Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,564 stories synthesized.
A new analysis of applications built using AI development tools has uncovered 434 exploitable security flaws, including denial-of-service and authorization bypass vulnerabilities.
A critical path traversal vulnerability in the open-source developer platform Windmill is being actively exploited, allowing attackers to read sensitive server files without authentication.
A new attack framework dubbed NULLZEREPTOOL uses Telegram bots to orchestrate sophisticated DDoS campaigns, incorporating rotating proxies and experimental wireless disruption modules.
Key findings • Five Ansible-related vulnerabilities disclosed on July 22, 2026, affecting VS Code extension, AWX, and community.general. • Two 'important' severity vulnerabilities in Ansible …
New research indicates a significant portion of ransomware victims pay ransoms, with many facing repeat extortion, underscoring the unreliability of criminal promises.
CISA has mandated federal agencies to patch CVE-2026-0770, a critical RCE flaw in the Langflow AI agent framework, which is being actively exploited in the wild.
Oracle's July 2026 Critical Patch Update addresses 1,449 vulnerabilities, including 261 critical issues, with the company attributing the surge in fixes to AI-driven vulnerability discovery.
Research reveals European financial institutions are inadvertently exposing customer data, including financial details, to third-party ad platforms through improperly configured cookie trackers.
As AI-driven attackers increasingly bypass traditional defenses, Security Operations Centers (SOCs) must adopt multi-layered detection strategies that integrate network visibility with endpoint and cloud telemetry.
A firsthand account of identity theft underscores the profound risk associated with compromised email accounts, revealing how a single point of failure can cascade into widespread personal data compromise.
The U.S. Department of Justice has dismantled a significant piracy operation by seizing over 1,000 internet domains used for unauthorized World Cup 2026 streams.
A race condition in Ubuntu's snap-confine utility allows local users to escalate privileges to root, granting full system control on default installations.
Microsoft has confirmed that the Extended Security Update (ESU) program for Exchange Server 2016 and 2019 will conclude in October 2026, leaving organizations without official security patches.
Lookout introduces the Mobile Software Exposure Center (MSEC) to address the growing threat of AI-accelerated vulnerability exploitation in mobile applications.
Google's CodeMender, initially a research project, is now a managed AI security agent integrated into Google Cloud, actively finding and fixing vulnerabilities by building and running exploits.
Box introduces new security capabilities to govern AI agents, including guardrails, prompt injection detection, and access policies, to secure enterprise content.
Key findings • Mozilla patched 25 coordinated vulnerabilities in Firefox 153 released on July 22, 2026. • Vulnerabilities include memory safety bugs, privilege escalations, and mitigation byp…
Key findings • Seven High severity vulnerabilities disclosed together in Chromium on July 22, 2026. • Flaws impact Extensions, UI, GPU, Certificate handling, WebAudio, and ANGLE components. …
Key findings • Google Chrome patched 11 High severity vulnerabilities on July 22, 2026. • Flaws impact V8, ANGLE, Skia, GPU, UI, Extensions, and Chromecast components. • Vulnerabilities i…
An anonymous researcher has released 204 proof-of-concept exploit files for numerous open-source projects, including PostgreSQL and Redis, before vendors could patch the vulnerabilities.
Yubico's latest YubiKey 5.8 firmware enhances hardware-backed passkeys, enabling verified authorization for sensitive enterprise actions including AI-driven approvals and document signing.
A sophisticated phishing campaign, attributed to North Korea's Famous Chollima group, is targeting cybersecurity and Web3 professionals with the GolangGhost malware via deceptive job interview lures.
Chick-fil-A is notifying customers of a data breach following credential stuffing attacks that compromised customer accounts with stolen credentials.
A typosquatting package on NuGet, 'Newtonsoftt.Json.Net,' has been discovered to contain malicious code designed to rig live game results on the Digitain betting platform, rather than steal data.