Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,334 stories synthesized.
Cloudflare is open-sourcing Cloudflare OS, a platform enabling organizations to deploy AI agents and workspaces tailored to their specific context, terminology, and systems.
Cloudflare launches WriteGuard, a new control layer for its internal MCP servers, providing fine-grained oversight and attribution for AI agent actions to prevent data misuse.
Cloudflare has developed an internal platform called Cloudflare OS to enable employees to safely leverage AI agents and tools, addressing the growing demand for AI-powered applications within the company.
Tenable introduces Hexa AI, an agentic engine for its Tenable One platform, designed to automate the entire vulnerability remediation lifecycle from discovery to verification.
Jenkins has issued a security advisory detailing critical vulnerabilities in its core and numerous plugins, including deserialization bypass, path traversal, and privilege escalation flaws.
A critical vulnerability in the Linux kernel's Open vSwitch component, CVE-2026-64531 (OVSwrap), allows unprivileged local users to escalate privileges to root.
Brown Health Medical Group-MA has reported a data breach affecting over 311,000 individuals, with sensitive personal, medical, and financial data compromised.
Palo Alto Networks' Unit 42 developed NOVA, an AI system that analyzed 3,915 open-source projects and identified 14,090 previously undocumented vulnerabilities, far exceeding existing public records.
A cyberattack on Beacon CRM has compromised sensitive data belonging to over 1,500 UK charities, including donor and service user information.
OWASP's latest Top 10 LLM Applications list reaffirms prompt injection as the most significant security risk, even as actual incidents remain scarce, indicating proactive defense efforts.
Trail of Bits researchers have identified passive and active attack vectors targeting the communication channel between AWS Nitro Enclaves and AWS Key Management Service (KMS), alongside vulnerabilities in the AWS Nitro Enclaves SDK for C.
Researchers discovered 321 n8n instances with exposed API tokens in public GitHub commits, allowing attackers to access sensitive data and downstream credentials without exploiting software flaws.
CISA has issued an alert regarding actively exploited vulnerabilities in Langflow, N-able N-central, and Apache Tomcat, urging immediate patching.
Researchers have uncovered significant security flaws in the KARR Security System, an aftermarket car alarm installed in millions of US vehicles, enabling remote unlocking, alarm disabling, and ignition immobilization.
Attackers linked to the Gentlemen ransomware operation are distributing EtherRAT malware across Windows domains using remote scheduled tasks, leveraging administrative shares and WMI for widespread compromise.
New research indicates AI chatbots like ChatGPT and Google AI have eliminated factual errors in election information, but still provide incomplete candidate lists and fail to link to official sources, posing risks to voters.
A behavior in 7-Zip versions prior to 24.09 allows malicious files to bypass Windows SmartScreen by stripping the Mark-of-the-Web tag.
A phishing campaign impersonating Bank of America is distributing a malicious script that installs the legitimate ScreenConnect remote access tool, enabling attackers to gain persistent control over compromised systems.
Veeam ONE 13.1 addresses critical vulnerabilities including unauthenticated remote code execution on agent hosts, arbitrary file reads, and SQL injection.
Key findings • 33 malicious npm packages disclosed within a 10-minute window on August 5, 2026. • 23 packages shared the @wethenorth12 npm scope, indicating a coordinated campaign. • Pack…
A long-standing supply chain attack on the QuickFox VPN tool has been delivering the FDMTP backdoor since at least August 2025, primarily targeting overseas Chinese users.
A critical vulnerability in PAX Technology Q80 devices allows unauthenticated, network-adjacent attackers to execute arbitrary code by exploiting a flaw in AIP file parsing.
A critical vulnerability in PAX Technology Q80 devices allows network-adjacent attackers to access sensitive information and alter configurations without authentication.
A recent industrial sabotage incident, where an attacker destroyed compressors by manipulating refrigeration valves, underscores the evolving threat landscape where AI is lowering the bar for sophisticated cyber-physical attacks.