Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,454 stories synthesized.
Researchers have developed an AI system, HTTP Terminator, capable of autonomously discovering and exploiting new HTTP desync attack techniques against live websites.
Key findings • 24 vulnerabilities disclosed simultaneously for Langflow OSS, affecting versions 1.0.0 through 1.10.3. • Multiple High-severity flaws enable arbitrary code execution, authentic…
Key findings • 23 vulnerabilities disclosed simultaneously for IBM Langflow OSS, affecting versions 1.0.0 through 1.10.3. • Multiple High-severity flaws enable arbitrary code execution, authe…
Key findings • 16 vulnerabilities disclosed for Electron framework on August 5, 2026, ranging from Medium to High severity. • Issues include bypasses of sandbox restrictions for external URLs…
Researchers have uncovered 15 critical vulnerabilities in TP-Link devices that undermine secure zero-trust network provisioning, potentially allowing attackers to compromise devices during setup.
Pre-authentication remote code execution vulnerabilities, including CVE-2026-31986, have been discovered in widely used enterprise Java applications Bonita BPM and Apache OFBiz, posing a significant risk to organizations.
A sophisticated supply-chain attack on the keyv and cacheable npm packages uses a worm-like mechanism and a novel dead-man's switch that punishes token revocation.
Google Blogger's automated systems mistakenly flagged thousands of legitimate websites as malicious, locking them and causing widespread user frustration.
Cybercriminals exploited Microsoft logins, Zoom events, and government websites in July 2026 to conduct sophisticated phishing and malware campaigns.
Microsoft's Defender for Cloud has been named a leader in KuppingerCole's Leadership Compass for Cloud Native Application Protection Platforms (CNAPP), highlighting its unified approach to cloud and AI security.
Key findings • Three High severity vulnerabilities disclosed together for Keycloak on August 5, 2026. • CVE-2026-16442: SAML broker flaw allows potential bypass of account linking restriction…
A sophisticated macOS ClickFix campaign is now using server-side browser fingerprinting to hide its malicious lures, serving them only to visitors who appear to be genuine macOS users.
A gray market service named Poison Claude is selling heavily discounted access to Anthropic's AI models by exploiting fraudulently created cloud accounts and free credits from providers like AWS and Google Cloud.
Dutch luxury retailer De Bijenkorf has reported a cyber incident affecting its logistics provider, potentially exposing customer data and causing delays in orders and refunds.
Uppsala Security, a leader in blockchain intelligence, has become the first firm of its kind to join the Cyber Threat Alliance, aiming to integrate on-chain threat data with traditional cyber intelligence.
Three critical vulnerabilities in the Paperclip AI agent orchestration platform enable unauthenticated attackers to execute arbitrary commands and expose sensitive data.
Malicious npm packages 'bianira-ui' and 'fluid-type-ui' have been found using a novel technique to hide command-and-control server IP addresses within fabricated Ethereum transaction recipient addresses.
New Phishing-as-a-Service kits are targeting US organizations, stealing Microsoft 365 credentials and session tokens by tricking users into completing legitimate MFA challenges.
The UK's data protection watchdog has reprimanded London's Metropolitan Police Service for two significant data handling failures in 2024, including one where a stalking victim's new contact details were given to her abuser.
Django has released urgent security updates for versions 6.0.8 and 5.2.17, addressing four vulnerabilities, one of which could lead to remote code execution.
ArmorCode enhances its Agentic Control Plane with four new Anya AI agents and a Context Risk Graph to improve cloud risk analysis, vulnerability management, and attack path prioritization.
Cloudflare introduces the Agent Access Model (AAM) to address the unique security challenges posed by software agents in Zero Trust architectures, advocating for real-time least privilege enforcement.
Research reveals the prolific threat actor TeamPCP, known for recent attacks on open-source software, has a history dating back to at least 2020 and employs AI for rapid payload adaptation.
Autonomous AI agents are creating unprecedented identity governance challenges, operating beyond traditional boundaries and requiring new methods for discovery, oversight, and cost management.