Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,727 stories synthesized.
A critical arbitrary file upload vulnerability in the Breeze Cache WordPress plugin is being actively exploited, allowing unauthenticated attackers to achieve remote code execution.
The Federal Trade Commission has reached a settlement with data broker Kochava, prohibiting the company from selling or sharing sensitive geolocation data without explicit consumer consent following a years-long legal dispute.
A university student in Taiwan was arrested for using software-defined radio equipment to impersonate legitimate beacons and trigger emergency brakes on the country's high-speed rail network.
A Latvian ransomware affiliate has been sentenced to more than eight years in U.S. prison for his role as a lead negotiator for a criminal syndicate that operated under multiple aliases, including Conti and Akira.
The Apache Software Foundation has patched a critical double-free vulnerability in the HTTP/2 module of the Apache HTTP Server that can be exploited for denial-of-service or remote code execution.
Official DAEMON Tools installers for Windows have been compromised to distribute malware, allowing attackers to maintain a persistent, targeted backdoor on select victim systems.
Microsoft Defender Research has uncovered a large-scale phishing campaign that targeted over 35,000 users across 13,000 organizations with fake compliance emails, using adversary-in-the-middle session hijacking to steal Microsoft authentication tokens.
Two unpatched vulnerabilities in the Ollama Windows auto-updater allow attackers to bypass signature checks and achieve persistent remote code execution by planting malicious files in the startup folder.
LastPass has launched a new "Mobile Smart Scanner" feature that uses on-device OCR to digitize handwritten or typed credentials, allowing users to import them directly into their password vaults.
CISA has added the "CopyFail" Linux kernel vulnerability to its Known Exploited Vulnerabilities catalog after researchers released a reliable root-level exploit that is already being used in the wild.
ESET researchers attribute a supply-chain attack on the Yanbian gaming site sqgame[.]net to North Korean APT37 (ScarCruft), which trojanized Windows and Android software with a previously undocumented Android variant of the BirdCall backdoor.
Apple has issued a security update for its App Store Connect platform to address a vulnerability affecting developer-facing services.
A security researcher has discovered that Microsoft Edge stores saved passwords in cleartext within process memory, allowing attackers with administrative access to extract credentials from shared enterprise systems.
A sophisticated phishing campaign targeting 13,000 organizations has been identified, utilizing adversary-in-the-middle techniques to bypass multifactor authentication.
The Federal Trade Commission has finalized a settlement with data broker Kochava, prohibiting the company from selling precise geolocation data without explicit consumer consent following allegations that it tracked users to sensitive locations.
Google has increased its top vulnerability bounty to $1.5 million for zero-click Pixel Titan M2 exploits as part of a major overhaul to its Android and Chrome bug reward programs.
A China-linked threat actor known as UAT-8302 is targeting government agencies in South America and Europe using a shared arsenal of malware previously tied to multiple other APT groups.
Security teams are facing a critical blind spot as industry-standard vulnerability scanners fail to report flaws in end-of-life (EOL) software, leading to a massive volume of unflagged, exploitable components.
Software Composition Analysis (SCA) tools are failing to detect vulnerabilities in end-of-life (EOL) software because official CVE records often omit older versions from their affected ranges, creating a massive blind spot for security teams.
A phishing campaign dubbed Venomous#Helper has compromised over 80 US organizations since April 2025, using fake SSA emails to deliver a signed SimpleHelp RAT that establishes dual persistent backdoors via SimpleHelp and ConnectWise ScreenConnect.
Real estate giant Cushman & Wakefield is investigating a data breach after being targeted by both the ShinyHunters and Qilin cybercrime groups following a successful vishing attack.
Principal Security Researcher Joey Melo is advancing the field of AI red teaming by applying traditional penetration testing methodologies to successfully jailbreak and manipulate large language models.
The ShinyHunters extortion gang has leaked data belonging to 119,200 Vimeo users after compromising the video platform through a third-party integration with data analytics firm Anodot.
The Center for Internet Security has introduced specialized hardened OS images for AWS to help organizations secure AI and high-performance computing workloads by providing pre-configured, compliant baselines.