Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,725 stories synthesized.
Four critical vulnerabilities in GNU Guix's package substitution and channel management features allow for remote privilege escalation, data corruption, and local file disclosure.
A vulnerability in the Linux kernel's FUSE subsystem, CVE-2026-31694, enables local attackers to gain root privileges by corrupting memory through oversized directory entries.
Danish e-commerce platform Miinto has confirmed a data breach exposing customer names, contact details, and payment method types, prompting warnings of potential phishing attacks.
SentinelOne reports that both China and India-linked threat actors have targeted Pakistan's Balochistan Police for over two years, highlighting sustained state-sponsored interest in a specific national entity.
A critical vulnerability in Alibaba's XQUIC library, nicknamed XRING, enables remote attackers to crash HTTP/3 servers with minimal, standard traffic, and no patch is currently available.
Zimbra has released a patch for a critical cross-site scripting (XSS) vulnerability in its Classic Web Client, urging immediate updates to prevent account takeovers.
A novel Windows technique dubbed 'Process Parameter Poisoning' allows attackers to hide malicious code within legitimate process startup data, evading detection by leading EDR solutions.
An exposed server has revealed the inner workings of a large-scale WordPress site-hacking operation, including tools, logs, and target lists for over 1.4 million websites.
Criminals are exploiting individuals, particularly students and job seekers, by recruiting them to open gambling accounts used for laundering illicit funds.
A new study of 281 free Android VPN applications found that a significant number suffer from critical security flaws, including traffic leaks and unencrypted data transmission, affecting billions of installations.
Odyssey Stealer is actively infecting macOS users in over 100 countries, employing social engineering tactics to steal credentials, browsing data, and cryptocurrency assets from hundreds of wallet extensions and desktop applications.
The new open-source Xalgorix platform uses an AI agent and an independent verifier to confirm vulnerabilities, offering a distinct approach to automated penetration testing.
Patchstack has partnered with web hosts, starting with Hostinger, to provide automated vulnerability protection and supply chain security for NodeJS applications, aiming to shield non-technical users from open-source dependency risks.
Cybercriminals are impersonating Robinhood in callback phishing attacks, using fake sign-in alerts to trick users into calling fraudulent phone numbers for social engineering.
Key findings • Six vulnerabilities disclosed in GNU patch and GNU Wget between July 8-10, 2026. • GNU patch vulnerable to NULL pointer dereference and DoS via crafted patch files (CVE-2026-56…
Key findings • Three vulnerabilities in Vim's completion scripts and spell-checking function were disclosed on July 10, 2026. • CVE-2026-59856 and CVE-2026-59858 affect PHP and C omni-complet…
NHS Forth Valley is investigating a data breach where a staff member emailed a spreadsheet containing personal details of approximately 150 maternity patients to their personal account.
Attackers are embedding large, obfuscated HTML files within phishing emails, using a "comment stuffing" technique to bypass AI-driven security filters.
A flaw in the random number generation for cryptocurrency wallet recovery phrases, dubbed 'Ill Bloom,' has led to the theft of over $3.1 million from hundreds of wallets.
The UK's National Health Service (NHS) has issued a stark warning to its staff, reminding them that unauthorized access to patient medical records is a criminal offense punishable by imprisonment.
A new Golang-based backdoor, GigaWiper, observed since October 2025, combines destructive disk wiping capabilities with deceptive file encryption, posing a significant threat to Windows systems.
A critical SQL injection vulnerability (CVE-2026-1207) in Django's GIS module, affecting GeoDjango with PostGIS, is actively exploited in the wild.
Attackers leveraged a vast network of approximately 200 GitHub repositories to host and distribute malware, initiating infection chains through Go modules and PowerShell.
A malicious NuGet package impersonating Braintree's .NET library has been discovered, targeting production payment systems by intercepting live transaction data and stealing sensitive environment secrets.