Patch Sonar

Zero-days under active attack, explained in plain English

Early-warning record

Every hour, Patch Sonar reads the security advisories of Microsoft, Google, Apple, Fortinet, Palo Alto Networks, Cisco, VMware, Ivanti and Citrix. When a vendor says a flaw is being exploited before CISA has listed it, we flag it. This page keeps score, counting from Oct 28, 2026.

0flagged before CISA
–average days ahead
–biggest head start, days
0still waiting for CISA
FlawVendor said exploitedWe flagged itCISA listed itDays ahead
Cisco ASA and FTD firewalls
CVE-2026-76418
Oct 28, 2026Oct 29, 2026Oct 29, 20260

How we count: a flaw is included only when the vendor's own advisory said it was exploited, the advisory was less than 30 days old, and we flagged it before CISA's listing date. "Days ahead" is the number of whole days between the day we flagged it and the day CISA listed it. Same-day listings and anything CISA already had are left out.