Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,564 stories synthesized.
Key findings • Guzzle versions before 7.15.1 are affected by cookie scope and redirect referer vulnerabilities. • CVE-2026-67339, affecting versions before 7.14.2, allows capture of proxy cre…
Key findings • Five vulnerabilities in GitPython disclosed on August 2, 2026, impact versions prior to 3.1.50-3.1.52. • Multiple CVEs involve command injection via improper handling of Git op…
Key findings • 21 vulnerabilities disclosed in Freerdp, patched in version 3.29.0. • Flaws include buffer overflows, out-of-bounds reads, null pointer dereferences, and TLS certificate valida…
Google is developing a new security feature for Chrome that will automatically block policy-installed extensions from hijacking the New Tab page or altering the default search engine.
Key findings • 17 vulnerabilities disclosed for Better Auth between August 1-2, 2026, ranging from Low to Critical severity. • Key themes include authorization bypass, insecure direct object …
A weekly cybersecurity roundup reveals critical vulnerabilities in VMware and Cisco, alongside alarming security incidents involving Anthropic's Claude AI models and Microsoft Word Copilot.
Russian VPN provider SplitVPN has suffered a major data breach, exposing personal records of 865,300 users and contradicting its own 'no-logs' policy.
A new malware campaign is distributing the Atomic MacOS (AMOS) stealer by tricking users into pasting malicious commands into their Terminal, leading to the theft of credentials and cryptocurrency.
A firmware flaw in Coldcard hardware wallets, caused by a March 2021 integration error, allowed an attacker to steal approximately $70.2 million in Bitcoin from 1,196 addresses within 41 minutes.
Microsoft is rolling out significant quality improvements to Windows 11, focusing on performance, reliability, and user experience, with enhanced taskbar controls and AI integration.
Key findings • Four vulnerabilities in Globo.com's Thumbor disclosed on August 1, 2026. • Path traversal vulnerability (CVE-2026-53502) allows access outside designated directories. • HMA…
Threat actors are now specifically targeting users of popular AI services like ChatGPT with phishing campaigns designed to steal payment information.
Adobe has patched a CVSS 10.0 vulnerability in its Campaign Classic platform that enables arbitrary code execution without user interaction.
Key findings • 16 malicious npm packages disclosed on August 1, 2026 • All advisories published within a single minute • Packages share the common prefix test-dev- • All packages were…
HackerOne now requires government ID verification for all bug bounty submissions to comply with regulations, impacting hackers seeking rewards.
Pharmaceutical giant Amgen has reported a significant data breach impacting patient health information and proprietary corporate data, accessed through compromised third-party cloud environments.
Arch Linux has temporarily disabled the adoption of Arch User Repository (AUR) packages to combat a recent wave of malicious takeovers and prevent the distribution of malware.
Online advertising firm Adform experienced a supply-chain attack where its ad script was compromised, leading to the theft of cryptocurrency by replacing wallet addresses.
Microsoft reports on CaptiveCrunch, a campaign by Midnight Blizzard sub-cluster Storm-2945, manipulating hospitality Wi-Fi to deliver malware and steal credentials globally.
Wordfence's April 2026 Bug Bounty Report reveals a significant influx of 1288 vulnerability submissions for WordPress plugins and themes, highlighting ongoing efforts to secure the vast WordPress ecosystem.
Sophisticated deepfake audio and video scams are increasingly tricking bank customers into willingly transferring funds to criminals, prompting financial institutions to re-evaluate authentication methods beyond voice.
Hugging Face's incident response was hampered when commercial AI models refused to analyze attack artifacts due to safety classifiers, highlighting a critical conflict between AI safety and security analysis.
A new Go-based loader, HollowFrame, has been identified deploying the Matryoshka backdoor in a sophisticated spear-phishing attack targeting a law firm.
A broken access control flaw in Keycloak's Admin REST API, CVE-2026-17059, enables restricted administrators to view usernames and email addresses outside their authorized scope.