Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,611 stories synthesized.
A command injection vulnerability in the revssh service of ChargePoint Home Flex EV chargers, disclosed at Pwn2Own, allows unauthenticated network-adjacent attackers to execute arbitrary code as root via a crafted OCPP message.
A format string vulnerability in QNAP TS-453E NAS devices, disclosed at Pwn2Own, allows network-adjacent attackers to execute arbitrary code as admin.
Trend Micro reveals a sophisticated Warlock attack chain exploiting SharePoint vulnerabilities, using BYOVD and legitimate tools like TightVNC and Velociraptor for persistence and lateral movement.
International law enforcement has taken down SocksEscort, a malicious proxy service that compromised over 360,000 routers and IoT devices worldwide since 2020 to facilitate cybercrime.
Check Point Research has published a detailed analysis of the Handala Hack persona, revealing the evolving tactics of the Iranian MOIS-affiliated threat actor Void Manticore, including the use of NetBird tunneling and AI-assisted PowerShell wipers.
Zimperium researchers have uncovered PixRevolution, an Android banking trojan that uses live screen streaming and accessibility permissions to hijack Brazil's PIX instant payment transfers in seconds.
Two critical vulnerabilities in n8n, including a zero-click unauthenticated RCE bug (CVE-2026-27493), allow attackers to fully compromise servers and decrypt stored credentials.
CISA has issued Emergency Directive 26-03 over active exploitation of CVE-2026-20127, a critical authentication bypass in Cisco Catalyst SD-WAN that gives unauthenticated attackers administrative access to federal networks.
Pro-Iranian hacking group Handala has claimed a devastating wiper attack on medical technology firm Stryker, wiping over 200,000 systems and exfiltrating 50TB of data, forcing offices in 79 countries to shut down.
Iran-linked hacktivist group Handala claims to have wiped data from over 200,000 systems at medical technology firm Stryker, forcing the company to send home 5,000 workers in Ireland and disrupting hospital supply chains.
Tenable Research has disclosed nine cross-tenant vulnerabilities in Google Looker Studio, collectively named LeakyLooker, that could allow attackers to run arbitrary SQL queries and access sensitive cloud data across tenants.
Rapid7 warns that a global campaign has compromised over 250 legitimate WordPress sites since December 2025 to deliver infostealer malware via fake Cloudflare Captcha pages and ClickFix social engineering.
Aryaka Threat Research Lab has uncovered a persistent malware campaign targeting HR and recruiting staff with phishing emails disguised as job applications, deploying the BlackSanta EDR-killer module to disable endpoint defenses.
Apple released iOS 16.7.15 (build 20H380) on March 11, 2026, addressing security vulnerabilities in the iOS 16 operating system.
Apple released iPadOS 16.7.15 (build 20H380) on March 11, 2026, delivering security fixes for iPad models that cannot upgrade to newer iPadOS versions.
Apple has released iOS 15.8.7 (build 19H411) as a security update for older iPhone and iPad models, addressing unspecified vulnerabilities in the operating system.
Apple has released iPadOS 15.8.7 (build 19H411) as a security update for older iPad models, addressing unspecified vulnerabilities.
Palo Alto Networks' Unit 42 has developed AdvJudge-Zero, an automated fuzzer that exploits LLM-based 'AI Judge' guardrails to authorize policy-violating outputs with a 99% success rate across multiple model architectures.
Trail of Bits has identified six common vulnerability patterns in ERC-4337 smart accounts after auditing dozens of implementations, warning that a single bug can be as catastrophic as leaking a private key.
Microsoft's March 2026 Patch Tuesday addresses 79 vulnerabilities, including two publicly disclosed zero-days: an SQL Server elevation of privilege bug and a .NET denial-of-service flaw.
Microsoft's March 2026 Patch Tuesday addresses 77 vulnerabilities, including two publicly disclosed flaws and a critical bug discovered by an autonomous AI agent, signaling a new era in vulnerability research.
GitLab released versions 18.9.2, 18.8.6, and 18.7.6 on March 11, 2026, fixing multiple high-severity vulnerabilities including a cross-site scripting bug and several denial-of-service issues.
Check Point Research reveals that Iranian MOIS-affiliated groups like Void Manticore and MuddyWater are moving beyond imitation to directly engage with the cyber crime ecosystem, using commercial infostealers, ransomware branding, and affiliate models to advance state objectives.
WordPress 6.9.2, a security release fixing 11 vulnerabilities including a blind SSRF, stored XSS, path traversal, and an XXE in the bundled getID3 library, is available now with an urgent recommendation to update.