Topic

N-Day Exploitation

Attacks that use vulnerabilities after public disclosure, exploiting the gap between a vendor advisory and the point at which most affected systems are patched.

Current clusters

security1 publisher

Red Heron turned a public Gitea exploit into 13 confirmed compromises across six countries

Acronis attributes exploitation of CVE-2026-60004 to a China-linked cluster that automated a published proof-of-concept from July 29, scanned 1,386 self-hosted Gitea servers and left a Linux rootkit behind.

Publishers:thehackernews.com

Reality

Evidence55
Adoption40
Hype gap+12
Incentives60
Confidence50

security4 publishers

Attackers chain two PaperCut flaws to lift LDAP and SAM credentials from school print servers

Arctic Wolf reports the two newly disclosed PaperCut bugs being used together against K-12 and university print servers in the US and Europe, with collection aimed at the directory credentials the server stores to do its job.

Publishers:bleepingcomputer.comsecurityaffairs.comsecurityweek.comthehackernews.com

Perspective Coverage

4 publishers

Builder: Builder 34%
Operator: Operator 52%
Investor: Investor 14%

Reality

Evidence58
Adoption72
Hype gap−12
Incentives58
Confidence64