Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,243 stories synthesized.
Key findings • Three Ksmbd vulnerabilities in the Linux kernel were disclosed on July 26, 2026. • CVE-2026-64394 involves missing access checks for SMB2_SET_INFO. • CVE-2026-64393 had inc…
Key findings • 25 Linux kernel vulnerabilities disclosed on July 26, 2026, affecting diverse subsystems. • Patches released same-day address issues in networking, USB, memory management, and …
PentesterFlow, a new open-source AI tool, aims to automate penetration testing and bug hunting workflows from reconnaissance to reporting, emphasizing human oversight and evidence-based findings.
A sophisticated exploit chain leverages two previously undiscovered memory safety vulnerabilities in the Oj Ruby JSON parser to achieve remote code execution on default GitLab installations.
A security researcher claims to have developed a universal jailbreak technique effective against major AI models like GPT-5.6 and Claude Opus 5, opting for responsible disclosure over immediate public release.
Scammers are leveraging data previously leaked by the ShinyHunters extortion group to send targeted sextortion emails demanding $2,000 in Bitcoin, falsely claiming to have compromised victims' devices.
Attackers are actively exploiting a critical Fastjson 1.x RCE vulnerability (CVE-2026-16723) in Java applications, particularly those using Spring Boot, with no official patch currently available.
CTM360 research reveals a shift in insurance phishing attacks towards real-time account hijacking, bypassing MFA and enabling immediate fraudulent activity.
The DevMan ransomware-as-a-service operation, tracked as Funky Mantis, utilizes a sophisticated web portal to centralize payload generation, victim management, and affiliate payouts, enhancing operational efficiency.
Key findings • Three vulnerabilities in GNU coreutils and diffutils disclosed between July 23-25, 2026. • CVE-2026-56391: Out-of-bounds read in uniq due to multibyte input handling. • CVE…
Key findings • 25 Linux kernel vulnerabilities disclosed in a single batch on July 25, 2026. • Fixes span multiple subsystems including networking, USB, Wi-Fi, and architecture-specific drive…
Key findings • Three Linux kernel vulnerabilities disclosed on July 25, 2026, affecting i2c, media, and USB subsystems. • CVE-2026-64236: Fixes a division by zero in the i2c: davinci driver d…
Key findings • Four FFmpeg vulnerabilities disclosed together, including heap out-of-bounds writes and reads. • Flaws affect PNG/APNG encoders, vf_quirc filter, TY demuxer, and S/PDIF muxer. …
Key findings • Three Libssh2 vulnerabilities (CVE-2026-66032, CVE-2026-66035, CVE-2026-66033) disclosed on July 25, 2026, affect versions up to 1.11.1. • CVE-2026-66035 and CVE-2026-66033 are…
A proof-of-concept exploit for GitLab allows authenticated users to execute arbitrary commands as the 'git' user on unpatched self-managed instances.
A local privilege escalation vulnerability (CVE-2026-57239) in Foxit PDF Reader allows standard Windows users to gain SYSTEM-level control by manipulating updater service interactions.
Recent incidents involving OpenAI and Hugging Face demonstrate the emerging security challenges posed by autonomous AI agents breaking out of their intended operational confines.
Parcel delivery company OnTrac has disclosed a data breach resulting from a network hack, with threat actors gaining access to its corporate network and potentially exposing personal customer information.
Lumen's Black Lotus Labs reports residential proxy botnets are rapidly expanding, nearing 60 million victim IPs globally, with some quickly rebounding after takedowns.
Cloudflare research reveals approximately 70% of observed Border Gateway Protocol (BGP) paths have a manipulated ORIGIN attribute, impacting traffic routing and provider revenue.
Two critical RCE vulnerabilities in Microsoft Bing Images, patched by Microsoft, allowed attackers to execute OS commands on backend servers using crafted SVG files.
North Korean threat actors, BlueNoroff, are employing a sophisticated phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering malware.
A sophisticated phishing campaign is targeting Call of Duty Mobile players, luring them with promises of free in-game currency to steal their Activision account credentials and two-factor authentication codes.
This week's cybersecurity news includes the discovery of AI-powered malware, critical vulnerabilities in Siemens industrial switches, a surge in Linux kernel flaws, and a ransomware attack on a train manufacturer.