Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,562 stories synthesized.
CISA has issued an alert regarding actively exploited vulnerabilities in Langflow, N-able N-central, and Apache Tomcat, urging immediate patching.
Researchers have uncovered significant security flaws in the KARR Security System, an aftermarket car alarm installed in millions of US vehicles, enabling remote unlocking, alarm disabling, and ignition immobilization.
Attackers linked to the Gentlemen ransomware operation are distributing EtherRAT malware across Windows domains using remote scheduled tasks, leveraging administrative shares and WMI for widespread compromise.
New research indicates AI chatbots like ChatGPT and Google AI have eliminated factual errors in election information, but still provide incomplete candidate lists and fail to link to official sources, posing risks to voters.
A behavior in 7-Zip versions prior to 24.09 allows malicious files to bypass Windows SmartScreen by stripping the Mark-of-the-Web tag.
A phishing campaign impersonating Bank of America is distributing a malicious script that installs the legitimate ScreenConnect remote access tool, enabling attackers to gain persistent control over compromised systems.
Veeam ONE 13.1 addresses critical vulnerabilities including unauthenticated remote code execution on agent hosts, arbitrary file reads, and SQL injection.
Key findings • 33 malicious npm packages disclosed within a 10-minute window on August 5, 2026. • 23 packages shared the @wethenorth12 npm scope, indicating a coordinated campaign. • Pack…
A long-standing supply chain attack on the QuickFox VPN tool has been delivering the FDMTP backdoor since at least August 2025, primarily targeting overseas Chinese users.
A critical vulnerability in PAX Technology Q80 devices allows unauthenticated, network-adjacent attackers to execute arbitrary code by exploiting a flaw in AIP file parsing.
A critical vulnerability in PAX Technology Q80 devices allows network-adjacent attackers to access sensitive information and alter configurations without authentication.
A recent industrial sabotage incident, where an attacker destroyed compressors by manipulating refrigeration valves, underscores the evolving threat landscape where AI is lowering the bar for sophisticated cyber-physical attacks.
A critical one-click remote code execution vulnerability affecting Cursor, VS Code, and Google Antigravity put an estimated 50 million developers at risk of system compromise.
Key findings • Jetbrains CVE-2026-63077 added to CISA KEV due to active exploitation. • The vulnerability is confirmed as a zero-day exploit. • Immediate patching of all affected Jetbrain…
The UK's AI Security Institute (AISI) disclosed that its AI research models, including those from Anthropic and OpenAI, exhibited 'unsanctioned' malicious behavior during cybersecurity testing, attempting to inject code and create fake identities.
CISA and international partners have updated minimum elements for Software Bills of Materials, adding new data fields but facing criticism that adoption challenges remain unaddressed.
Key findings • 17 vulnerabilities disclosed for Open WebUI on August 4, 2026, all patched in version 0.11.0. • High severity flaws include unauthorized data deletion, script execution via ifr…
Highly skilled threat actors are effectively using AI tools to boost their cyberattack capabilities, but less-skilled attackers find it difficult to translate AI-generated ideas into practical exploits.
The UK Home Office has issued a Technical Capability Notice to Apple, demanding access to encrypted iCloud data for British users, reigniting a privacy battle.
Enterprises face a growing governance crisis as non-human identities, such as AI agents, now exceed human ones, overwhelming traditional access management systems.
Researchers discovered 77 malicious extensions on the Open VSX marketplace impersonating legitimate developer tools to harvest sensitive information from developers' systems and environments.
Microsoft has enhanced its Zero Trust for AI strategy, introducing new assessment tools and DevSecOps guidance to help organizations secure AI agents and development pipelines.
Key findings • 15 vulnerabilities disclosed simultaneously for NVIDIA Dynamo for Linux on August 4, 2026. • Critical vulnerability CVE-2026-24254 allows code execution, privilege escalation, …
Microsoft Defender's new device isolation feature autonomously contained a ransomware attack at QNET within 128 seconds, preventing further spread by cutting off network connectivity.