zerodayalpha

⚡️ 0-Day Alert: Node.js, PyPI, .NET, and others CVE-2026-111497: Google Brotli buffer overflow Logic error in input stream management of the 'br' decompression algorithm, leading to memory corruption and code execution. **The bug is now confirmed in active exploitation**. Brotli fixed versions: 1.0.10, 1.1.1, 1.2.1. Node.js: 22.23.4, 24.22.1, 26.12.1 https://intelligence.zerodayengineering.com/0-day-alert-cve-2026-111

0-Day Insights: PHP RCE https://intelligence.zerodayengineering.com/0-day-insights-php-rce/ This research note is our independent analysis of both critical PHP bugs that were patched this week, CVE-2026-109618 and CVE-2026-109619. We take the code as ground truth and re-evaluate every assumption from the ground up. 🔒 Members only intelligence

Keynote: The Art of Looking Deeper https://zerodayengineering.com/research/keynote-the-art-of-looking-deeper/ Presented by @alisaesage at c0c0n 2026

We host a monthly technical review webinar under the Exploit Intelligence membership. Next live is scheduled on Wednesday, 21st October. Alisa Esage will look at the past month's security events, break down slop and hype, share her personal opinions, and hold a brief Q&A. Meant for leadership who loves technical details: https://intelligence.zerodayengineering.com/monthly-webinar-access/

Chromium VRP just raised reward amounts – after lowering it to near 0 earlier this year. 4x memory safety baseline, increased rewards for logic sandbox, and the fuzzer bonus is back (!) Still no incentives to report the bugs that could pay 10x at comps...

⚡️ 0-Day Alert: Apple CoreGraphics RCE exploited in targeted attacks CVE-2026-86950: out-of-bounds write in CoreGraphics parsing a maliciously crafted image/PDF, leading to arbitrary code execution. Both iOS and macOS are vulnerable. This AV is reachable through a wide variety of iOS native and 3rd party apps that render graphics, such as WhatsApp (first suspect due to report credit), Safari, iMessage, etc. Zero-click where auto-preview renders the file. However, the bug alone is not enough to compromise the device, and requires further chaining such as sandbox escape and EoP. These further bugs are not public. Patched in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1. https://intelligence.zerodayengineering.com/0-day-alert-cve-2026-86950/

⚡️ 0-Day Alert: Chrome v8 RCE CVE-2026-87491: WasmGetOwnProperty builtin may invoke a getter from user's JavaScript, leading to OOBW. Patched in Chrome 153.0.8010.36/.37 https://intelligence.zerodayengineering.com/0-day-alert-cve-2026-87491/

⚡️ 0-Day Alert: Chrome v8 RCE exploited in the wild CVE-2026-85046: v8 array-builtin callback side-effect to elements-kind transition confusion. Affects both Turbofan and Maglev. Exploit will work in default config but requires multiple other bugs to achieve arbitrary code execution on the system. The bug alone without helpers could do for an UXSS. Patched in Chrome 152.0.7977.82/.83

Browser Exploit Surface model + bug overlay CVE callouts: randomly picked exploitable bug samples from historical records @alisaesage

Mastery container: Multi-Specialization Essentials A curated course of foundational webinars and hands-on masterclasses taught by @alisaesage, covering the introductory essentials of the three classic specializations at Zero Day Engineering: vulnerability discovery, hypervisor and browser exploitation. Made for self-paced study with minimal prerequisites that can be taken over a weekend as orientation in the field or initialization of multi-specialized work with AI. Details: https://zerodayengineering.com/training/multi-essentials.html Purchase within 21 September 2026 to get a reduced price for any full training of your choice.

