Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,564 stories synthesized.
A critical vulnerability in OSNEXUS QuantaStor, assigned CVE-2026-18265, permits unauthenticated remote attackers to execute arbitrary code with root privileges.
A critical vulnerability in NoMachine's getstat command allows authenticated attackers to achieve remote code execution with a CVSS score of 8.8.
A heap-based buffer overflow in GIMP's TIF file parsing allows remote code execution, with a CVSS score of 7.8.
A command injection vulnerability in Kenwood DNR1007XR devices, identified as ZDI-26-489, allows physically present attackers to execute arbitrary code without authentication.
A local privilege escalation vulnerability in Kenwood DNR1007XR devices, identified as ZDI-26-490, allows physically present attackers to gain root-level access by exploiting incorrect USB permissions.
A new survey reveals that a significant portion of AI agents in production are accessing sensitive data beyond their authorized permissions, leading to potential breaches and operational disruptions.
Two beta versions of @joyfill npm packages have been compromised to deliver a remote access trojan (RAT) linked to the DEV#POPPER malware family.
Research reveals that many popular Android malware detectors struggle to distinguish legitimate apps with extensive permissions from actual threats, leading to high false positive rates.
OpenAI has released Codex Security, an AI-powered command-line tool and SDK designed to help developers identify, validate, and patch code vulnerabilities directly within their development workflows.
The U.S. Federal Communications Commission has banned new sales of foreign-made internet-connected power inverters and mobile robots, citing national security risks to critical infrastructure and potential for espionage.
A new benchmark, CryptanalysisBench, reveals that advanced AI models can perform sophisticated cryptanalysis, even discovering previously unknown vulnerabilities in cryptographic schemes.
GitLab has issued critical patch updates for versions 19.2.1, 19.1.3, and 19.0.5, addressing a range of security flaws including sensitive information exposure and mass assignment vulnerabilities.
Key findings • CVE-2026-20316, a static credential vulnerability in Cisco Secure Firewall Management Center, is actively exploited. • The flaw was added to CISA's KEV catalog on July 29, 2026…
Trend Micro research reveals over 35,000 malicious websites impersonating official FIFA World Cup 2026 entities, attracting millions of visits and employing sophisticated tactics to steal financial data.
The Agentic AI Foundation releases a major update to the Model Context Protocol (MCP), adopting a stateless architecture for easier enterprise deployment and bolstering security with new measures against OAuth attacks.
Security researcher Aleksandr Krasnov has identified a new cloud attack vector: dormant non-human identities, or 'ghost credentials,' creating security blind spots and hidden trust paths exploitable by attackers.
Australian drone flight controller developer CubePilot suffered a DNS hijacking attack that allowed attackers to intercept traffic and potentially steal user credentials.
Medical Cost Bảo hiểm Services LLC (MCBS) is notifying 1.3 million patients of a 2025 data breach attributed to the extortion group PEAR, which claims to have stolen 3.3 terabytes of sensitive information.
Microsoft and Wiz's respective AI security agents, MDASH and Project Atlas, have demonstrated remarkable success in identifying software vulnerabilities, both exceeding 90% accuracy on the CyberGym benchmark.
Key findings • Eight high-severity vulnerabilities disclosed together in Adobe Bridge on July 28, 2026. • Flaws include incorrect authorization, untrusted search path, out-of-bounds write, an…
A coordinated cyberattack has disrupted water and wastewater utilities in more than 30 Minnesota communities, prompting a multi-agency response and raising concerns about critical infrastructure security.
Analysis of the first half of 2026 reveals a significant increase in newly discovered vulnerabilities, largely attributed to AI, yet the rate at which these flaws are exploited in the wild has not kept pace.
The European Commission has released final guidance for the Cyber Resilience Act (CRA), setting key compliance deadlines and clarifying the scope of software covered by the landmark 2024 law.
Anthropic's Claude Mythos Preview AI has identified significant cryptographic weaknesses in the HAWK post-quantum signature scheme and a reduced-round AES version, flaws that eluded human experts for years.