Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,559 stories synthesized.
Key findings • 14 vulnerabilities disclosed for Open62541, impacting version 1.5.5 and earlier. • Critical (CVSS 9.8) and High (CVSS 7.5) severity flaws dominate the batch. • Vulnerabilit…
A honeypot analysis reveals a sophisticated automated campaign rapidly compromising SSH servers within seconds of initial login, injecting backdoors and establishing persistence.
The threat actor UNC6671, formerly known as BlackFile, has rebranded to REDACT and is actively diversifying its extortion operations under multiple aliases, targeting financial services and enterprise cloud environments with multi-brand vishing tactics.
Global crime syndicates are aggressively leveraging AI for large-scale fraud, generating billions through sophisticated scams like voice cloning and deepfake videos.
Researchers have detailed a new class of HTTP desynchronization attacks, dubbed 'CRLF-Powered Desync Worms,' that leverage header injection flaws to hijack user sessions and bypass security measures.
Key findings • Three high-severity vulnerabilities disclosed in PraisonAI on August 5, 2026. • Two SSRF flaws in the web_crawl tool allow connections to internal destinations. • One code …
An Ontario man has pleaded guilty to charges related to the 2024 attacks on cloud data platform Snowflake, which resulted in approximately 165 data breaches.
Researchers warn that Cascading Style Sheets (CSS) are being weaponized to steal sensitive data from webmail clients, with some vendors unprepared for the emerging threat.
Researchers demonstrated an exploit chain using Samsung Members and Samsung Account apps to gain system-level control of Galaxy devices via the Bixby virtual assistant.
Researchers have developed an AI system, HTTP Terminator, capable of autonomously discovering and exploiting new HTTP desync attack techniques against live websites.
Key findings • 24 vulnerabilities disclosed simultaneously for Langflow OSS, affecting versions 1.0.0 through 1.10.3. • Multiple High-severity flaws enable arbitrary code execution, authentic…
Key findings • 23 vulnerabilities disclosed simultaneously for IBM Langflow OSS, affecting versions 1.0.0 through 1.10.3. • Multiple High-severity flaws enable arbitrary code execution, authe…
Key findings • 16 vulnerabilities disclosed for Electron framework on August 5, 2026, ranging from Medium to High severity. • Issues include bypasses of sandbox restrictions for external URLs…
Researchers have uncovered 15 critical vulnerabilities in TP-Link devices that undermine secure zero-trust network provisioning, potentially allowing attackers to compromise devices during setup.
Pre-authentication remote code execution vulnerabilities, including CVE-2026-31986, have been discovered in widely used enterprise Java applications Bonita BPM and Apache OFBiz, posing a significant risk to organizations.
A sophisticated supply-chain attack on the keyv and cacheable npm packages uses a worm-like mechanism and a novel dead-man's switch that punishes token revocation.
Google Blogger's automated systems mistakenly flagged thousands of legitimate websites as malicious, locking them and causing widespread user frustration.
Cybercriminals exploited Microsoft logins, Zoom events, and government websites in July 2026 to conduct sophisticated phishing and malware campaigns.
Microsoft's Defender for Cloud has been named a leader in KuppingerCole's Leadership Compass for Cloud Native Application Protection Platforms (CNAPP), highlighting its unified approach to cloud and AI security.
Key findings • Three High severity vulnerabilities disclosed together for Keycloak on August 5, 2026. • CVE-2026-16442: SAML broker flaw allows potential bypass of account linking restriction…
A sophisticated macOS ClickFix campaign is now using server-side browser fingerprinting to hide its malicious lures, serving them only to visitors who appear to be genuine macOS users.
A gray market service named Poison Claude is selling heavily discounted access to Anthropic's AI models by exploiting fraudulently created cloud accounts and free credits from providers like AWS and Google Cloud.
Dutch luxury retailer De Bijenkorf has reported a cyber incident affecting its logistics provider, potentially exposing customer data and causing delays in orders and refunds.
Uppsala Security, a leader in blockchain intelligence, has become the first firm of its kind to join the Cyber Threat Alliance, aiming to integrate on-chain threat data with traditional cyber intelligence.