zero-day
Safeguard articles tagged "zero-day" — guides, analysis, and best practices for software supply chain and application security.
76 articles
Stuxnet (2010): Four Zero-Days Aimed at Industrial Controllers
A factual retrospective on Stuxnet, the malware discovered in 2010 that targeted Siemens PLCs controlling uranium enrichment centrifuges, and why it reset expectations about targeted attacks on physical systems.
2026 Mid-Year Threat Landscape: Supply-Chain Worms, Agentic AI, and Edge Zero-Days
A defender's synthesis of the first half of 2026 — self-propagating package worms, the agentic-AI access-control problem, edge-appliance zero-days, and a healthcare ransomware surge — and what to prioritize next.
CVE-2026-68820: A 7.0 That Ends With a Kernel Rootkit and Your EDR Switched Off
Lazarus used this afd.sys use-after-free to reach SYSTEM from a local foothold, then loaded a FudModule kernel rootkit. Escalation is never the objective — it is the step before it.
Patch Tuesday August 2026: ~398 Flaws, 3 Zero-Days, and One the Norks Already Used
Microsoft shipped fixes for roughly 398 CVEs on 11 August. Three are zero-days, one is under active exploitation by Lazarus, and the vendor tallies disagree by nearly 30.
Confluence Broken Access Control Zero-Day (CVE-2023-22515) Explained
CVE-2023-22515 let unauthenticated attackers create rogue administrator accounts on Confluence Data Center and Server. Here's the broken-access-control flaw and how to fix it.
WebP (CVE-2023-4863) Explained: The libwebp Heap Overflow That Patched the Web
CVE-2023-4863 was an actively exploited heap buffer overflow in libwebp's Huffman decoder. Because the codec is vendored everywhere, one bug forced emergency patches across browsers and apps.
Cisco IOS XE CVE-2023-20198 Explained: The Web UI Privilege Escalation Zero-Day
CVE-2023-20198 is an unauthenticated privilege escalation in the Cisco IOS XE Web UI, rated CVSS 10.0, that let attackers implant tens of thousands of devices in days. Here is how it worked and how to remediate.
2026 Mid-Year Threat Landscape: Supply-Chain Worms, Agentic AI, and Edge Zero-Days
A defender's synthesis of the first half of 2026 — self-propagating package worms, the agentic-AI access-control problem, edge-appliance zero-days, and a healthcare ransomware surge — and what to prioritize next.
TeamPCP: Running a Software Supply Chain Attack Like a Production Pipeline
TeamPCP (UNC6780) is the most active actor in the 2026 supply chain corpus, weaponizing the tools developers trust most. Here is how the operation works, and why a zero-CVE campaign breaks the model most teams still rely on.
Agentic AI Security: Why Architecture Beats Model Size in Vulnerability Discovery
The CyberGym leaderboard shows the lead in AI vulnerability discovery moving to multi-agent orchestration, not raw model scale. Here is what that means for security teams betting on agentic AI.
Hacker Summer Camp 2026 Survival Guide: OPSEC for Black Hat, DEF CON 34 and BSides
A practical, opinionated field guide to surviving Hacker Summer Camp in Las Vegas this August — device hygiene, network OPSEC, talk selection, and pacing — with a preview of the AI agent and supply chain themes likely to dominate the floor.
Edge Appliances Are the Soft Underbelly: VPN Zero-Days as Initial Access in 2026
Check Point's CVE-2026-50751 and Cisco's seventh SD-WAN zero-day of the year are not isolated bugs — they are the same story. Here is why VPN and edge appliances keep becoming the front door for ransomware, and how to monitor and segment them.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.