Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,521 stories synthesized.
Pre-authentication remote code execution vulnerabilities, including CVE-2026-31986, have been discovered in widely used enterprise Java applications Bonita BPM and Apache OFBiz, posing a significant risk to organizations.
A sophisticated supply-chain attack on the keyv and cacheable npm packages uses a worm-like mechanism and a novel dead-man's switch that punishes token revocation.
Google Blogger's automated systems mistakenly flagged thousands of legitimate websites as malicious, locking them and causing widespread user frustration.
Cybercriminals exploited Microsoft logins, Zoom events, and government websites in July 2026 to conduct sophisticated phishing and malware campaigns.
Microsoft's Defender for Cloud has been named a leader in KuppingerCole's Leadership Compass for Cloud Native Application Protection Platforms (CNAPP), highlighting its unified approach to cloud and AI security.
Key findings • Three High severity vulnerabilities disclosed together for Keycloak on August 5, 2026. • CVE-2026-16442: SAML broker flaw allows potential bypass of account linking restriction…
A sophisticated macOS ClickFix campaign is now using server-side browser fingerprinting to hide its malicious lures, serving them only to visitors who appear to be genuine macOS users.
A gray market service named Poison Claude is selling heavily discounted access to Anthropic's AI models by exploiting fraudulently created cloud accounts and free credits from providers like AWS and Google Cloud.
Dutch luxury retailer De Bijenkorf has reported a cyber incident affecting its logistics provider, potentially exposing customer data and causing delays in orders and refunds.
Uppsala Security, a leader in blockchain intelligence, has become the first firm of its kind to join the Cyber Threat Alliance, aiming to integrate on-chain threat data with traditional cyber intelligence.
Three critical vulnerabilities in the Paperclip AI agent orchestration platform enable unauthenticated attackers to execute arbitrary commands and expose sensitive data.
Malicious npm packages 'bianira-ui' and 'fluid-type-ui' have been found using a novel technique to hide command-and-control server IP addresses within fabricated Ethereum transaction recipient addresses.
New Phishing-as-a-Service kits are targeting US organizations, stealing Microsoft 365 credentials and session tokens by tricking users into completing legitimate MFA challenges.
The UK's data protection watchdog has reprimanded London's Metropolitan Police Service for two significant data handling failures in 2024, including one where a stalking victim's new contact details were given to her abuser.
Django has released urgent security updates for versions 6.0.8 and 5.2.17, addressing four vulnerabilities, one of which could lead to remote code execution.
ArmorCode enhances its Agentic Control Plane with four new Anya AI agents and a Context Risk Graph to improve cloud risk analysis, vulnerability management, and attack path prioritization.
Cloudflare introduces the Agent Access Model (AAM) to address the unique security challenges posed by software agents in Zero Trust architectures, advocating for real-time least privilege enforcement.
Research reveals the prolific threat actor TeamPCP, known for recent attacks on open-source software, has a history dating back to at least 2020 and employs AI for rapid payload adaptation.
Autonomous AI agents are creating unprecedented identity governance challenges, operating beyond traditional boundaries and requiring new methods for discovery, oversight, and cost management.
Cloudflare is open-sourcing Cloudflare OS, a platform enabling organizations to deploy AI agents and workspaces tailored to their specific context, terminology, and systems.
Cloudflare launches WriteGuard, a new control layer for its internal MCP servers, providing fine-grained oversight and attribution for AI agent actions to prevent data misuse.
Cloudflare has developed an internal platform called Cloudflare OS to enable employees to safely leverage AI agents and tools, addressing the growing demand for AI-powered applications within the company.
Tenable introduces Hexa AI, an agentic engine for its Tenable One platform, designed to automate the entire vulnerability remediation lifecycle from discovery to verification.
Jenkins has issued a security advisory detailing critical vulnerabilities in its core and numerous plugins, including deserialization bypass, path traversal, and privilege escalation flaws.