Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,256 stories synthesized.
Researchers found critical vulnerabilities in AI coding agents from Anthropic, Google, and OpenAI, enabling remote code execution and supply chain compromises.
Researchers have uncovered a novel attack chain that allows adversaries to compromise enterprise endpoints by exploiting Windows Server Update Services (WSUS) to deliver malicious software.
A new review highlights Tufin as the top firewall management tool for 2026, emphasizing its change automation and compliance features, as the market sees consolidation with Skybox Security's acquisition.
A U.S. congressional report suggests China-controlled telecommunications infrastructure could be exploited by threat actors like Salt Typhoon for future cyber operations.
Cybercriminals are distributing Lumma Stealer via pirated downloads of the movie 'The Odyssey (2026)', aiming to steal saved passwords, payment card details, and cryptocurrency assets.
A sophisticated ad fraud scheme named Papyrus is leveraging seemingly innocuous novel-reading apps to generate fake ad traffic by simulating user interactions in hidden browser windows.
Cloudflare is advocating for a new internet paradigm, the 'Agentic Internet,' designed to accommodate the rise of AI agents as distinct web visitors requiring new standards for identification, interaction, and payment.
Cloudflare introduces Agent Readiness and Answer Engine Optimization (AEO) tools to help websites adapt to the increasing dominance of AI agents in user discovery and interaction.
Cloudflare has launched Kitesurf, a novel browser designed specifically for AI agents, running efficiently on Cloudflare Workers using V8 isolates and WebAssembly.
Cloudflare launches a developer preview of WebMCP, a new browser standard enabling AI agents to interact with websites by exposing tools without origin code changes.
Cloudflare has released a new specification for its Model Context Protocol (MCP), transitioning it to a stateless design to simplify deployment and reduce operational overhead for AI agents.
Researchers have uncovered zero-click vulnerabilities in Anthropic's Claude and OpenAI's ChatGPT Atlas, enabling attackers to hijack AI browser sessions via emails and social media posts without user interaction.
A 1Password study reveals that only one in four AI-generated vulnerability patches successfully fix the intended bug, with many introducing new issues or failing to address the root cause.
A public proof-of-concept exploit is now available for a use-after-free vulnerability in the Linux kernel's bridge subsystem, potentially leading to memory corruption and control-flow hijacking.
A new information-stealing malware, Remus, is employing an Ethereum smart contract to dynamically retrieve its command and control server address, making it harder to block.
A severe lapse in basic security hygiene saw an IT department place sticky notes with usernames and initial login credentials on new hire laptops, leading to a contractor accessing proprietary data.
Chainalysis reports a dramatic surge in physical cryptocurrency thefts, with 'wrench attacks' like home invasions and kidnappings costing victims $30 million in the first half of 2026.
A decade-old flaw in the CryptoJS library's random number generator has been exploited to steal over $5.7 million from five cryptocurrency wallet applications.
Cybercriminals are using AI-generated deepfakes and voice cloning to impersonate OnlyFans creators, defrauding fans through fake promises of exclusive content.
OWASP has unveiled its Top 10 for LLM Applications 2026, a crucial guide for developers and security professionals to address the most critical vulnerabilities in generative AI systems.
Scammers are using identical full-screen pop-up messages to impersonate both Amazon and Apple support, tricking users into calling a shared scam number over a fake $149.99 unauthorized purchase.
A critical vulnerability in Cisco's Integrated Management Controller (IMC) has been patched, but a public proof-of-concept exploit increases the immediate risk of exploitation.
Multiple water and wastewater utilities across at least seven U.S. states have been targeted by cyberattacks exploiting unpatched, internet-exposed industrial control systems, leading to operational disruptions and a local state of emergency.
Threat actors exploited a SQL injection vulnerability to deploy a Java-based post-exploitation toolkit directly within an Oracle database, enabling SYSTEM-level command execution on the underlying Windows server without writing executables to disk.