Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,753 stories synthesized.
The hacker group TeamPCP is attempting to sell 5 gigabytes of stolen Mistral AI source code following a widespread supply-chain attack that also impacted OpenAI and numerous other software projects.
Security experts are questioning the validity of claims by the ShinyHunters extortion group that they have destroyed data stolen from 275 million Canvas users following an agreement with the platform's parent company, Instructure.
Tenable has launched an agentic AI tool, Tenable Hexa AI, to help organizations identify and decommission "zombie" cloud assets that contribute to both security vulnerabilities and unnecessary infrastructure costs.
A critical authentication bypass vulnerability in the Burst Statistics WordPress plugin is being actively exploited to grant attackers full administrative access to approximately 115,000 websites.
SecurityScorecard has acquired the Internet scanning startup Driftnet to enhance its third-party risk management platform with real-time threat intelligence capabilities.
Instructure Holdings has paid a ransom to the ShinyHunters cybercriminal group following multiple breaches of its Canvas learning platform, despite expert warnings that such payments offer no guarantee of data security.
A critical authentication bypass vulnerability in Palo Alto Networks PAN-OS (CVE-2026-0265) allows remote unauthenticated attackers to bypass authentication when Cloud Authentication Service is enabled on a login interface.
OpenAI disclosed that two employees' devices were compromised in the TanStack supply chain attack linked to the TeamPCP extortion gang, prompting the company to rotate code-signing certificates and requiring macOS users to update by June 12.
Security researchers earned over $385,000 in prizes on the second day of Pwn2Own Berlin 2026 by demonstrating 15 zero-day exploits against Microsoft Exchange, Windows 11, and various AI platforms.
CISA added Microsoft vulnerability CVE-2026-42897 to its Known Exploited Vulnerabilities catalog on May 15, 2026, confirming active exploitation in the wild.
Malicious versions of the widely used node-ipc npm package have been discovered containing obfuscated code designed to steal cloud credentials, SSH keys, and CI/CD secrets from developer machines.
CISA added Cisco vulnerability CVE-2026-20182 to its Known Exploited Vulnerabilities catalog on May 14, 2026, confirming active exploitation in the wild.
The Belarus-aligned threat group FrostyNeighbor (Ghostwriter) has been conducting a highly targeted spear-phishing campaign since March 2026 against government and military organizations in Poland and Ukraine.
CISA has published a series of advisories covering vulnerabilities in Siemens industrial products, including session hijacking in SIPROTEC 5, OS command injection in Ruggedcom ROX, and multiple flaws in SIMATIC S7 PLCs and other ICS devices.
This week's security landscape was marked by the disclosure of a Cisco SD-WAN zero-day and the continued exploitation of unpatched Microsoft Exchange Server vulnerabilities.
Cisco has confirmed active exploitation of CVE-2026-20182, a CVSS 10.0 authentication bypass in Catalyst SD-WAN Controller and Manager that allows unauthenticated attackers to gain full administrative privileges.
Rapid7 has published an analysis arguing that SD-WAN controllers represent a concentrated risk point, where a single vulnerability can give attackers 'god mode' access to an entire enterprise network.
Proof-of-concept exploit code has been released for a critical 16-year-old heap buffer overflow vulnerability in NGINX that could allow for denial-of-service or remote code execution.
A months-long espionage campaign targeting Asia-Pacific and Japan networks uses an updated FDMTP backdoor (v3.2.5.1) delivered via CDN-impersonating domains and DLL sideloading, linked to China-aligned group Mustang Panda.
Microsoft has published a deep-dive analysis of Kazuar, the modular peer-to-peer botnet used by Russian state actor Secret Blizzard for espionage against government and diplomatic targets in Europe and Central Asia.
A new Linux kernel local privilege escalation vulnerability dubbed 'Fragnesia' (CVE-2026-46300) was accidentally introduced by the patch for the Dirty Frag bugs, with a public PoC already available for Ubuntu systems.
Electronics manufacturing giant Foxconn confirmed a cyberattack disrupted some of its North American factories, with the Nitrogen ransomware group claiming responsibility and alleging theft of 8 terabytes of data from clients including Intel, Apple, and Nvidia.
Microsoft reports that more than half of cloud-native AI workload exploitations originate from misconfigurations, with attackers actively abusing publicly exposed AI services lacking authentication.
Belarus-aligned threat actor Ghostwriter is targeting Ukrainian government entities with geofenced PDF phishing campaigns that deliver PicassoLoader and Cobalt Strike, with malicious payloads only served to Ukrainian IP addresses.