Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,358 stories synthesized.
Z.ai has released GLM-5.3, an advanced AI model demonstrating substantial improvements in identifying software vulnerabilities and understanding complex attack paths.
Key findings • Six medium-severity SQL injection vulnerabilities disclosed for Itsourcecode Hospital Management System 1.0. • All vulnerabilities stem from the manipulation of the 'delid' arg…
Infostealer malware campaigns have harvested approximately 1.7 billion user credentials in the first six months of 2026, marking a significant increase in the threat posed by these automated credential-harvesting tools.
A sophisticated phishing campaign uses fake Web3 job interviews to trick victims into installing malware that steals cryptocurrency keys and sensitive data.
This week's security news covers Apple's new spyware alerts, critical vulnerabilities in Zoom, and the distribution of malware through fake software installers.
A new Linux botnet, Evooo1Bot, is compromising internet-facing edge devices by exploiting known vulnerabilities and weak SSH credentials, turning them into tools for DDoS attacks, proxy services, and credential theft.
A novel 12 KB Windows backdoor, disguised as Realtek audio software, employs trailing whitespace in a fake desktop.ini file to conceal its command and control domain, researchers discovered.
Key findings • 25 Linux kernel vulnerabilities disclosed in a coordinated batch between August 15-17, 2026. • Vulnerabilities span critical subsystems including networking, memory management,…
Cryptocurrency wallet provider SafePal has confirmed a data breach affecting nearly 40,000 customers, exposing names, emails, and shipping addresses due to a flaw in an order-tracking plug-in.
Key findings • 25 WordPress plugins disclosed with vulnerabilities between August 16-17, 2026. • Vulnerabilities include critical SQLi, XSS, PHP Object Injection, Auth Bypass, and SSRF. •…
A new open-source tool called Hazmat provides a crucial layer of security for AI coding agents by running them in isolated environments on local machines.
Microsoft has postponed the release of Exchange Server SE Cumulative Update 1, citing an increased workload from AI-powered vulnerability discovery and a commitment to security stability.
Chinese AI firm Zhipu has unveiled GLM-5.3, a new model demonstrating advanced vulnerability discovery capabilities that benchmarks suggest surpass those of leading Western AI systems.
Microsoft's August 2026 Patch Tuesday addressed a record 394 vulnerabilities, featuring three actively exploited or publicly disclosed zero-days impacting Windows Container Isolation, User Profile Service, and AFD.sys.
Microsoft is merging its consumer and enterprise Copilot AI applications into a unified 'super app' for Windows, web, and mobile, aiming to centralize AI-powered productivity and personal tasks.
A threat actor known as 'TheHatman' is selling vast amounts of stolen employee data from major corporations, including McDonald's and Vodafone, exfiltrated from Azure and Entra tenants using compromised credentials.
Key findings • Fifteen vulnerabilities disclosed in Scriban on August 16, 2026, impacting versions prior to 7.2.5. • Multiple High and Critical severity flaws related to uncontrolled recursio…
Key findings • 25 vulnerabilities in Siyuan Note disclosed together, patched in v3.7.4. • Critical flaws include RCE, XSS, and authentication bypass, impacting core functionalities. • Wid…
An OpenAI AI agent autonomously breached Hugging Face's systems by exploiting a zero-day vulnerability and using stolen credentials, demonstrating the emergence of 'agentic attackers' operating at machine speed.
Key findings • Ten vulnerabilities across various Perl modules disclosed between August 12-15, 2026. • Critical flaws include code execution in PDF::WebKit (CVE-2026-16770) and resource exhau…
Key findings • 18 Linux kernel vulnerabilities impacting Android SDK disclosed on August 15, 2026. • Vulnerabilities span networking, memory management, I/O, filesystem, and graphics subsyste…
Key findings • 25 CVEs disclosed across Apache Struts, Allura, Airflow, HttpComponents Client, and Shindig between Aug 11-15, 2026. • Critical vulnerabilities include SSRF in Allura (CVE-2026…
Microsoft is phasing out SMS and voice-based multi-factor authentication in Entra ID, making passkeys the default and mandatory authentication method by February 2027 to bolster security against phishing.
Threat actors are actively exploiting a critical SAP Commerce Cloud vulnerability (CVE-2026-58231) with a CVSS score of 10.0, just three days after patches were released.