Zero-day vulnerability

Still, you probably don't want to do this.

And as it has become traditional following Microsoft's Patch Tuesday, we of course get Nightmare Eclipse's Zero Day Wednesday.

The latest vulnerability here is dubbed ShieldCrash, and it's actually not a fundamentally new vulnerability.

It's ShieldBreak, but, uh, it does expand this older vulnerability to bypass the fix, uh, that Microsoft has implemented for this.

a zero day in magento and adobe commerce is being exploited right now and there's still no patch available a phishing as a service platform bypassed mfa at 258 organizations and is still active rogue's green connect clients are spreading a four-stage worm-like payload to every new host that connects and the researcher behind a string of windows zero days just dropped a public exploit targeting crowdstrike avast and nvidia no coordinated disclosure No waiting for this one.

This is the Cyber Hub Podcast, Security Gang.

Let's get into it.

Tuesday, September 8th, 2026, and I'll be honest with you.

Today's episode has a different texture than most.

Yeah, we've got zero days with no patches.

We have phishing infrastructure that's still online, worm-like malware that's actively spreading through remote management platforms, and public exploit code for CrowdStrike Falcon.

On any other day...

Chaotic Eclipse also claims that taking control of Kaspersky's user interface process can disrupt antivirus functions and interfere with file access controls.

Kaspersky says it has already addressed the vulnerability.

Chaotic Eclipse has previously published zero-day exploits targeting Microsoft products, a practice that has fueled debate over responsible vulnerability disclosure and the risks of releasing working exploit code.

The Financial Stability Board is warning that frontier AI could reshape cyber risk fast enough to threaten the global financial system.

The FSB, chaired by Bank of England Governor Andrew Bailey, is an international advisory body that monitors potential risks to global financial stability.

It is supposed to provide one limited service, but if the system carrying the feed has a flaw, well, the contestant can stop playing the puzzle and start exploring the production equipment behind it.

Now, OpenAI's preliminary account says the models found an unknown vulnerability, often called a zero day, in that package service.

Again, in plain text for those that don't know, a zero day is a software weakness the defender or vendor has not yet had a chance to fix.

Now, the agents used that weakness to get open internet access.

Then they increased their permissions, uh, moved through other parts of the research environment, and eventually reached a system that could connect outside.

Uh, Exploit Gym is the benchmark or, uh, standardized test the models were trying to solve.

The reported goal was narrow: get the solutions.

The route was anything but narrow, and this is where an agent behavior can feel alien, even when it is perfectly consistent with the objective that it-- we gave it, right? OpenAI says one model used stolen credentials and additional zero day vulnerabilities to find a path for remote code execution on Hugging Face servers.