on the Autel charger and manipulate the CP signal, earning $50,000 USD and 5 Master of Pwn points. Full win with the add-on. #Pwn2Own #P2OAuto

Confirmed! Taejin Kim (@tae3), Junsu Yeo (@junactually), Sunmin Park (@sunminpark4503), Sungmin Son (@_ssm98), and Hoseok Lee of SKShieldus (@EQSTLab) exploited a hardcoded credential (CWE-798) for code execution via CWE-494 on the Grizzl-E Smart 40A, earning $40,000 and 4 MoP points. #Pwn2Own

Verified! @kiddo_pwn and @freddo_1337 of Team DDOS exploited two bugs, including a command injection, against the ChargePoint Home Flex. Add-on failed, but still earned $40,000 USD and 4 Master of Pwn points. #Pwn2Own #P2OAuto

The exploit in action!

Confirmed! Neodyme AG (@Neodyme) used a stack based buffer overflow to get a root shell on the Alpine iLX-F511, earning $20,000 USD and 2 Master of Pwn points. #Pwn2Own #P2OAuto

Zed is learning about sake. I had to apologize for putting him in checked baggage on the way to Tokyo.

We're in the middle of setting up for #Pwn2Own Automotive, and @dustinchilds.bsky.social and Zed peek behind the scenes to see how it's going. youtube.com/shorts/h8dbY...

He may be in Tokyo prepping for #Pwn2Own Automotive, but Patch Tuesday waits for no one. Join @dustinchilds.bsky.social as he breaks down a big #Microsoft release (w/ 1 CVE in the wild) and a smallish #Adobe release. www.zerodayinitiative.com/blog/2026/1/...

It's a big patch Tuesday with more than 110 CVEs from Microsoft but only 25 from Adobe. There's one info disclosure bug under attack. I'll have my full thoughts out soon.

NEW: Apple and Google have rolled out security updates to fix a series of flaws used in an active hacking campaign. Google updated Chrome; Apple issued fixes for iPhones, Macs, and more. Apple and Google's TAG were credited with the find. TAG usually tracks goverment-backed threats, like spyware.

A small release from Microsoft and Adobe for our final Patch Tuesday of the year, but we do have Microsoft 0-days in the wild. I'll have my thoughts about the release out soon.

Silent patches make Zed sad :-[

Wow - a small(ish) Patch Tuesday! Just 64 new CVEs from #Microsoft and 29 from #Adobe. One Msft CVE under active attack. I'll have my full thoughts out shortly.

I attended Pwn2Own in Cork ☘️ last week. I shared a review of the event on this week's episode of my podcast. You can find that at 14:41 in the video linked here ⬇️ www.youtube.com/watch?v=aaLA... Thanks to @dustinchilds.bsky.social & @thezdi.bsky.social for allowing me to attend. ❤️

But I thought Microsoft said it wasn't worth fixing? "Microsoft classified this as low severity and this will not be patched in the immediate future." arcticwolf.com/resources/bl...

Not to brag or anything, but I did predict this. I didn't predict the patch would be bypassed. *sigh* Patch kwality continues to be an issue. Go update your WSUS - again. msrc.microsoft.com/update-guide...

For the record, Maude and I are just friends. Any other rumors you may have heard are just tabloid trash. ;-]