Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,726 stories synthesized.
Checkmarx has confirmed that data from its GitHub repository was published on the dark web following a March 23 supply-chain attack attributed to threat actor TeamPCP.
The TeamPCP supply chain campaign resumed after a 26-day pause with three concurrent compromises targeting Checkmarx KICS, Bitwarden CLI, and xinference, alongside the discovery of a self-propagating npm worm called CanisterSprawl.
This week's cybersecurity news covers a Lua-based malware predating Stuxnet, a backdoor targeting U.S. federal agencies, a wiper aimed at Venezuelan energy systems, and multiple ransomware developments.
Researchers at SentinelOne have discovered fast16, a previously undocumented malware framework dating back to 2005 that predates Stuxnet as the earliest known cyber sabotage tool, designed to corrupt high-precision calculations in engineering and scientific software.
Check Point's weekly threat report details a Vercel breach via compromised OAuth tokens, a Bitwarden supply-chain attack, and critical out-of-band patches from Microsoft for ASP.NET Core.
Pro-Ukrainian hacktivist group PhantomCore exploited three TrueConf Server vulnerabilities to breach Russian networks since September 2025, using a chain of authentication bypass, arbitrary file read, and command injection flaws.
Home security giant ADT has confirmed a cyber intrusion on April 20 after the ShinyHunters group attempted extortion group claimed to have stolen over 10 million Salesforce records containing customer PII.
Socket researchers have identified 73 cloned VS Code extensions on the Open VSX repository linked to the GlassWorm v2 campaign, with six confirmed malicious and the rest acting as sleeper packages.
Researchers at SentinelOne have identified Fast16, a previously unknown malware family from 2005 designed to sabotage Iran's nuclear program, making it the earliest known state-backed cyber-sabotage operation, predating Stuxnet by five years.
A financially motivated extortion group tracked as BlackFile has been targeting retail and hospitality firms since February 2026, using vishing attacks, MFA bypass, and SaaS data exfiltration to demand seven-figure ransoms.
A massive international revenue share fraud campaign uses fake CAPTCHA pages to trick victims into sending premium-rate SMS messages, while over 120 malicious campaigns abuse the Keitaro traffic distribution system for malware delivery and cryptocurrency theft.
A critical authentication bypass vulnerability in Flowise, a popular low-code platform for building LLM applications, allows unauthenticated remote attackers to compromise systems via a flawed password reset mechanism.
A use-after-free vulnerability in Foxit PDF Reader's handling of AcroForm Signature objects could allow attackers to leak sensitive memory contents by tricking users into opening a malicious PDF file.
A use-after-free vulnerability in Foxit PDF Reader's Annotation object handling, tracked as CVE-2026-5940, allows remote attackers to execute arbitrary code by tricking users into opening a malicious PDF file.
A use-after-free vulnerability in Foxit PDF Reader's handling of AcroForm Annotation objects, tracked as CVE-2026-5943, allows attackers to execute arbitrary code by tricking users into opening a malicious PDF file.
A critical use-after-free vulnerability in Foxit PDF Reader's AcroForm Signature handling allows remote attackers to execute arbitrary code, with a patch now available.
Google's Threat Intelligence Group has identified a new threat group, UNC6692, that combines help desk impersonation via Microsoft Teams with a custom modular malware ecosystem dubbed 'Snow' to steal credentials and establish persistent backdoor access.
New analysis confirms the Lua-based fast16 malware was a pre-Stuxnet cyber sabotage tool designed to corrupt uranium-compression simulations used in nuclear weapon design.
CISA added four actively exploited vulnerabilities to its KEV catalog, affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers, with a federal patch deadline of May 8, 2026.
Rapid7's latest Metasploit Wrap-Up introduces four new modules, including exploits for a directory traversal in Camaleon CMS, a prompt injection RCE in Langflow, and an updated WebDAV PHP Upload module with Linux support.
CISA and NCSC disclosed that an unnamed federal agency's Cisco Firepower device was compromised with the FIRESTARTER backdoor, which persists across firmware updates and reboots.
SentinelOne's Week 17 roundup covers guilty pleas from a Scattered Spider leader and a ransomware negotiator, Chinese-linked botnet expansions, and a newly discovered pre-Stuxnet sabotage framework.
North Korea's Lazarus Group is targeting macOS users in the FinTech and cryptocurrency sectors with a new malware kit delivered through ClickFix social engineering attacks on Telegram.
A dataset containing genetic sequences, blood samples, and medical imaging of half a million UK Biobank volunteers was offered for sale on the Chinese e-commerce platform Alibaba, prompting an emergency government response.