ZeroDay TimesIndependent briefings on data breaches, bug bounty programs, zero-days, CVEs, and AI security, written for defenders.https://zerodaytimes.com/en-usStolen credentials, not a product flaw, still open the widest breach windowhttps://zerodaytimes.com/news/stolen-credentials-saas-breach-window/https://zerodaytimes.com/news/stolen-credentials-saas-breach-window/Public disclosures keep tracing large SaaS breaches to accounts without strong sign-in. The Snowflake customer campaign is still the clearest case.Wed, 28 Oct 2026 00:00:00 GMTData BreachesidentitySaaSMFAA six-figure bounty is a procurement decision, not a gifthttps://zerodaytimes.com/news/bug-bounty-payouts-are-procurement/https://zerodaytimes.com/news/bug-bounty-payouts-are-procurement/Public reward programs pay for impact at a trust boundary. The triage around the report matters more than the size of the check.Mon, 26 Oct 2026 00:00:00 GMTBug BountydisclosuretriageVRPExposed SSH is still a patching problem with a name: CVE-2024-6387https://zerodaytimes.com/news/cve-2024-6387-exposed-ssh-patching/https://zerodaytimes.com/news/cve-2024-6387-exposed-ssh-patching/Qualys called it regreSSHion. The durable lesson is that an admin service on the open internet needs an owner, a version, and a weekend plan.Sat, 24 Oct 2026 00:00:00 GMTZero-Days & CVEsCVE-2024-6387OpenSSHpatchingYour copilot reads mail the attacker can writehttps://zerodaytimes.com/news/indirect-prompt-injection-confused-deputy/https://zerodaytimes.com/news/indirect-prompt-injection-confused-deputy/Indirect prompt injection turned enterprise assistants into a new kind of confused deputy. The control that matters is what the assistant is allowed to touch.Wed, 21 Oct 2026 00:00:00 GMTAI & TechAI securitycopilotsleast privilege