Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,731 stories synthesized.
Microsoft has officially classified the Microsoft Edge browser's practice of keeping the entire password vault in plaintext memory as an intentional design choice, despite security concerns regarding credential harvesting.
Meta is reversing its commitment to end-to-end encryption on Instagram, opting to remove the feature from its direct messaging service in the coming months.
Palo Alto Networks has warned of a critical, unpatched zero-day vulnerability in its PAN-OS software that is currently being exploited in the wild to achieve remote code execution.
Poland’s Internal Security Agency has confirmed that five water treatment plants were breached in 2025, with attackers gaining the ability to manipulate critical operational equipment.
AI observability platform Braintrust is urging customers to rotate their API keys after a breach of an internal AWS account exposed credentials used to access third-party AI models.
The ACSC has issued an urgent alert about a widespread campaign using ClickFix social engineering and compromised WordPress sites to distribute the Vidar Stealer infostealer malware.
The hacking group ShinyHunters has compromised the Canvas learning management system, stealing vast amounts of student data and forcing a temporary shutdown of services during the peak of the U.S. academic final exam season.
A security breach at a former third-party technology provider has exposed the personal data of 197,400 Zara customers, according to findings from Have I Been Pwned.
Meta has initiated a judicial review against the UK's Ofcom, challenging the regulator's method of calculating potential fines and fees based on global revenue rather than UK-specific earnings.
CISA has mandated that federal agencies patch a high-severity zero-day vulnerability in Ivanti Endpoint Manager Mobile by May 10 following reports of active exploitation.
A new analysis of 25 million security alerts reveals that enterprise reliance on severity-based triage and automated EDR remediation is leaving organizations vulnerable to one missed breach per week.
Google is integrating Play Policy Insights and SDK compliance checks directly into Android Studio to help developers identify and resolve security and policy issues during the coding process.
Apple has released a massive wave of updates across its entire ecosystem, including version 26.5 for all major platforms and critical security patches for legacy iOS and iPadOS versions.
Two U.S. men have been sentenced to 18 months in prison for operating "laptop farms" that enabled North Korean IT workers to secure remote jobs at nearly 70 American companies and funnel over $1.2 million to Pyongyang.
SentinelOne researchers have uncovered PCPJack, a credential theft framework that worms through cloud infrastructure previously compromised by the TeamPCP cybercrime group, removing their artifacts and stealing credentials.
A Virginia man has been convicted of federal charges for orchestrating the retaliatory destruction of 96 government databases following his termination from a federal contracting firm.
A new, sophisticated Linux backdoor called PamDOORa is being sold on underground forums, offering attackers persistent SSH access and credential harvesting capabilities by exploiting the Pluggable Authentication Module (PAM) framework.
A newly discovered malware framework called PCPJack is systematically purging systems of TeamPCP infections to establish its own credential-harvesting operation.
Snyk has integrated Anthropic’s Claude models into its AI Security Platform to automate vulnerability discovery and remediation for AI-generated code and agentic workflows.
Avantra has released Avantra 26, an updated AIOps platform featuring an AI-driven root cause analyzer designed to diagnose SAP system failures in seconds.
Securonix has introduced an AI-powered Threat Research Agent and a validation tool called ThreatWatch to help security teams automate threat research and confirm exposure within their environments.
OpenAI has introduced GPT-5.5-Cyber, a specialized, more permissive AI model designed to assist verified security professionals with red teaming and vulnerability validation.
Kaspersky researchers have disclosed CVE-2025-68670, a critical remote code execution vulnerability in the xrdp remote desktop server for Linux that can be exploited without authentication.
A new Linux kernel privilege escalation chain dubbed \"Dirty Frag\" allows unprivileged local users to gain root access across most major distributions using a publicly available exploit.