Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,564 stories synthesized.
Chinese military researchers are leveraging AI distillation to create smaller, more capable AI models for drones and battlefield systems, potentially bypassing Western safeguards.
A new campaign is weaponizing developer interest in AI tools, using compromised GitHub repositories to deliver malware and gain initial access to enterprise networks.
A new Windows backdoor named BINDCLOAK is being used by an espionage group to steal user and process tokens, enabling it to run malware with elevated privileges against targets in the Middle East.
Four vulnerabilities in Apache NiFi versions 1.5.0 through 2.10.0 could allow attackers to bypass authorization, alter configurations, and cause denial-of-service conditions.
Madera Community Hospital is notifying over 150,000 individuals about a data breach that compromised sensitive personal, financial, and medical information.
A critical privilege-escalation flaw, CVE-2026-58048, in cPanel & WHM allows authenticated users to execute arbitrary SQL commands as root, potentially leading to full server compromise.
Microsoft is reducing the validity of new NuGet.org API keys from one year to 30 days, effective August 17, 2026, to mitigate risks from exposed credentials.
North Korean threat actors are employing a novel technique called NullReceiver, embedding malware command-and-control server IP addresses within seemingly valueless Ethereum transactions.
A social engineering scam is tricking WhatsApp users into authorizing malicious device linking, granting attackers access to their accounts and conversations.
Attackers are increasingly bypassing corporate defenses by targeting executives through their personal digital lives, exploiting unsecured accounts and devices to gain access to sensitive company information.
The OWASP Subtractive Security Top 10 project, led by Christopher Frenz, introduces a new paradigm focused on eliminating exploitable capabilities and measuring 'Path Erasure Rate' to enhance security.
Stellar Cyber's new Agentic Auto Triage tool significantly reduces analyst workload by automatically resolving 64% of security alerts, saving an average of 19 minutes per hour per analyst.
Cloudflare is leveraging Anthropic's Claude Sonnet AI for bug bounty processing and has developed over 200 internal AI agents, leading to a significant reduction in reliance on third-party security solutions.
Fraudulent physical letters are being sent to cryptocurrency holders, directing them to a fake IRS compliance portal to trick them into revealing sensitive information.
Key findings • Microsoft Edge Chromium: 14 CVEs disclosed on August 4, 2026, covering diverse vulnerabilities. • High severity flaws include origin validation errors, type confusion, use-afte…
Key findings • CVE-2026-34486, an Apache vulnerability, is now on CISA's KEV list due to active exploitation. • Its inclusion mandates urgent remediation for federal agencies and strongly adv…
Google's threat intelligence division forecasts a significant increase in open-source supply chain compromises, citing ease of scale and replication as key drivers for threat actors.
Key findings • Four vulnerabilities in Zephyr OS disclosed between July 31 and August 3, 2026, impacting device management and Bluetooth. • High severity flaws include a heap buffer overflow …
The Operational Technology Cybersecurity Coalition (OTCC) is calling on CISA to issue a binding directive mandating federal agencies improve their operational technology security after Iran-linked attacks targeted water utilities in Minnesota and at least six other states.
Malicious actors are capitalizing on user searches for adult content on TikTok by directing them to fake websites designed to generate ad revenue and harvest personal information.
N-able has disclosed CVE-2026-18577, a critical authentication bypass flaw in its RMM servers, allowing attackers administrator-level access.
The European Union's AI Act is now in effect, mandating transparency for AI chatbots and labeling of AI-generated content, while also prohibiting certain high-risk AI applications.
California residents can now use the state-run DROP platform to easily submit deletion and opt-out requests to registered data brokers, streamlining privacy control.
Researchers discovered a supply-chain flaw in Google's Python Agent Development Kit, allowing a low-privilege AI agent to manipulate a higher-privilege one into executing malicious code.