Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,726 stories synthesized.
Kaspersky researchers have uncovered 26 malicious apps on the Apple App Store that impersonate popular cryptocurrency wallets to steal recovery phrases and private keys, marking a significant escalation in iOS-targeted crypto theft.
A new campaign attributed to the Chinese-speaking threat group Tropic Trooper uses a trojanized SumatraPDF reader to deliver the AdaptixC2 Beacon, leveraging GitHub for command-and-control and VS Code tunnels for remote access.
Malicious npm packages @automagik/genie and pgserve are spreading worm-like malware that steals credentials, cloud tokens, SSH keys, and cryptocurrency wallet data, with self-propagation capabilities extending to PyPI.
Researchers have disclosed PhantomRPC, a novel privilege escalation technique in the Windows RPC architecture that allows processes with impersonation privileges to gain SYSTEM access on all Windows versions, with no patch available.
A high-severity SSRF vulnerability in LMDeploy's vision-language module is being actively exploited less than 13 hours after public disclosure, with attackers targeting AWS IMDS, Redis, and MySQL.
ESET researchers have uncovered a Chinese APT group, GopherWhisper, that has been targeting the Mongolian government since November 2023 with five distinct backdoors abusing Slack, Discord, and Microsoft Outlook for command-and-control.
The China-linked APT23 group has broadened its espionage operations to Japan, South Korea, and Taiwan, using compromised home Wi-Fi routers to hijack DNS and deliver Cobalt Strike beacons through a novel supply-chain attack.
The UK's NCSC, alongside US and other agencies, warns that China-nexus threat actors are industrializing botnets of compromised SOHO routers and IoT devices for large-scale, deniable cyber operations.
Mandiant has identified UNC6692, a threat actor using Microsoft Teams to impersonate IT help desk staff and deploy the modular SNOW malware suite, with 77% of observed incidents targeting senior executives.
Wordfence's weekly vulnerability report for April 13-19, 2026, discloses 139 vulnerabilities across 118 plugins and 10 themes, with 30 remaining unpatched and 6 rated critical severity.
Cisco Talos has identified that threat actor UAT-4356 is actively exploiting n-day vulnerabilities in Cisco Firepower FXOS devices to deploy a custom backdoor named FIRESTARTER, which achieves persistence through CSP_MOUNT_LIST manipulation and executes arbitrary shellcode within the LINA process.
Cisco researchers demonstrated a technique to compromise Anthropic Claude Code's memory.md file through NPM post-install hooks, achieving persistent code injection across sessions and projects.
The Bitwarden CLI package was briefly compromised via a malicious npm release, part of a broader supply chain campaign linked to Checkmarx, stealing developer secrets and CI/CD tokens.
North Korean threat actor TraderTraitor is suspected in the $290M KelpDAO DeFi hack, which exploited compromised LayerZero RPC nodes rather than a smart contract flaw.
Apple has released emergency patches for CVE-2026-28950, a Notification Services flaw in iOS and iPadOS that caused deleted message alerts to persist in system storage, potentially exposing sensitive content to forensic recovery.
The UK's National Cyber Security Centre warns that China-nexus cyber actors are constructing dynamic, large-scale covert networks from compromised routers and edge devices, rendering traditional static defenses ineffective.
A joint international advisory details how China-nexus cyber actors are using large-scale covert networks of compromised SOHO routers and IoT devices for reconnaissance, malware delivery, and espionage.
Anthropic's Project Glasswing, powered by the Mythos Preview model, discovered vulnerabilities across major OSes and browsers including a 27-year-old bug in OpenBSD, but fewer than 1% were patched, exposing a critical remediation gap.
The FBI forensically recovered deleted Signal messages from an iPhone by accessing the device's push notification database, which retained message previews even after the app was removed.
Apple has fixed CVE-2026-28950, a logging flaw in iOS and iPadOS that caused deleted notifications—including chat message previews from apps like Signal—to be retained in a device database, a bug law enforcement exploited to recover messages from an unlocked iPhone.
Palo Alto Networks' Unit 42 researchers have built a proof-of-concept multi-agent LLM system called Zealot that autonomously chains SSRF exploitation, metadata service credential theft, and data exfiltration in Google Cloud Platform environments.
Palo Alto Networks Unit 42 researchers have built 'Zealot,' an autonomous multi-agent AI system that executed a complete cloud attack chain from initial access to data exfiltration in under three minutes using a single natural-language prompt.
Forcepoint researchers have identified 10 real-world indirect prompt injection payloads that poison web content to hijack AI agents, enabling data theft, file destruction, and fraudulent payments.
ESET has uncovered a China-aligned APT group, GopherWhisper, that has compromised at least 12 Mongolian government systems using a suite of Go-based backdoors that abuse legitimate services like Discord and Slack for command-and-control.