Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,611 stories synthesized.
Apple has expanded iOS 18.7.7 and iPadOS 18.7.7 to additional devices, patching six vulnerabilities exploited by the DarkSword exploit kit in watering-hole attacks that deploy data-stealing malware.
Fortinet reports a multi-stage malware campaign targeting South Korean users via malicious LNK files that use GitHub repositories as a covert C2 channel.
Halcyon researchers report that the Akira ransomware group Akira can complete the entire attack lifecycle in under one hour, using intermittent encryption and zero-day exploits to maximize speed and evade detection.
WatchTowr researchers disclosed a pre-authenticated remote code execution chain in Progress ShareFile's on-premises Storage Zone Controller, affecting roughly 30,000 internet-facing instances.
A command injection vulnerability in Microsoft Visual Studio Code's handling of mcp.json files allows remote code execution when a user opens a malicious project, with a CVSS score of 7.8.
Mozilla has patched a critical type confusion vulnerability in the IonMonkey JIT compiler's switch statement optimization, tracked as CVE-2026-4698, which allows remote code execution via a malicious webpage or file.
A local privilege escalation vulnerability in Foxit PDF Reader's Update Service, tracked as CVE-2026-3775, allows attackers with low-privileged code execution to gain SYSTEM-level access.
Mandiant released a comprehensive defender's guide detailing the BRICKSTORM backdoor that targets VMware vSphere Virtual Center, providing persistent access to virtual infrastructure.
GitHub Security Lab warns of a growing attack pattern where adversaries compromise GitHub Actions workflows to exfiltrate secrets and publish malicious packages, urging adoption of OIDC-based trusted publishing and CodeQL workflow reviews.
Researchers at BlackFog have identified Venom Stealer, a malware-as-a-service platform that uses ClickFix social engineering to automate continuous credential theft and cryptocurrency wallet cracking.
Chinese state-backed group TA416 (Mustang Panda) has resumed targeted espionage campaigns against European governments after a lull since 2023, using web bugs, spoofed Cloudflare pages, OAuth redirects, and C# project files to deliver the PlugX backdoor.
Trail of Bits announced MuTON and mewt, two new mutation testing tools optimized for agentic use, along with a configuration optimization skill to help AI agents set up campaigns efficiently.
Threat actors hijacked the npm account of Axios maintainer Jason Saayman to publish malicious versions of the widely used JavaScript library, deploying cross-platform remote access Trojans that could compromise millions of developer environments.
This week's Risky Business podcast covers a North Korean backdoor in a 100M-downloads-a-week npm package, a TeamPCP breach of Cisco's source code, active exploitation of a Citrix NetScaler memory leak, and AI tools like Claude finding zero-day vulnerabilities.
Jonathan Spalletta, 36, has been charged with hacking the Uranium Finance decentralized exchange twice in April 2021, stealing over $53 million by exploiting smart contract flaws and laundering proceeds through Tornado Cash.
Group-IB has uncovered a sustained phishing campaign delivering Phantom Stealer, a .NET-based infostealer sold as part of a commercial toolkit with subscription tiers, targeting European logistics, manufacturing, and technology sectors.
Check Point Research discovered CVE-2026-3502, a zero-day vulnerability in the TrueConf video conferencing client exploited in a campaign dubbed 'TrueChaos' targeting Southeast Asian government entities with the Havoc payload.
Check Point researchers discovered a vulnerability in ChatGPT that enabled attackers to exfiltrate sensitive data, including messages and uploaded files, through a single malicious prompt exploiting a DNS side channel.
Wiz researchers report a 'dangerous convergence' as the TeamPCP supply chain threat group partners with Lapsus$ and Vect ransomware to validate, exfiltrate, and monetize stolen cloud and Kubernetes credentials.
The UK National Cyber Security Centre and CISA are urging organizations to urgently patch CVE-2025-53521, a critical remote code execution vulnerability in F5 BIG-IP Access Policy Manager that was reclassified from a denial-of-service flaw and is now under active exploitation.
A high-severity vulnerability in the Linux kernel's Analog Device Driver allows local attackers to escalate privileges to kernel level via improper validation of array indices in debugfs commands.
Mandiant has identified a supply chain attack on the widely used Axios npm package, with North Korea-nexus threat actor UNC1069 injecting malicious code that deploys the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux.
Attackers hijacked the lead maintainer's npm account to publish malicious versions of the Axios HTTP client, deploying a cross-platform RAT via a phantom dependency.
Check Point Research has uncovered a hidden outbound communication channel in ChatGPT's code execution runtime that allows a single malicious prompt to silently exfiltrate user messages, uploaded files, and other sensitive data to external servers without triggering any safeguards or user approval.