Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,727 stories synthesized.
The North Korean state-sponsored group ScarCruft has compromised a regional gaming platform to distribute trojanized Windows and Android software, enabling long-term espionage against ethnic Koreans in China.
The North Korean-aligned APT group ScarCruft has compromised a regional gaming platform to distribute sophisticated Windows and Android backdoors in a targeted supply-chain attack.
Cybersecurity vendor Trellix has revealed that threat actors gained unauthorized access to a portion of its source code repository, raising concerns about potential supply chain attacks.
Meta has patched two medium-impact vulnerabilities in WhatsApp while simultaneously upgrading the cryptographic transparency of its end-to-end encrypted backup infrastructure.
Microsoft has uncovered a massive, multi-stage phishing campaign that leveraged enterprise-themed lures and adversary-in-the-middle tactics to bypass multi-factor authentication for over 35,000 users.
Researchers have developed a new machine learning model, VulStyle, that identifies potential security vulnerabilities by analyzing the unique coding habits and stylistic patterns of software developers.
A new analysis from Noma Security warns that 25% of enterprise MCP servers are vulnerable to code execution risks, with AI agents frequently exposed to toxic instruction chains that can lead to data exfiltration and system destruction.
Organizations globally are actively recruiting for a wide array of cybersecurity roles, emphasizing a growing need for professionals who can balance technical security operations with governance and compliance requirements.
The SANS Internet Storm Center released its daily security briefing on May 5, 2026, providing a status update on the current threat landscape for security professionals.
Trend Micro exposes the InstallFix campaign, in which threat actors use fake Claude AI installer pages promoted through Google Ads to deliver malware that disables security features and establishes persistent access.
A critical, actively exploited remote code execution vulnerability in the Weaver E-cology platform is allowing unauthenticated attackers to execute arbitrary commands via an exposed debug API.
The UK's National Health Service has ordered a temporary shift of its public GitHub repositories to private status, citing concerns that advanced AI models could exploit exposed source code.
A stealthy phishing campaign dubbed VENOMOUS#HELPER is compromising organizations by weaponizing legitimate, signed RMM tools to maintain persistent, undetected access to victim systems.
New research reveals that children are frequently bypassing UK Online Safety Act age verification measures using simple tactics, including fake mustaches and false identification, while nearly half of surveyed children continue to encounter harmful content online.
Threat actors are increasingly exploiting Amazon Simple Email Service (SES) to deliver high-quality phishing and BEC attacks that bypass traditional email authentication filters.
Threat actors are increasingly leveraging Amazon Simple Email Service (SES) to launch sophisticated phishing campaigns that bypass traditional security defenses by exploiting leaked AWS credentials.
A critical authentication bypass vulnerability in cPanel software is under heavy, active exploitation, leading to widespread server compromises and ransomware attacks just days after its disclosure.
Cisco has announced its intent to acquire Astrix Security for approximately $400 million to strengthen its ability to secure non-human identities and AI-driven agents.
A sophisticated phishing campaign has compromised over 80 organizations by deploying legitimate RMM tools to establish persistent, dual-channel remote access.
Educational technology provider Instructure is investigating a data breach involving its Canvas learning management system after the ShinyHunters hacking group claimed to have stolen 3.6 terabytes of data from thousands of schools.
A malicious version of the popular PyTorch Lightning AI framework was found on PyPI, containing a hidden, credential-stealing payload linked to a broader, cross-ecosystem supply-chain attack.
Forbes Media has agreed to a $10 million preliminary settlement to resolve a class-action lawsuit alleging the company violated California privacy laws by tracking users without consent.
Trellix, a global cybersecurity firm protecting over 200 million endpoints, has confirmed that unauthorized actors gained access to a portion of its source code repository.
The ransomware group World Leaks has published 8.5 terabytes of data stolen from Mediaworks, a major Hungarian media firm, following a breach that exposed sensitive internal communications and financial records.