Over 700 Ghost sites hijacked in a coordinated campaign using CVE-2026-26980 combined with ClickFix social engineering. Active exploitation ongoing.

Unauthenticated, remote API access to Site Admin privileges via crafted request to Cisco Secure Workload's management layer. Affects both SaaS and on-prem deployments.

An analysis of CVE-2026-9082, a highly critical unauthenticated SQL injection in Drupal core (rated 20/25) confirmed actively exploited by CISA KEV. Covers the PostgreSQL-only attack path, exploitation timeline, affected versions, and immediate mitigation guidance.

A whitepaper-style analysis of CVE-2026-42208 in LiteLLM, covering the pre-authentication SQL injection path, observed exploitation activity, public PoC references, and safe lab-only 0day Inc validation guidance.

A whitepaper-style analysis of CVE-2026-6770 in Firefox and Tor Browser, covering the IndexedDB ordering leak, public proof-of-concept references, and safe 0day Inc lab demonstrations for defenders.