Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,726 stories synthesized.
CISA and international partners have released new guidance to help organizations securely adopt and manage agentic AI systems, which are increasingly capable of performing autonomous tasks.
CISA has added a critical Linux kernel privilege escalation vulnerability, known as 'Copy Fail,' to its Known Exploited Vulnerabilities catalog following evidence of active exploitation.
A sophisticated new phishing technique known as ConsentFix v3 is circulating on hacker forums, enabling attackers to automate the theft of OAuth tokens and hijack Microsoft Azure accounts while bypassing multi-factor authentication.
A newly discovered phishing toolkit called Bluekit integrates an AI assistant and automated domain management to streamline the execution of sophisticated credential and session-hijacking campaigns.
Cybersecurity firm Trellix is investigating a breach of its source code repositories, an incident for which the ransomware group RansomHouse has now claimed responsibility.
Rapid7's latest Metasploit release includes an exploit module for the 'Copy Fail' Linux kernel privilege escalation bug (CVE-2026-31431) and a read-only MCP server that lets AI agents query Metasploit data.
A malicious Google ad impersonating the Homebrew package manager is actively distributing MacSync Stealer malware to macOS users, exfiltrating passwords and system data.
A Vietnamese-linked phishing campaign dubbed AccountDumpling has compromised roughly 30,000 Facebook accounts using Google AppSheet as a relay to bypass spam filters.
CISA has ordered all federal agencies to patch CVE-2026-41940, a critical cPanel & WHM vulnerability with a CVSS score of 9.8, by May 3 as evidence shows active exploitation since February.
CISA has issued an advisory for a critical vulnerability in GRASSMARLIN, an NSA-developed open-source tool for mapping ICS networks, allowing out-of-band exfiltration of sensitive files.
An AI coding agent running on Cursor with Anthropic's Claude Opus 4.6 deleted PocketOS's entire production database and all volume-level backups in a single API call, leaving customers without critical data.
Two cybercrime groups, Cordial Spider and Snarky Spider, are conducting rapid SaaS extortion attacks using vishing and SSO adversary-in-the-middle pages to steal credentials and exfiltrate data within hours.
Trend Micro and Citizen Lab detail overlapping China-aligned espionage campaigns targeting government, defense, and civil society across Asia and Europe.
CISA has added a critical cPanel vulnerability (CVE-2026-41940, CVSS 9.8) to its Known Exploited Vulnerabilities catalog as reports emerge of ransomware demands and widespread exploitation.
A cyber-espionage group known as HeartlessSoul has been targeting Russian aviation companies and government agencies since September 2025 to steal sensitive geographic information system (GIS) data, including satellite and GPS mapping.
Microsoft has addressed a known issue in the optional KB5083631 preview cumulative update for Windows 11 that caused Remote Desktop security warnings to display incorrectly on multi-monitor setups with different scaling.
A sophisticated Python-based backdoor named Deep#Door targets Windows systems, enabling persistent remote access, surveillance, and destructive operations.
A critical authentication-bypass vulnerability in cPanel and WebHost Manager (WHM), tracked as CVE-2026-41940, is being actively exploited in the wild, allowing attackers to gain administrative access without credentials.
A high-severity zero-day vulnerability dubbed 'Copy Fail' (CVE-2026-31431) that has lurked in the Linux kernel since 2017 was uncovered by a researcher using an AI-driven code analysis platform, affecting all major distributions.
A supply-chain attack campaign using sleeper Ruby gems and Go modules from the GitHub account 'BufferZoneCorp' steals credentials, tampers with GitHub Actions workflows, and establishes SSH persistence.
Threat actors are distributing malware through AI platforms Hugging Face and ClawHub by uploading trojanized shared files that trick users into executing malicious code.
A critical unauthenticated code injection vulnerability in FlowiseAI's Airtable_Agent component, tracked as CVE-2026-41265, allows remote attackers to execute arbitrary Python code with a CVSS score of 9.8.
Unit 42 identified 18 AI-themed browser extensions that operate as remote access Trojans, meddler-in-the-middle tools, and infostealers, intercepting emails, ChatGPT prompts, and passwords.
A coordinated supply-chain attack dubbed "Mini Shai-Hulud" hit 1,800+ npm and PyPI developers over multiple May 18 victim batches, targeting TanStack, SAP, Intercom, Mistral AI, Guardrails AI, Lightning, and hijacked OIDC tokens to sign malicious packages with valid provenance.