Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,728 stories synthesized.
Three malicious PyPI packages have been discovered delivering a new malware that uses Zulip's REST APIs as its command-and-control infrastructure, targeting both Windows and Linux systems.
ESET researchers uncovered 28 fraudulent Android apps on Google Play, collectively named CallPhantom, that tricked over 7.3 million users into paying for fake call logs and SMS records generated from hardcoded data.
Cofense warns that low-skilled threat actors are increasingly abusing Vercel's generative AI platform v0.dev to create convincing phishing pages mimicking brands like Microsoft, Spotify, and Nike.
Researchers have identified a cyberattack on a Mexican water utility where threat actors used generative AI to develop custom hacking tools and independently identify critical industrial control systems.
BlueRock has launched an open-source runtime sensor that allows developers to monitor Model Context Protocol (MCP) servers and Python application behavior without modifying source code.
Enterprises are struggling to manage the operational and security complexities of deploying multiple AI models across hybrid multicloud environments, according to new industry data.
The SANS Internet Storm Center released its daily Stormcast briefing on May 7, 2026, providing security professionals with an updated assessment of the current threat landscape.
A new research project demonstrates how Large Language Models can dynamically generate secure, adaptive dashboards for analyzing web honeypot logs, simplifying threat detection for security teams.
North Korean state-sponsored hackers known as APT37 have targeted ethnic Koreans in China with a sophisticated Android backdoor called 'BirdCall' distributed through a compromised mobile gaming platform.
Palo Alto Networks disclosed CVE-2026-0300, a critical buffer overflow in the PAN-OS Captive Portal allowing unauthenticated remote code execution, with limited exploitation by a likely state-sponsored threat cluster tracked as CL-STA-1132.
Microsoft is rolling out a new "Brand Impersonation Protection" feature for Teams Calling to automatically alert users to suspicious, high-risk VoIP calls from external impersonators.
Attackers are using malicious Google search advertisements to lure ManageWP users into a real-time adversary-in-the-middle phishing scheme that bypasses multi-factor authentication.
Kaspersky researchers have uncovered a new bypass of Google Chrome's App-Bound Encryption (ABE) by the VoidStealer Trojan, which attaches to the browser as a debugger to capture the decryption key from memory.
Instructure, the vendor behind the Canvas learning management system, disclosed a data breach on May 1 where a threat actor stole names, emails, student IDs, and user messages.
A critical out-of-bounds write vulnerability in Palo Alto Networks' PAN-OS is being actively exploited by a state-sponsored group, prompting an urgent directive from CISA.
A new Mirai-derived botnet named xlabs_v1 is hijacking internet-exposed Android devices and IoT hardware via the Android Debug Bridge to power a DDoS-for-hire service.
Twelve critical vulnerabilities in the widely used vm2 Node.js library allow attackers to escape sandboxed environments and execute arbitrary code on host systems.
Cisco has released patches for a high-severity denial-of-service vulnerability in its Crosswork Network Controller and Network Services Orchestrator that forces affected systems into an unresponsive state requiring manual reboots.
CISA has launched the "CI Fortify" initiative, a new framework designed to help critical infrastructure organizations maintain essential services by operating in isolation during cyberattacks or network outages.
On May 5, 2026, DENIC published incorrect DNSSEC signatures for the .de TLD, causing validating resolvers like Cloudflare's 1.1.1.1 to return SERVFAIL for millions of domains over three hours.
A critical vulnerability in the Slider Revolution WordPress plugin allows authenticated users to upload arbitrary files, potentially leading to remote code execution.
Security researcher Alexander Hanff reveals that Google Chrome automatically downloads a 4GB Gemini Nano AI model onto eligible devices without notification or consent, raising privacy and bandwidth concerns.
Rapid7 researchers have uncovered an Iranian state-sponsored espionage operation, attributed with medium confidence to MuddyWater, that posed as the Chaos ransomware gang to conceal a data theft and false-flag campaign.
Sysdig has introduced a "headless" cloud security platform that replaces traditional dashboards with direct integration into AI coding agents, aiming to counter the machine-speed pace of modern cyberattacks.