Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,559 stories synthesized.
A new ClickFix campaign is targeting macOS users with a deceptive CAPTCHA page that prompts them to execute malicious commands, leading to backdoor installation, credential theft, and cryptocurrency mining.
Key findings • 25 vulnerabilities disclosed across multiple Joomla extensions between August 20-24, 2026. • Critical flaws include SQL injection in Page Builder CK and Fabrik, and stored XSS …
The DOUBLECUP malware appends a PowerShell payload after PNG files, using a simple text trick to enable easy extraction via the FINDSTR command.
A busy week in cybersecurity saw significant data breaches, critical patches for major software, and a rise in sophisticated scams targeting consumers and businesses.
Key findings • 11 malicious npm packages disclosed simultaneously on August 24, 2026. • 8 packages share the sm- prefix, indicating a coordinated campaign. • All sm- prefixed packages wer…
Cybermes, a new open-source AI red teaming agent, automates the full penetration testing pipeline for web applications and infrastructure, aiming to reduce false positives with a deterministic validation layer.
Proton has launched a free tool, AI Paper Trail, that analyzes exported ChatGPT and Claude conversations to reveal the extent of personal data inferable from user interactions.
A critical vulnerability in libwebsockets' HTTP/2 HPACK header parsing allows unauthenticated attackers to achieve remote code execution with a CVSS score of 9.8.
A stack-based buffer overflow in BlueZ's A2DP implementation, tracked as CVE-2026-19774, permits network-adjacent attackers to achieve remote code execution on vulnerable systems.
A critical vulnerability in NVIDIA Megatron Bridge, ZDI-26-594, allows remote attackers to execute arbitrary code by exploiting a flaw in model configuration loading.
A heap-based buffer overflow in Ashlar-Vellum Cobalt, tracked as CVE-2026-19781, allows remote attackers to execute arbitrary code by tricking users into opening malicious VS files.
A use-after-free vulnerability in the Linux Kernel's KVM IOAPIC component allows local privilege escalation, requiring prior high-privileged code execution for exploitation.
A server-side request forgery vulnerability in the Fabric.js library, CVE-2026-19504, enables remote attackers to disclose sensitive information by exploiting improper URI validation.
A vulnerability in Microsoft Windows, CVE-2026-50508, allows remote attackers to disclose NTLM responses through improper handling of localized filenames, requiring user interaction.
A local privilege escalation vulnerability in Microsoft Windows Compatibility Appraiser, ZDI-26-606, allows attackers with low-privilege code execution to gain SYSTEM privileges.
A critical vulnerability in NVIDIA TensorRT allows remote code execution through improper validation of array indices when parsing ONNX files.
A critical vulnerability in Foxit PDF Reader allows remote attackers to disclose sensitive information through specially crafted PDF files or malicious web pages.
A ZDI-26-607 vulnerability in Microsoft Office permits remote attackers to disclose sensitive information through HTML injection, requiring user interaction.
A critical use-after-free vulnerability in Foxit PDF Reader's AcroForm component allows remote attackers to execute arbitrary code on vulnerable systems.
A new Malware-as-a-Service (MaaS) operation, dubbed 'Kaido Panel,' is targeting Windows users through a deceptive Adobe-themed domain impersonating Adobe Acrobat Reader.
AWS Network Firewall now provides a rule hit count feature to help security teams identify unused or redundant stateful firewall rules, improving configuration management and compliance.
Key findings • CVE-2026-21962, an Oracle vulnerability, is now on CISA's KEV catalog. • The flaw is confirmed to be actively exploited in real-world attacks. • Immediate patching is criti…
Hackers suspected of being linked to Iran successfully took a small UK power plant offline for four days, marking a significant escalation in attacks against critical infrastructure.
This week's cybersecurity news is dominated by the dual-edged sword of AI in cyber warfare, a critical Entra ID vulnerability, and an unusual low-tech defense tactic against state-sponsored hackers.