Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,727 stories synthesized.
Security researchers have discovered that Microsoft Edge stores user passwords in cleartext within its process memory, allowing local users or malware to extract credentials without elevated privileges.
Australia has established a new Cyber Incident Review Board to conduct no-fault, post-incident investigations into major cyberattacks, granting the body the power to compel information from organizations.
A Latvian national has been sentenced to 102 months in prison for his role in a sophisticated ransomware syndicate that extorted over 54 organizations using various aliases, including Conti and Akira.
A critical heap out-of-bounds vulnerability in the Ollama AI inference engine, dubbed 'Bleeding Llama,' is exposing roughly 300,000 internet-accessible instances to unauthenticated information theft.
A data breach involving third-party analytics provider Anodot has resulted in the exposure of over 119,000 Vimeo user email addresses, according to data confirmed by the breach notification service Have I Been Pwned.
Google has patched a critical remote code execution vulnerability in the Android System component that could allow attackers to execute code as a shell user without user interaction.
A sophisticated campaign targeting the sales engagement platform Drift has exposed the systemic risks of persistent OAuth tokens, which allow attackers to bypass MFA and gain long-term access to sensitive cloud environments.
A critical code injection vulnerability in MetInfo CMS is being actively exploited in the wild, allowing unauthenticated attackers to achieve remote code execution on vulnerable servers.
VIAVI Solutions has introduced the CyberFlood CF1000, a 400G appliance designed to validate the security and performance of multi-terabit AI data centers and critical network infrastructure.
Oracle has introduced a new monthly Critical Security Patch Update (CSPU) cycle to help customers address vulnerabilities more quickly while maintaining its existing quarterly patch schedule.
Certificate authority SSL.com has begun rotating its root certificate hierarchy, prompting warnings for organizations with custom trust configurations to audit their systems for potential service disruptions.
Meta has patched two vulnerabilities in WhatsApp that could allow attackers to manipulate media handling and disguise malicious files, though no active exploitation has been observed.
Google has overhauled its Android and Chrome bug bounty programs, offering up to $1.5 million for high-end exploits while scaling back rewards for vulnerabilities easily identified by AI.
The Apache Software Foundation has released critical patches for the Apache HTTP Server and the Apache MINA framework to address over a dozen vulnerabilities, including several that could lead to remote code execution.
A sophisticated phishing campaign impersonating internal compliance notices successfully targeted over 35,000 users to conduct adversary-in-the-middle attacks and steal session tokens.
Trail of Bits released detailed walkthroughs of two C/C++ security challenges from its Testing Handbook, revealing subtle bugs in a Linux ping program and a Windows driver, and introduced a new Claude skill for automated code review.
A Latvian member of the Karakurt ransomware gang has been sentenced to 8.5 years in prison for his role in extorting victims and managing negotiations for the criminal group.
Google researchers have identified a sophisticated iOS zero-day exploit chain named DarkSword, which has been used by state-sponsored actors and surveillance vendors to fully compromise devices since late 2025.
A scan of 1 million exposed AI services has uncovered widespread security failures, including default-off authentication and leaked API keys, leaving enterprise infrastructure vulnerable to data exfiltration and unauthorized code execution.
Anomali has unveiled ThreatStream Next-Gen, a new platform designed to accelerate threat response by automating intelligence-driven decision-making across security workflows.
A Latvian national has been sentenced to 8.5 years in U.S. prison for his role as a negotiator for the Karakurt extortion gang, a group linked to hundreds of millions of dollars in losses and deep ties to Russian state corruption.
Cisco Talos has uncovered a China-nexus threat actor, tracked as UAT-8302, that is leveraging a shared arsenal of sophisticated malware to infiltrate government networks across South America and Europe.
A sophisticated new malware campaign is abusing the Microsoft Phone Link application to intercept SMS-based authentication codes and credentials from Windows PCs.
Threat actors are actively exploiting critical, unauthenticated remote code execution vulnerabilities in MetInfo CMS and Weaver E-cology, leading to potential full server compromise.