Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,725 stories synthesized.
Attackers are actively exploiting a critical unauthenticated RCE vulnerability in BeyondTrust Remote Support (Bomgar) to deploy LockBit ransomware and compromise downstream clients via MSP supply chains.
Google has fixed a critical vulnerability in its Antigravity agentic IDE that allowed attackers to escape the Secure Mode sandbox and achieve remote code execution through a prompt injection attack.
Rapid7 has analyzed Kyber ransomware, a new cross-platform family that simultaneously encrypts VMware ESXi datastores and Windows systems using distinct cryptographic implementations.
The Gentlemen ransomware-as-a-service operation has claimed over 320 victims since mid-2025, with affiliates using cross-platform encryptors and post-exploitation tools like SystemBC and Cobalt Strike.
Cisco Talos reports that phishing remained the top initial access vector in 2025, with attackers increasingly using cascaded campaigns from compromised trusted accounts and abusing Microsoft 365 Direct Send to spoof internal emails.
Chinese state-sponsored APT Mustang Panda is targeting Indian banks, including HDFC Bank, alongside US and South Korean policy circles using spear-phishing and DLL sideloading to deploy the LotusLite backdoor.
Cisco Talos has published research detailing how adversaries can abuse native macOS features like Remote Application Scripting and Spotlight metadata for lateral movement, payload staging, and persistence, bypassing traditional security monitoring.
Vercel confirmed a cyber incident where a sophisticated attacker exploited a third-party tool, Context.ai, to compromise an employee's Google Workspace account and access internal environments.
ESET researchers have uncovered a new NGate malware variant that trojanizes the legitimate Android NFC relay app HandyPay, enabling attackers to steal payment card data and PINs for contactless ATM cash-outs.
North Korea's Lazarus Group is accused of stealing $293 million from liquid restaking protocol KelpDAO by exploiting a single-point-of-failure configuration in LayerZero's cross-chain messaging infrastructure.
Microsoft has declined to patch a newly disclosed zero-day vulnerability in Windows library-ms file parsing that leaks NTLM responses to network-adjacent attackers, prompting ZDI to publish a public advisory.
A critical unauthenticated server-side request forgery vulnerability in the PublicCMS getXml method, disclosed as a 0-day by ZDI, allows remote attackers to disclose sensitive information with no patch forthcoming.
A critical command injection vulnerability (CVE-2026-5059, CVSS 9.8) in aws-mcp-server allows unauthenticated remote code execution, with the vendor rejecting the report and leaving users exposed.
Zero Day Initiative has disclosed a 0-day vulnerability in Microsoft Office's URI handler that leaks NTLM responses, after Microsoft declined to fix the flaw, deeming it below its security servicing bar.
North Korea-linked threat actor Void Dokkaebi is using fake job interviews to trick developers into downloading malware from compromised code repositories, creating a self-propagating supply chain attack.
Darktrace researchers have discovered ZionSiphon, a new malware strain designed to compromise water treatment and desalination OT systems, combining privilege escalation and USB propagation with attempts to modify chlorine dosing and pressure parameters.
Two active phishing campaigns are delivering the Formbook infostealer to Windows systems using DLL sideloading via RAR attachments and obfuscated JavaScript hidden in PDF files, targeting organizations across Europe and South America.
Check Point's weekly threat intelligence report details multiple high-profile breaches, including Booking.com, McGraw-Hill, and EssentialPlugin, alongside active exploits for Apache ActiveMQ and Splunk.
FortiGuard Labs has uncovered a campaign exploiting CVE-2024-3721 in TBK DVR systems to deploy Nexcorium, a multi-architecture Mirai-based botnet targeting ARM, MIPS, and x86-64 devices for DDoS attacks.
Check Point Research reveals that The Gentlemen ransomware-as-a-service operation has claimed over 320 victims, with affiliates deploying SystemBC proxy malware to establish covert tunnels in corporate networks.
Kaspersky researchers have uncovered over 20 phishing apps in the Apple App Store that masquerade as legitimate crypto wallets and use iOS provisioning profiles to install trojanized wallet versions that steal recovery phrases and private keys.
Attackers used a Lumma Stealer infection at Context.ai to compromise OAuth tokens and access Vercel's internal systems, exposing customer environment variables.
Unit 42 has identified Iranian threat group CL-STA-1128 (Cyber Av3ngers) actively targeting Rockwell Automation OT/ICS systems, with over 5,600 exposed IPs globally and a new CISA advisory issued.
The Metasploit Framework released seven new modules this week, including exploits for critical vulnerabilities in AVideo, openDCIM, Selenium Grid, and ChurchCRM, alongside three new Windows persistence techniques.