Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,564 stories synthesized.
Sekoia and Kudelski Security have identified six distinct cyber clusters operating under the umbrella of North Korea's Lazarus threat group, each specializing in espionage, financial theft, and sanctions evasion.
Roundcube Webmail has released versions 1.6.19 and 1.7.4 to address 12 vulnerabilities, including a zero-click stored XSS, XSS in the HTML editor, and multiple email header injection flaws.
A counterfeit Minecraft optimization mod is distributing the Myth Stealer RAT, which steals browser credentials and cookies, masking its malicious intent with functional game enhancements.
Key findings • Three MISP vulnerabilities, including two high-severity flaws, were disclosed together between Sept 6-7, 2026. • Flaws include improper authorization checks and ACL bypasses in…
A UK watchdog has identified cyberattacks as a significant and growing threat to the nation's food supply chain, citing recent disruptions at major retailers.
A chain of four vulnerabilities in Telerik UI for ASP.NET AJAX allows unauthenticated attackers to achieve remote code execution, impacting versions from 2010 to 2026.
OpenVPN 2.7.7 has been released to fix seven security vulnerabilities, impacting its core reliability layer and Windows service components, with potential for DoS and unauthorized configuration execution.
UK lawmakers are debating amendments to the Cyber Security and Resilience Bill, focusing on personal liability for executives and the practicalities of incident reporting.
N-able has issued a critical hotfix for its N-central platform to address CVE-2026-86218, a pre-authenticated remote code execution vulnerability that could allow attackers to compromise managed systems.
The cybersecurity landscape is being reshaped by AI-driven vulnerability discovery, leading to a dramatic increase in critical flaws and a collapse in the time attackers take to weaponize them.
New V8 JavaScript malware named JSCeal employs sophisticated obfuscation techniques to steal session cookies, enabling it to bypass Google authentication and conduct surveillance.
Early September saw critical zero-day exploits in Google Chrome, the emergence of the StreamRat Android malware, and significant data breaches impacting McKesson and millions of individuals.
Tufin has been ranked as the top Network Security Policy Management (NSPM) tool for 2026, with AlgoSec and FireMon following closely, according to a new evaluation that also notes the cessation of operations for Skybox Security.
ISMG editors convened to discuss the persistent problem of sensitive data mishandling, the growing risks posed by cybersecurity debt amplified by AI, and escalating geopolitical tensions fueling concerns over Iranian attacks on U.S. critical infrastructure.
Stacklok releases ToolHive, an open-source platform designed to containerize and secure Model Context Protocol (MCP) servers, enhancing the safety of AI client interactions with external tools.
Traditional zero trust security models are insufficient for autonomous AI agents, requiring a new approach focused on trusted runtimes and continuous behavioral identity security, according to Teleport's Chris Webber.
Key findings • 13 npm packages disclosed in under a minute on September 7, 2026. • Many packages impersonate 'wallet' or 'base-account' related functionalities. • All packages were publis…
This week's cybersecurity news highlights critical zero-day exploits in Google Chrome and e-commerce platforms, alongside vendor advisories for VMware and an ongoing investigation into a potential privilege escalation flaw in CrowdStrike's Falcon Sensor.
Key findings • 40 malicious npm packages disclosed within a 2-minute window on 2026-09-06. • All packages share the common prefix eka-, indicating a coordinated campaign. • All advisories…
Key findings • Ten vulnerabilities disclosed for SourceCodester Class and Exam Timetabling System 1.0 between Sept 4-6, 2026. • Nine SQL injection flaws found across multiple administrative a…
MikroTik has released a patch for a critical vulnerability enabling SSH authentication bypass, which is actively being exploited by attackers to establish persistence on affected devices.
CrowdStrike launches SafeMind, an agentic AI system featuring dual offensive and defensive models designed to autonomously detect and remediate cyber threats.
A critical vulnerability (CVE-2026-75754) in ASUS Control Center Enterprise allows remote attackers to gain complete administrative control over managed systems.
Threat actors are exploiting internet-exposed MikroTik routers by gaining administrative control through unauthenticated SSH access, with attacks dating back to early September.