Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,564 stories synthesized.
Cisco research indicates that country-of-origin labels for AI models are insufficient, as upstream dependencies can obscure true lineage and potential security risks.
A critical vulnerability in the popular GiveWP WordPress plugin allows unauthenticated attackers to achieve remote code execution with a CVSS score of 10.0.
Android 17 introduces significant network security enhancements, including default support for Encrypted Client Hello (ECH), to shield users from Wi-Fi tracking and web snooping.
A new backdoor, HOOKEDGE, linked to the APT28 threat group, has been deployed against European government and diplomatic organizations, utilizing batch scripts and webhook services for command and control.
Key findings • 25 Linux kernel vulnerabilities disclosed on August 28, 2026, affecting diverse subsystems. • Issues range from improper validation and buffer overflows to race conditions and …
Researchers demonstrate a multi-step prompt injection attack that bypasses Claude Code Opus 5's Auto Mode safeguards, leading to arbitrary code execution.
A deep dive into 23.5 million malicious files from Malware Bazaar highlights the continued prevalence of 32-bit Portable Executable (PE) files and significant challenges in identifying their origins.
Running open-weight AI models on-premises introduces significant, often underestimated, operational costs and security responsibilities that demand careful planning, especially for teams with limited resources.
PaperCut is urging customers to apply an emergency patch or take servers offline following active exploitation of a zero-day vulnerability in its NG and MF print management products.
Key findings • 25 WordPress plugins disclosed with vulnerabilities between August 27-28, 2026. • Critical vulnerabilities include RCE and PHP Object Injection in plugins like Tutor LMS, Hash …
Threat actors are leveraging overlooked Active Directory Service Principal Name (SPN) misconfigurations, dubbed 'Ghost SPN,' to conduct stealthier Kerberoasting attacks, potentially leading to privilege escalation.
A critical vulnerability (CVE-2026-65643) in cPanel and WHM allows low-privileged authenticated users to gain root-level control of a server by exploiting the domain parking functionality.
Key findings • Six Wazuh vulnerabilities disclosed on August 28, 2026, affecting versions 4.0.0 through 4.14.6. • Critical CVE-2026-61800 allows remote code execution as root via cluster key …
Key findings • Seven critical and high-severity vulnerabilities disclosed on August 28, 2026, affect Cisagov CSAF products. • Vulnerabilities include missing authentication, command injection…
Key findings • Eight Denial of Service vulnerabilities disclosed together in FFmpeg on August 28, 2026. • All vulnerabilities affect the libswscale component, primarily through integer overfl…
The escalating sophistication of AI-orchestrated cyberattacks is rapidly diminishing the cost advantage currently enjoyed by defenders, according to General Dynamics' Matt Hayden.
The DireWolf ransomware gang claims to have stolen 253 gigabytes of sensitive data from the National Kidney Registry, raising critical concerns about patient safety and the security of vital organ transplant operations.
The CRPx0 cybercrime service claims its victim count has surged to 48 organizations, offering a customizable ransomware-as-a-service platform and data extraction tools to aspiring criminals.
Key findings • Three vulnerabilities disclosed for Dolibarr on August 27, 2026, impacting file handling, API authorization, and data import. • CVE-2026-81730 (High, CVSS 8.2): Insecure file a…
Key findings • Four Denial of Service vulnerabilities disclosed for Open5GS v2.7.6 on August 27, 2026. • Two vulnerabilities are integer overflows, triggered by crafted GTP packets and HTTP/2…
Key findings • 25 Adobe vulnerabilities disclosed Aug 25-27, 2026, spanning multiple products. • Critical OS Command Injection flaws in Adobe Campaign Classic (CVE-2026-76197, CVE-2026-76195,…
Wordfence has developed an advanced AI agent named Wordfence Argus, capable of discovering critical vulnerabilities in WordPress themes at a pace and scale exceeding human researchers.
Numerous ZBT routers, distributed worldwide as white-label devices, have been discovered with multiple built-in backdoors, raising significant security concerns for users.
A staging version of the AI companion review site Intimeros was left publicly accessible and indexed by Google for three weeks, exposing unpublished content and strategic plans.