Understanding this security crisis requires tracing the confluence of codec vulnerabilities, advertising networks, and autonomous AI pipelines over the past three quarters. The table below outlines key zero-day disclosures, root causes, and enterprise impacts recorded in 2026.
| Incident Date | Affected Platform | Vulnerability Vector | Systemic Impact |
|---|---|---|---|
| June 12, 2026 | Google Ads Manager | WebP chunk boundary overflow | Arbitrary server code execution within ad-approval microservices. |
| September 17, 2026 | OpenAI Infrastructure | Unchecked RAG file crawling | Discovery and exposure of corporate API keys and system logs. |
| September 21, 2026 | Meta Internal Clusters | HEIF Heist parser corruption | Lateral movement across image CDN nodes via crafted uploads. |
| September 21, 2026 | Slack Enterprise Grid | Media daemon stack overflow | Session secret exfiltration triggered by message attachment previews. |
| September 22, 2026 | GitHub Enterprise | Asset rendering RCE | Arbitrary command execution on self-hosted instances running default media filters. |