Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,649 stories synthesized.
An advanced threat actor is exploiting the update mechanism of Russia's ViPNet private networking software to deliver malware to government agencies and other critical organizations.
Russian state-sponsored threat actors, identified as UAC-0145 and linked to the Sandworm group, are employing a sophisticated social engineering tactic using fake CAPTCHA checks to trick Ukrainian organizations into downloading and executing malware.
Cybercriminals are exploiting a weakness in Microsoft Entra ID's logging by spoofing OAuth client IDs, allowing them to conduct reconnaissance and enumeration without detection.
7-Zip version 26.02 addresses a critical remote code execution vulnerability that can be triggered by opening malicious XZ-compressed archives.
Hugging Face has confirmed a sophisticated breach orchestrated by autonomous AI agents, which exploited code-execution flaws in its dataset processing pipeline and were countered by the company's own AI-driven forensic analysis.
Critical 'wp2shell' vulnerabilities in WordPress Core, CVE-2026-63030 and CVE-2026-60137, are now exploitable via public proof-of-concept code, prompting urgent calls for updates.
WordPress 7.0.2 addresses two critical vulnerabilities: a facilitated SQL injection and a REST API confusion leading to RCE, affecting versions 6.9 and earlier.
Microsoft has observed a significant increase in attacks using the ACR Stealer malware, which targets enterprise customers to exfiltrate sensitive data like passwords and documents.
Key findings • Nine RabbitMQ vulnerabilities disclosed on July 18, 2026, impact authentication, authorization, and management functionalities. • Key risks include OAuth secret leakage (CVE-20…
Two vulnerabilities in Citrix Secure Access Client and Endpoint Analysis Client for Windows could allow local attackers to escalate privileges to SYSTEM level.
WordPress core has been updated to fix a critical SQL injection flaw and a chained vulnerability leading to unauthenticated remote code execution.
Abbott Laboratories is probing two distinct cybersecurity incidents, one involving unauthorized access to legacy Exact Sciences systems and another concerning a breach of its LabCentral portal, with threat actors claiming data theft.
Sophisticated AI-powered phishing toolkits are becoming widely accessible, enabling attackers to craft more personalized and effective campaigns that can bypass multi-factor authentication.
Seven malicious npm packages targeting the Vite ecosystem have been discovered, employing a novel blockchain-based C2 infrastructure to deliver a remote access trojan (RAT) to unsuspecting developers.
WordPress 7.0.2, released July 17, 2026, patches a critical SQL injection flaw and a high-severity REST API confusion leading to RCE, with forced updates enabled.
A newly discovered OpenSSL vulnerability, dubbed 'HollowByte,' enables unauthenticated remote attackers to cause a denial-of-service by sending a minimal 11-byte payload, exploiting memory allocation flaws during TLS handshakes.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has detailed its response and recommendations following a data leak incident where sensitive information was exposed on a public GitHub repository.
A new Go-based botnet named NadMesh is actively scanning the internet for and exploiting publicly accessible AI services to steal cloud API keys and Kubernetes tokens.
PentestCode, an open-source AI agent, automates penetration testing by integrating 18 specialized tools to perform reconnaissance, exploitation, and post-exploitation tasks with minimal human intervention.
Authorities in the US, UK, and EU have intensified efforts against cybercriminals, sanctioning Russian GRU and FSB-linked entities, a VPN provider, and indicting operators of bulletproof hosting services.
A subgroup of the GoldenEyeDog Chinese cybercrime group, CylindricalCanine, is linked to the April 2026 DigiCert breach where code-signing certificates were stolen.
Microsoft Security will present insights on defending against AI-powered threats and ongoing supply chain attacks at Black Hat USA 2026, highlighting how threat actors exploit trust in digital ecosystems.
Global professional services firm Ernst & Young (EY) has revealed a data breach stemming from the compromise of a third-party support ticket system, potentially exposing client tax information.
Cybercriminals are increasingly scrutinizing residential proxies, prioritizing 'clean' IPs with no prior fraud history to bypass advanced fraud detection systems.