Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,726 stories synthesized.
A critical SQL injection vulnerability in BerriAI's LiteLLM Python package, CVE-2026-42208, is being actively exploited in the wild just 36 hours after disclosure, with attackers targeting database tables holding LLM provider keys and proxy credentials.
Threat actors exploited the legitimate Kuse AI workplace platform to host a phishing document, using a compromised vendor email and a blurred markdown file to steal credentials.
North Korea's BlueNoroff group is using AI-generated avatars and stolen webcam footage in fake Zoom meetings to trick cryptocurrency executives into installing malware, with full compromise achieved in under five minutes.
Law enforcement disruptions of Lumma and Rhadamanthys have propelled the Vidar has vaulted to become the most-used infostealer on Russian Market, driven by a major upgrade and expanded distribution network.
Check Point Research has discovered that the Vect ransomware, used in recent supply-chain attacks, is actually a wiper that permanently destroys files larger than 128KB, making data recovery impossible even for the attackers.
Researchers at Wiz have disclosed a critical command injection vulnerability in GitHub.com and GitHub Enterprise Server that allows authenticated attackers to achieve remote code execution with a single git push.
Brazilian threat group LofyGang has resurfaced after three years with a new campaign targeting Minecraft players, distributing a stealer disguised as a fake game hack.
A critical remote code execution vulnerability in GitHub's git push pipeline, discovered by Wiz researchers, allowed any user with push access to execute arbitrary commands on GitHub servers.
The ongoing GlassWorm supply-chain attack has released a fresh wave of 73 malicious VS Code extensions on the Open VSX marketplace, using a 'sleeper' tactic to evade detection and deliver self-replicating malware.
ShinyHunters has leaked 8.2 million unique email addresses, names, phone numbers, and physical addresses from logistics tech firm Pitney Bowes, with the breach confirmed by Have I Been Pwned on April 27, 2026.
A critical encryption flaw in the VECT 2.0 ransomware permanently destroys files larger than 131KB instead of encrypting them, making recovery impossible even for the operators.
Attackers are probing Vercel deployments with a custom, undocumented HTTP header that may trick servers into setting a bypass cookie, potentially relaxing security controls.
Check Point Research reveals that VECT 2.0 ransomware permanently destroys files larger than 128 KB due to a nonce-handling bug in its ChaCha20-IETF implementation, making recovery impossible even for the attackers.
Ransomware groups 0APT and KryBit have engaged in a damaging turf war, publicly leaking each other's operational data and revealing fabricated victim claims.
A critical unauthenticated remote code execution vulnerability (CVE-2026-25874, CVSS 9.3) has been disclosed in Hugging Face's LeRobot open-source robotics platform, with no patch currently available.
North Korean threat group BlueNoroff has compromised over 100 cryptocurrency organizations across 20+ countries using typosquatted Zoom domains, AI-generated deepfakes, and ClickFix clipboard injection attacks.
Chinese national Xu Zewei, a member of the Silk Typhoon hacking group, has been extradited from Italy to the U.S. for allegedly stealing COVID-19 vaccine data and exploiting Microsoft Exchange zero-days.
A privilege escalation flaw in Microsoft Entra ID's Agent ID Administrator role allowed users to take over arbitrary service principals, potentially granting attackers broader tenant control.
Microsoft has confirmed that CVE-2026-32202, a Windows Shell spoofing vulnerability patched in April 2026, is being actively exploited in the wild as a zero-click credential theft vector.
The Zero Day Initiative has published a sandbox escape vulnerability in OpenAI Codex as a 0-day advisory after OpenAI rejected the report as out of scope for its bug bounty program.
A race condition in Oracle VirtualBox's SoundBlaster 16 virtual device, tracked as CVE-2026-35230, allows a guest attacker with high privileges to execute arbitrary code in the hypervisor context.
Checkmarx has confirmed that data posted by the Lapsus$ extortion group originated from its GitHub repository, accessed via a prior compromise of the Trivy open-source scanner in an ongoing supply-chain campaign targeting security and developer tools.
Google Threat Intelligence and Mandiant have identified a new financially motivated threat actor, UNC6692, that blends social engineering via Microsoft Teams with custom malware and AWS S3 bucket abuse.
An unpatched architectural flaw in Windows RPC, dubbed PhantomRPC, allows low-privileged attackers to escalate to SYSTEM by impersonating legitimate services.