Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,724 stories synthesized.
A trojanized copy of the WowShipping Pro WordPress plugin contains a dropper that silently installs a full-featured remote access toolkit, with the vendor releasing a fix on March 22, 2026.
The FBI has dismantled the W3LL phishing platform and arrested its developer, while Ukraine's CERT-UA warns of the AgingFly malware campaign targeting government and healthcare, and attackers actively exploit a critical Nginx UI vulnerability (CVE-2026-33032) for full server takeover.
Trail of Bits researchers exploited memory safety and logic vulnerabilities in Google's Rust-based zero-knowledge proof code to forge a proof that falsely claims a quantum circuit can break elliptic curve cryptography in 9 minutes with zero Toffoli gates.
Palo Alto Networks' Unit 42 has analyzed active exploitation attempts targeting CVE-2023-33538, a command injection vulnerability in end-of-life TP-Link routers, finding that while current payloads are flawed, the underlying risk remains significant due to default credential reuse.
A critical missing authentication vulnerability in Nginx UI (CVE-2026-33032, CVSS 9.8) is being actively exploited in the wild, allowing unauthenticated attackers to take full control of managed Nginx servers.
Cisco Talos has disclosed a critical use-after-free vulnerability in Foxit Reader (CVE-2026-3779) and six heap-based buffer overflow and integer overflow flaws in the LibRaw library, all of which have been patched by the respective vendors.
Cisco Talos' Q1 2026 vulnerability pulse reveals networking gear accounts for 20% of Known Exploited Vulnerabilities, attackers are weaponizing the n8n AI workflow platform for malware delivery, and AI-relevant CVEs rose to 121.
Attackers are actively exploiting CVE-2026-0740, a critical arbitrary file upload vulnerability in the Ninja Forms – File Upload WordPress plugin, with over 118,600 blocked exploit attempts since April 6, 2026.
Wordfence's weekly vulnerability report reveals 157 flaws across 141 plugins and 23 themes, with 11 rated critical severity and 17 remaining unpatched as of April 12, 2026.
Cleafy researchers have identified APK malformation as a standard evasion technique in over 3,000 Android malware samples, including Teabot, TrickMo, Godfather, and SpyNote, allowing malicious apps to bypass static analysis tools while installing normally.
Cookeville Regional Medical Center in Tennessee has begun notifying 337,917 patients that their personal and medical data was stolen in a July 2025 ransomware attack carried out by the Rhysida group.
Rapid7 has uncovered a ClickFix phishing campaign that uses a fake installer for the AI tool Claude to deliver a multi-stage payload targeting organizations in the EU and US.
Cisco Talos has uncovered PowMix, a previously undocumented botnet targeting Czech organizations since December 2025, using randomized C2 beaconing and AMSI-bypassing PowerShell loaders.
Apple has released Xcode 26.4.1 (17E202), a security-focused update for its integrated development environment, addressing vulnerabilities that could impact developers and the applications they build.
A systemic vulnerability in Anthropic's Model Context Protocol allows arbitrary command execution via the STDIO interface, potentially affecting over 150 million downloads and 200,000 instances.
Drupal has released version 11.3.7 to fix a moderately critical stored cross-site scripting vulnerability in CKEditor 5's entity suggestion feature, tracked as CVE-2026-6367.
Drupal has released security updates to fix a gadget chain vulnerability, CVE-2026-6366, that could enable remote code execution or SQL injection when combined with an insecure deserialization flaw.
Drupal has released emergency security updates to fix a critical cross-site scripting vulnerability (CVE-2026-6365) in core's AJAX modal dialog jQuery integration, affecting versions 8.0.0 through 11.3.6.
A signed adware campaign linked to Dragon Boss Solutions LLC has disabled antivirus on over 23,000 hosts globally, using a legitimate code-signing certificate and a PowerShell script to kill security tools from Malwarebytes, Kaspersky, McAfee, and ESET.
A critical authentication bypass in nginx-ui, tracked as CVE-2026-33032 with a CVSS score of 9.8, is being actively exploited, allowing unauthenticated attackers to fully compromise nginx servers via a single API request.
Cisco Talos has uncovered a widespread campaign where threat actors abuse the n8n AI workflow automation platform to deliver malware and fingerprint devices via automated emails, with a 686% surge in malicious n8n webhook URLs observed by March 2026.
Researchers at Barracuda report a sharp rise in brute-force attacks targeting SonicWall and Fortinet edge devices, with 88% of attempts originating from Middle Eastern IPs amid heightened US-Israeli hostilities with Iran.
Microsoft's April 2026 Patch Tuesday addresses two zero-day vulnerabilities, including one actively exploited in SharePoint, and a critical RCE in Windows IKE service.
A supply-chain compromise has compromised over 20 WordPress plugins by EssentialPlugin after the vendor was sold to a malicious buyer on Flippa, who planted a PHP object-injection backdoor that remained dormant for seven months before triggering it on April 5, 2026.