Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,611 stories synthesized.
Wiz researchers uncovered a critical cloud-stunt vulnerability in the AWS Console that, combined with a supply-chain issue in AWS CodeBuild, could have allowed attackers to gain control of any AWS customer's environment.
GitLab released versions 18.8.2, 18.7.2, and 18.6.4 on January 21, 2026, patching multiple vulnerabilities including an unauthenticated denial-of-service in Jira Connect and a 2FA bypass flaw.
A multi-stage campaign dubbed Evelyn Stealer is targeting software developers through malicious Visual Studio Code extensions, leveraging a sophisticated infection chain that hijacks browser sessions and exfiltrates cryptocurrency wallets and credentials.
Trend Micro's new ÆSIR platform uses AI automation with human oversight to discover zero-day vulnerabilities in AI infrastructure, uncovering 21 CVEs across NVIDIA, Tencent, and MLflow since mid-2025.
A critical unauthenticated privilege escalation vulnerability (CVE-2026-23800) in the Modular DS WordPress plugin is being actively exploited, allowing attackers to gain admin access on over 40,000 sites.
Trail of Bits researchers have identified architectural isolation flaws in multiple agentic browsers that enable attacks functionally identical to XSS and CSRF, resurrecting vulnerabilities the web security community spent years patching.
Trend Micro's analysis of the 2025 MITRE ATT&CK Evaluation reveals modern attack chains from SHADOW-AETHER-015 and Earth Preta, validated through TrendAI Vision One.
Trend Micro researchers detail a multi-stage AsyncRAT campaign exploiting Cloudflare's free-tier infrastructure and legitimate Python environments to evade detection.
A pre-authentication remote code execution vulnerability rated CVSS 10.0 has been disclosed in SmarterTools SmarterMail, silently patched in October 2025 but only publicly revealed in late December 2025.
GitLab released versions 18.7.1, 18.6.3, and 18.5.5 on January 7, 2026, fixing multiple vulnerabilities including two high-severity cross-site scripting flaws in Markdown placeholders and the Web IDE.
Trail of Bits has released go-panikint, a modified Go compiler that turns silent integer overflows into explicit panics, exposing a hidden class of vulnerabilities during fuzzing.
ESET researchers have analyzed CVE-2025-50165, a critical Windows Imaging Component RCE flaw, concluding that exploitation is more difficult than Microsoft's initial assessment suggested.
ESET researchers have discovered a previously undocumented China-aligned APT group, dubbed LongNosedGoblin, that has been conducting cyberespionage against governmental entities in Southeast Asia and Japan since at least September 2023, using Group Policy for lateral movement and cloud services for command and control.
The DFIR Report has published a detailed breakdown of a Lynx ransomware intrusion that began with a single RDP logon using compromised credentials, revealing the full attack chain and C2 infrastructure.
A critical arbitrary file upload vulnerability in the Motors WordPress theme, tracked as CVE-2025-64374, allows any authenticated user to install and activate arbitrary plugins, leading to full site takeover.
The final Risky Business show of 2025 covers Venezuela's state oil firm PDVSA blaming the US for a ransomware/wiper attack, ongoing React2Shell exploitation, and Microsoft finally disabling RC4 in Active Directory Kerberos.
ESET's H2 2025 Threat Report reveals the first known AI-driven ransomware, PromptLock, and a 40% projected rise in ransomware victims, while Lumma Stealer detections plummet 86% after global disruption.
Trend Micro researchers have identified a new threat actor, SHADOW-VOID-042, using spear-phishing campaigns with social engineering lures that closely resemble the tactics of the Russian-aligned Void Rabisu group.
A privilege escalation vulnerability (CVE-2025-64188) in the Soledad WordPress theme allows any logged-in user to take over a site by modifying global settings.
WatchTowr Labs disclosed SOAPwn at Black Hat Europe, revealing new .NET Framework primitives that allow remote code execution via HTTP client proxies and WSDL manipulation, already weaponized against Barracuda and Ivanti appliances.
PortSwigger Research reveals new authentication bypass techniques in Ruby and PHP SAML implementations, exploiting parser inconsistencies to bypass XML signature validation.
Jenkins released a security advisory on December 10, 2025, fixing a dozen flaws including a denial-of-service vulnerability in its HTTP-based CLI, an OS command injection in the Git client Plugin, and stored XSS in the Coverage Plugin.
A critical remote code execution vulnerability in the React JavaScript server, dubbed React2Shell (CVE-2025-55182), is being actively exploited by Chinese APT groups within hours of disclosure.
The DFIR Report dissects an intrusion where attackers exploited CVE-2025-55182 to deploy EtherRAT, evolved to the TukTuk framework, and ultimately deployed The Gentlemen ransomware.