Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,178 stories synthesized.
Researchers found that Samsung and Vizio smart TVs transmit Automatic Content Recognition (ACR) traffic even after users disable the feature, raising privacy concerns.
An Interpol-coordinated cybercrime operation across 21 African nations and the U.S. resulted in 1,462 arrests, the takedown of over 10,000 malicious networks, and the recovery of $105 million.
OpenAI has outlined a five-stage process for managing critical software vulnerabilities, aiming to enhance security by integrating AI into the discovery and remediation lifecycle.
A cybercrime group known as CyberCartel has employed an AI-driven framework, CARLIY0S, integrating models from Anthropic's Claude and xAI's Grok, to automate and scale sophisticated attacks against over 400 banks and financial institutions in Latin America.
Delinea's new Fastpath MCP Server allows finance, IT, audit, and compliance teams to query access governance data using natural language AI assistants.
A wave of critical vulnerabilities in PHP and Node.js, a sophisticated supply chain attack on LiteLLM, and ongoing exploitation of other systems created a cybersecurity crisis on October 21, 2026.
Key findings • 25 CVEs disclosed across Apache Traffic Server, mod_qos, DataSketches, and Pulsar between Oct 21-22, 2026. • Multiple Critical (CVSS 10.0) vulnerabilities in Apache Traffic Ser…
Multiple flaws in the QPACK compression format used by HTTP/3 can allow remote attackers to crash servers through memory amplification attacks, consuming thousands of times more memory than the initial request.
Key findings • 11 malicious npm packages disclosed on October 22, 2026 • All advisories published within a 21-minute window • Eight packages share the common '-testmetest' suffix • Se…
The notorious BlackLotus UEFI bootkit has resurfaced under the name BlackX, wielded by the APT41 threat group in sophisticated attacks against diplomatic organizations in Central Asia.
A new survey reveals that 70% of organizations have granted AI agents decision-making and action-taking authority, leading to widespread security issues.
A novel attack allows malicious actors to subtly manipulate speech-to-text AI models during fine-tuning, causing them to transcribe specific individuals' speech into predetermined fraudulent commands.
A critical heap-based buffer overflow in NoMachine's NXWebRunner component, rated CVSS 9.8, allows unauthenticated remote attackers to execute arbitrary code.
Cisco has released security updates addressing 34 vulnerabilities across its Expressway Series, IOS XR, Snort 3, and Unified Communications products, with several critical flaws posing significant risks.
A critical remote code execution vulnerability in NVIDIA Megatron Bridge, identified as CVE-2026-24250, allows attackers to execute arbitrary code by exploiting a flaw in YAML file parsing.
A use-after-free vulnerability in OpenSSL's CMP component allows unauthenticated remote attackers to disclose sensitive information.
A vulnerability in OpenSSL, CVE-2026-34182, permits network-adjacent attackers to tamper with CMS AuthEnvelopedData messages by improperly validating integrity check values.
A new report from LocalStack reveals that the surge in AI-generated code is creating significant bottlenecks in cloud development, leading to increased bugs, testing delays, and disruptions in shared environments.
Key findings • 25 malicious packages disclosed on PyPI within a single minute on October 22, 2026. • All packages were assigned a 'Critical' severity rating, indicating severe system compromi…
Key findings • 20 vulnerabilities disclosed for Roundcube Webmail, affecting versions prior to 1.6.20 and 1.7.5. • High-severity flaws include IMAP command injection, SSRF bypass, and mail he…
Cloud platform Railway disclosed a security incident where unauthorized access to customer environment variables, potentially including API keys and database passwords, may have occurred.
Key findings • High-severity blind SQL injection in Frappe Framework (CVE-2026-114664) patched in v16.33.0. • Three medium-severity authorization bypass flaws in Frappe Helpdesk and CRM discl…
Key findings • High-severity flaw in Grav Login plugin allows privilege escalation to super user. • Core Grav CMS vulnerable to arbitrary method execution via crafted page frontmatter. • …
GoDaddy is revoking more than 404,000 TLS certificates after discovering they were issued in violation of the company's own policies, compounded by a failure to meet the mandatory revocation deadline.