Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,726 stories synthesized.
A new variant of the Redtail cryptominer, dubbed 'libredtail,' is actively spreading via HTTP by exploiting CVE-2024-4577 to compromise PHP servers and deploy cryptocurrency mining payloads.
A high-severity local privilege escalation vulnerability in the Linux kernel's authencesn cryptographic template, dubbed Copy Fail, allows unprivileged users to gain root access on nearly all distributions released since 2017.
Trend Micro reveals Shadow-Earth-053, a China-aligned cyberespionage campaign exploiting unpatched Microsoft Exchange vulnerabilities to target government and defense sectors across Asia.
GitHub disclosed CVE-2026-3854, a high-severity remote code execution vulnerability in GitHub Enterprise Server, discovered by Wiz using an AI-powered reverse-engineering tool that cut analysis time from weeks to under 48 hours.
A critical authentication bypass vulnerability in cPanel & WHM (CVE-2026-41940, CVSS 9.8) is being actively exploited in the wild, granting unauthenticated attackers root-level access to over a million exposed servers.
An AI-driven code analysis by Aisle has revealed 38 previously unknown vulnerabilities in OpenEMR, the open-source EHR platform used by over 100,000 healthcare providers, including a critical SQL injection flaw rated CVSS 10.0.
Microsoft and CISA warn that CVE-2026-32202, a zero-click authentication coercion flaw in Windows Shell stemming from an incomplete fix for a Russian-APT28-exploited bug, is being actively exploited.
A critical authentication bypass vulnerability in cPanel and WebHost Manager, CVE-2026-41940, is being actively exploited by threat actors to deploy backdoors and harvest credentials on a global scale.
A supply chain attack has compromised four SAP-related npm packages with credential-stealing malware that steals credentials, cloud secrets, and targets AI coding agent configurations for persistence.
CISA has flagged CVE-2026-6807, an XXE vulnerability in the NSA-developed OT network tool GrassMarlin, which can leak sensitive data via crafted session files.
A design flaw in the Vect 2.0 ransomware-as-a-service variant causes it to permanently destroy large files instead of encrypting them, making recovery impossible even for victims who pay the ransom.
A high-severity vulnerability in the AI coding tool Cursor allows any installed extension to access locally stored API keys and session tokens without user interaction.
ReversingLabs has uncovered PromptMink, a North Korean threat-actor campaign that uses malicious npm packages introduced by an AI coding assistant to steal cryptocurrency from developers in the Web3 space.
ReversingLabs has uncovered a malicious npm package, @validate-sdk/v2, linked to North Korean threat actor Famous Chollima (APT37), which was added to an autonomous trading agent via an AI-assisted commit co-authored by Anthropic's Claude Opus model.
A researcher disclosed PhantomRPC, a local privilege escalation weakness in Windows RPC that Microsoft declined to patch, calling it a feature not a bug.
Wiz researchers discovered a high-severity vulnerability in GitHub's git infrastructure that allowed remote attackers to gain full read/write access to private repositories using a single command, earning one of the largest bug bounties in GitHub's history.
Kaspersky Lab has identified a previously unknown wiper, dubbed Lotus Wiper, used in a December 2025 attack against Venezuelan energy firms and utilities, relying on living-off-the-land techniques to disable defenses before destroying data.
KELA's 2026 threat report tracked 2.9 billion compromised credentials globally in 2025, with infostealer infections on macOS surging from under 1,000 to over 70,000 and a 45% increase in ransomware victims.
Jenkins released a security advisory on April 29, 2026, patching seven vulnerabilities across six plugins, including a high-severity path traversal bug that can lead to remote code execution.
Trail of Bits has integrated the advanced LibAFL fuzzing engine into Ruzzy, its coverage-guided fuzzer for Ruby, enabling improved performance and modularity.
Check Point Research has discovered a critical implementation flaw in Vect 2.0 ransomware that causes it to permanently destroy files larger than 128 KB instead of encrypting them, making recovery impossible even for the attackers.
Mozilla's Firefox 150 release patches 271 zero-day vulnerabilities discovered by Anthropic's Claude Mythos Preview AI model, signaling a paradigm shift in defensive cybersecurity capabilities.
cPanel has released emergency patches for CVE-2026-41940, a critical authentication bypass vulnerability in cPanel and WHM with a CVSS score of 9.8, which is being actively exploited in the wild as a zero-day for at least 30 days.
CISA has added CVE-2024-1708 (ConnectWise ScreenConnect) and CVE-2026-32202 (Microsoft Windows Shell) to its Known Exploited Vulnerabilities catalog, citing active exploitation in the wild.