Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,611 stories synthesized.
A medium-severity information disclosure vulnerability in OpenClaw's OAuth PKCE verifier exposes stored credentials in the authorization URL query string, requiring user interaction to exploit.
A critical SQL injection vulnerability in QNAP QHora-322 routers, discovered during Pwn2Own, allows remote authenticated attackers to execute arbitrary code as root; QNAP has released a security update.
The Zero Day Initiative has disclosed CVE-2023-6270, a use-after-free vulnerability in the Linux kernel's ATA over Ethernet (AoE) driver that allows local attackers to escalate privileges to kernel level.
Three days after compromising LiteLLM, TeamPCP published malicious Telnyx SDK versions to PyPI, using WAV audio steganography and split-file injection to steal credentials across Windows, Linux, and macOS.
watchTowr Labs reveals that CVE-2026-3055 actually covers at least two memory overread vulnerabilities in Citrix NetScaler, with exploitation in the wild observed since March 27th.
Check Point Research reveals that a single developer used a commercial AI-powered IDE to build the sophisticated VoidLink Linux malware framework in under a week, marking a turning point in AI-assisted cybercrime.
Citrix disclosed CVE-2026-3055, a critical memory overread vulnerability in NetScaler ADC and Gateway, with watchTowr Labs warning of a troubling pattern of similar flaws.
Push Security has identified a new wave of Adversary-in-the-Middle phishing pages targeting TikTok for Business accounts, registered on March 24, 2026, using TikTok- or Google-themed content hosted behind Cloudflare.
TeamPCP has compromised the official Telnyx Python SDK on PyPI, publishing malicious versions that exfiltrate SSH private keys and bash history at install time.
The Silver Fox threat actor is conducting a targeted spearphishing campaign against Japanese manufacturers and businesses, exploiting the country's tax filing and HR change season to deliver ValleyRAT.
Researchers at Georgia Tech have documented 74 confirmed CVEs directly introduced by AI coding tools like Claude Code, with 35 disclosed in March 2026 alone, and estimate the real number is 400-700 cases across open-source projects.
A CloudSEK honeypot study reveals that attackers began exploiting CVE-2026-21962, a critical Oracle WebLogic RCE vulnerability with a CVSS score of 10.0, on the same day public exploit code was released.
Researchers at eSentire have uncovered a new EtherRAT campaign that uses Ethereum smart contracts to store command-and-control addresses, enabling stealthy, low-cost infrastructure rotation.
The Iran-linked Pay2Key ransomware group has resurfaced with advanced evasion and anti-forensics capabilities, targeting a US healthcare provider and encrypting its entire infrastructure in three hours.
Russia-aligned APT group Pawn Storm has deployed a new malware suite called PRISMEX to target the defense supply chain of Ukraine and its allies, exploiting a Windows zero-day and using steganography to evade detection.
Trend Micro reveals that TeamPCP compromised the LiteLLM AI proxy package on PyPI, deploying a three-stage malware that stole cloud credentials and Kubernetes secrets in a cascading supply chain attack.
Group-IB research reveals cloud phones—remote Android devices hosted in data centers—are increasingly used in financial fraud, including creating dropper accounts for authorized push payment fraud.
The TeamPCP threat group has compromised the LiteLLM Python package on PyPI, stealing SSH keys, cloud credentials, and Kubernetes secrets from environments with over 95 million monthly downloads.
Security firm Expel has uncovered a wave of malicious Chrome extensions that secretly monitor browser tabs for AI chatbot sessions and exfiltrate user prompts and responses to attacker-controlled servers.
Trail of Bits has released a new Claude plugin that uses dimensional analysis to mechanically detect type mismatches in codebases, achieving 93% recall in testing against real audit findings.
This week's Risky Business podcast covers a wave of supply-chain attacks including a PyPI compromise of LiteLLM and malware injected into Checkmarx KICS GitHub Action tags, alongside an iOS exploit kit targeting hundreds of millions of iPhones.
GitLab released versions 18.10.1, 18.9.3, and 18.8.7 on March 25, 2026, fixing multiple high-severity vulnerabilities including a Jira Connect credential theft bug (CVE-2026-2370) and a CSRF flaw in the GLQL API (CVE-2026-3857).
Malicious versions of the litellm Python package on PyPI are actively exfiltrating cloud credentials, SSH keys, and Kubernetes secrets from AI infrastructure.
The Silver Fox intrusion group has shifted tactics between 2025 and 2026, combining espionage-style operations with financially motivated cybercrime in three campaign waves targeting organizations across South and East Asia.