Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,564 stories synthesized.
A critical zero-day vulnerability, dubbed StyleSmuggler, is being actively exploited in unpatched Magento Open Source and Adobe Commerce platforms, allowing unauthenticated attackers to execute arbitrary code and backdoor e-commerce stores.
Key findings • 40 malicious npm packages were disclosed on September 5, 2026. • All packages were disclosed within a rapid 23-minute window. • The burst includes packages under the shared…
JetBrains has reported a security incident where attackers exploited a critical vulnerability in its TeamCity CI/CD platform to breach its own Cadence environment, prompting urgent calls for credential rotation.
Key findings • Seven vulnerabilities disclosed for Grav CMS between 2026-09-04 and 2026-09-05, ranging from Medium to High severity. • Key risks include Remote Code Execution (CVE-2026-85604)…
Key findings • Five vulnerabilities disclosed for Grav CMS between 2026-09-04 and 2026-09-05, ranging from Medium to High severity. • Privilege escalation flaws in grav-plugin-api allow non-s…
Key findings • Critical stored XSS (CVE-2026-84803) due to incomplete extension blocklist in asset serving. • High-severity path traversal (CVE-2026-85175) allows access to sensitive TLS/CA k…
Key findings • 25 WWBN AVideo vulnerabilities disclosed between Sep 1-5, 2026, including critical flaws. • Critical vulnerabilities include indefinite password resets, auth bypasses, and path…
Microsoft is investigating a widespread issue causing its Windows desktop client for Teams to fail loading or experience significant delays, impacting user productivity.
Perplexity AI's open-source tool, numbat, provides critical observability for AI agents, addressing concerns about uncontrolled proliferation and excessive privileges.
European Parliament members are calling for Serbia's EU accession process to be slowed due to credible reports of state-sponsored spyware use against activists and opposition figures.
Microsoft outlines critical security considerations for organizations deploying AI systems on customer-owned infrastructure, emphasizing new attack vectors and necessary defenses.
An executive order aims to secure the U.S. bulk electric power market's supply chain against adversary nations, including China, citing risks of backdoors in critical infrastructure.
Key findings • 25 Linux kernel vulnerabilities disclosed together on September 4, 2026. • Vulnerabilities affect diverse subsystems including SELinux, graphics, and networking. • Fixes ad…
Key findings • Sixteen Linux kernel vulnerabilities affecting the Android SDK were disclosed on September 4, 2026. • The batch includes issues across fuse, RDMA/rxe, nvme-tcp, and other kerne…
Key findings • IBM i OS: Seven vulnerabilities disclosed on September 4, 2026, affecting versions 7.3-7.6. • High-severity flaw (CVE-2026-18175) allows manipulation of database transactions d…
Key findings • Seventeen vulnerabilities disclosed in IBM Langflow OSS on Sept 4, 2026, spanning SSRF, path traversal, and auth bypass. • High severity flaws include arbitrary code execution …
Key findings • Three medium-severity vulnerabilities disclosed together for IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. • CVE-2026-17483: Local attacker can delete historical flight-reco…
Malwarebytes details its rigorous internal migration of its Windows product to .NET 10, emphasizing the security implications of updating core platform components.
Microsoft's Project Zenith is a new Windows 11 experience designed for high-memory PCs, enabling local execution of AI models up to 30 billion parameters.
Microsoft has released server-side patches for multiple cloud services, while approximately 5,000 Dropbox accounts were compromised due to a Lenovo ID integration flaw. Additionally, a new federal-private sector initiative aims to bolster Texas water utility cybersecurity.
HPE has released security updates addressing 34 CVEs in its ArubaOS-CX network operating system, including critical remote code execution flaws.
Frontier AI models are demonstrating the capability to autonomously conduct end-to-end system compromises, necessitating urgent preparation for automated attacks within the next six months.
A sophisticated phishing campaign is employing invisible Unicode tag characters to split financial lure words, effectively bypassing traditional email filters and detection mechanisms.
Financial losses from account hacking in the UK have surged to £6.3 million, a fivefold increase attributed to enhanced reporting mechanisms.