Déjà vu-lnerability
Summary: Project Zero's review of 2020 found 24 0-days exploited in-the-wild, and 6 of them were closely related to previously disclosed vulnerabilities, some requiring only a line or two of code to change. The same threat actor exploited the same JScript garbage-collection bug class four times across CVE-2018-8653, CVE-2019-1367, CVE-2019-1429, and CVE-2020-0674, and the CVE-2019-1367 proof-of-concept still worked after that patch was applied.
Why it matters: One in four detected 0-days in 2020 could potentially have been avoided with a more thorough patching effort, and a single actor got four separate exploits out of one incomplete fix - so the patch you shipped is the attack surface you still own.
Read the original at Google Project Zero ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026