Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,564 stories synthesized.
Key findings • 25 vulnerabilities disclosed in WordPress plugins and themes on August 25, 2026. • Vulnerabilities include XSS, privilege escalation, SQLi, file upload, and auth bypass. • …
Malwarebytes Labs warns of sophisticated phishing campaigns targeting TikTok users with fake login pages designed to steal credentials and two-factor authentication codes.
Anthropic's Claude AI now offers enterprise-managed authorization for its Model Context Protocol (MCP) connectors, integrating with identity providers like Okta to centralize access control for workplace tools.
AI supply chain risks are currently most prevalent in developer workflows and open-source repositories, according to Zentera Systems CEO Dr. Jaushin Lee.
Key findings • Critical CVE-2026-13214: Stack buffer overflow in OCPP 1.6 client with CVSSv3 9.8. • Two medium-severity vulnerabilities disclosed: CVE-2026-9728 (syscall verifier) and CVE-202…
Modern cybercrime operations have transformed into a sophisticated, multi-stage supply chain, mirroring legitimate business models with specialized roles and financial transactions at each step.
Key findings • Critical pickle deserialization vulnerability in Nltk's TransitionParser.parse() method (CVE-2026-78683). • High-severity SSRF vulnerability in Nltk's pathsec.urlopen when usin…
Key findings • Five Gitpython vulnerabilities disclosed simultaneously on August 25, 2026, affecting versions prior to 3.1.59. • Critical vulnerability (CVE-2026-78676) allows arbitrary Git d…
Key findings • Six vulnerabilities in Grav CMS fixed in version 2.0.16, disclosed on August 25, 2026. • High severity flaws allow access to sensitive system secrets and user credentials via T…
Key findings • Eight vulnerabilities in Grav CMS and its plugins were disclosed on August 25, 2026, with fixes available in updated versions. • Flaws include path traversal, unauthorized file…
A security researcher has disclosed five vulnerabilities in Palo Alto GlobalProtect, including privilege escalation and Active Directory password recovery flaws, while also criticizing the vendor's disclosure process.
Slovakian authorities have halted the rollout of new traffic cameras after discovering Russian-made backdoors and critical software vulnerabilities.
Rectangle Health CISO Chris Frenz champions 'subtractive-hardening' to proactively remove attacker options and reduce risk in healthcare environments.
A sophisticated new Windows backdoor, dubbed 'Sleepwalker,' has been identified that remains dormant in system memory until triggered by a specific network packet, employing a unique 23-instruction command language for its operations.
A new browser-based tool called Glassbox allows users to assess their own online identifiability by analyzing browser characteristics and estimating uniqueness.
CISA has added CVE-2026-21962, an Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in Improper Access Control Vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog, citing active exploitation.
Key findings • Four high-severity vulnerabilities disclosed on August 24, 2026, affect TP-Link routers and mesh systems. • Three command injection flaws (CVE-2026-78541, CVE-2026-9254, CVE-20…
Key findings • Combodo iTop: Three vulnerabilities, including critical RCE and XSS, disclosed on August 24, 2026. • CVE-2026-39975 allows unauthenticated users to delete a critical file, lead…
Nonprofit health system AnMed has confirmed a July ransomware attack that disrupted services and led to the theft of sensitive patient data, warning individuals about potential criminal scams.
Germany's Federal Office for Information Security (BSI) has issued a warning regarding the increasing threat of fingerprint spoofing, driven by advancements in AI, high-resolution imaging, and 3D printing.
CISOs and security executives are grappling with a paradigm shift where AI agents, rather than stolen credentials or open ports, are becoming the primary vector for cyberattacks.
The U.S. Treasury Department has sanctioned four Iranian individuals for their alleged involvement in cybertheft and hacking of critical infrastructure, linking them to a broader "economic D-Day" strategy against Iran.
Key findings • 19 malicious npm packages were disclosed within a single minute on August 24, 2026. • Four of the disclosed packages shared the @medisend npm scope, indicating a targeted campa…
Key findings • 25 vulnerabilities disclosed on August 24, 2026, for DrayTek VigorSwitch devices. • Multiple command injection flaws, including pre-authentication critical vulnerabilities like…