⚡️ 0-Day Alert: IBM LangFlow OSS RCE LangFlow deployments have been under active exploitation since May. CVE-2025-34291: CORS misconfiguration + SameSite=None CVE-2026-33017*: Unauthenticated RCE via build_public_tmp's data parameter CVE-2026-55255: IDOR in /api/v1/responses: run any user's flow by ID CVE-2026-0770: Unauthenticated RCE via validate_code() / decorator abuse CVE-2026-9198: Unauthenticated RCE via auto_login + validate/code chain Bugs are not hard, likely spotted by generally available AI. Public exploit POCs exist. Majority pattern: takes input from an API endpoint variable and executes it directly on the OS. Attack pattern suggests that LangFlow has not seen appropriate security hardening from the vendor, and shouldn't be deployed in environments where an arbitrary code execution poses a risk. * Attached: 33017 diff and code trace to exec()

"In an era where autonomous AI agents are increasingly being used for vulnerability hunting, this course was a great reminder that deep vulnerability research still depends on a unique methodology, analytical thinking, and understanding systems at their core not just automation." – Malik Kurbanov, Founder & CEO

⚡️ Linux Kernel just issued a single-fix security update for stable LTS branches, addressing CVE-2026-64560. We were able to exploit the bug and independently confirm that it's serious. The impact is kernel code execution and EoP from unpriveleged user with no CAPs/userns, io_uring disable + BPF JIT hardening. The use-after-free primitive is reliable despite the race (<1m to exploit). No wild attacks were seen yet. They are likely, given our technical picture. Majority of Android devices are affected. Exploitability on Android wasn't empirically confirmed yet.

vmxnet3 is a ESXi-specific network card emulator. We've done some research on binary diffing and exploitation of it previously: https://zerodayengineering.com/research/vmware-esxi-vmxnet3-from-patch-to-poc.html It is included as a hands-on case study in Hypervisor Vulnerability Research training: https://zerodayengineering.com/training/hypervisor-vulnerability-research.html Alpha Exploit Intelligence subscription offers an experienced human practitioner advisory on current threat landscape – join the next cohort: https://zerodayengineering.com/intelligence/alpha/index.html

VMware just released a critical security update for ESXi hypervisor suite (VMSA-2026-0006). Two attack vectors: 1. Remote attack on vCenter – CVE-2026-59309: auth bypass via network access CVE-2026-59310: directory traversal RCE An exploit would allow control of entire ESXi infrastructure. 2. A VM-escapable set of two bugs – CVE-2026-59310: vmxnet3 OOBW CVE-2026-41703: core OOBR These are likely chainable to break out of VM and achieve code execution on hypervisor OS, as a privileged guest OS user. Diffing and exploiting (1) is straightforward and should be patched promptly.

New training: Chrome Full Chain Exploit Engineering @alisaesage Public online cohort on August 25-28, 2026 open for booking: https://zerodayengineering.com/training/chrome-full-chain/

"About three months ago I started the Browser Exploit Design training of Zero Day Engineering. A very interesting self-paced course where a combination of browser internals, realistic exploit development workflows and hands-on exercises based on modern browser 0-days is discussed. It includes topics such as DOM use-after-free bugs, JavaScript engine type confusion and sandbox escapes in Chrome, Firefox and Safari/WebKit. It is without a doubt the most challenging course I have followed so far in the field of (browser) exploitation. And I still have a lot to learn in this. But much more insight into how browsers work and how browser exploits are done in practice. To be continued." – Ian van der Wurff, Hacker || OSCE3 | OSCP

New Certification System https://zerodayengineering.com/training/certification/ Zero Day Engineering now issues a Certificate of Competence — proof of integrating the training and applying it to current frontier challenges in scope. Project-based, evaluated for honest merit.

"Highly recommended for anyone looking to deepen their understanding of browser security internals and the full exploit lifecycle" – Bruno Eligio Pavesi, Red Team Operator, Penetration Tester Browser Exploit Design course: https://zerodayengineering.com/training/browser-exploit-design.html

New course review: "Probably the best use of my time and effort I have made in some time." – Vikram Hegde, ML Engineer & Data Scientist, CA, US Vikram took Browser Exploit Design course after building his foundation with Zero Day Vulnerability Research course: 1- https://zerodayengineering.com/training/universal-vulnerability-research.html 2- https://zerodayengineering.com/training/browser-exploit-design.html