Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,564 stories synthesized.
A writer was mistakenly arrested due to Flock's AI license plate recognition system misinterpreting partial plate data, highlighting concerns about the technology's accuracy and broader surveillance capabilities.
Software provider Craneware, serving over 2,000 U.S. hospitals, has reported a data breach impacting employee and customer data after hackers accessed its internal network.
Malware campaigns are leveraging fake game downloads, disguised with the RenPy engine, to distribute the Amatera Stealer, employing MSBuild and a novel blockchain-based C2 technique for evasion.
Microsoft is actively working to resolve synchronization issues impacting Windows Server Update Services (WSUS) servers, which have prevented timely deployment of critical updates for over a week.
Financial services giant Capital One has open-sourced VulnHunter, an AI-driven tool designed to identify and remediate exploitable code vulnerabilities with a focus on reducing false positives.
Key findings • 25 vulnerabilities disclosed in the Linux kernel on July 20, 2026. • Issues span multiple subsystems including networking, storage, graphics, and security. • All disclosed …
Key findings • 17 Linux kernel vulnerabilities disclosed on July 20, 2026, affecting networking, storage, graphics, and crypto subsystems. • All disclosed vulnerabilities were addressed in De…
Key findings • 25 Linux kernel vulnerabilities disclosed together on July 20, 2026, affecting multiple subsystems. • All disclosed vulnerabilities were patched by Debian on the same day as di…
Key findings • Three F2FS vulnerabilities in the Linux kernel were disclosed on July 20, 2026. • CVE-2026-63819 involves an invalid opcode kernel BUG in f2fs node handling. • CVE-2026-638…
A threat actor is allegedly selling a database containing 176 million Starbucks user records on a cybercrime forum, though the claims remain unverified.
Microsoft's July 2026 Patch Tuesday addresses a significant number of vulnerabilities, including three zero-days actively exploited in the wild.
Microsoft has launched Dusseldorf, an open-source platform designed to simplify the testing of out-of-band vulnerabilities by capturing and analyzing inbound network traffic.
An outcome-based Security Operations Center (SOC) approach can significantly improve response times and reduce alert fatigue, even as the volume of security alerts continues to rise.
A new supply chain attack dubbed SleeperGem has compromised three RubyGems packages, including one impersonating Microsoft's Git Credential Manager, to deliver malware to developer machines.
Researchers have developed CodeTracer, a novel forensic tool designed to trace malicious code completions generated by AI coding assistants back to their poisoned training data.
Key findings • 40 malicious npm packages disclosed within one minute on July 20, 2026. • All packages share the @gocortexio npm scope and npmgremlinbox- prefix. • Package names indicate v…
Key findings • 34 malicious npm packages were disclosed within a 7-minute window. • The packages impersonated various brands, including Twilio, Tencent, and others. • Multiple packages us…
AI security firm PromptArmor highlights how connectors linking AI agents to third-party services like Gmail and Slack introduce significant, often unmanaged, security risks.
Researchers observe widespread scans probing Hikvision's Intelligent Security API (ISAPI) for vulnerabilities, potentially exposing device control and credentials.
An advanced threat actor is exploiting the update mechanism of Russia's ViPNet private networking software to deliver malware to government agencies and other critical organizations.
Russian state-sponsored threat actors, identified as UAC-0145 and linked to the Sandworm group, are employing a sophisticated social engineering tactic using fake CAPTCHA checks to trick Ukrainian organizations into downloading and executing malware.
Cybercriminals are exploiting a weakness in Microsoft Entra ID's logging by spoofing OAuth client IDs, allowing them to conduct reconnaissance and enumeration without detection.
7-Zip version 26.02 addresses a critical remote code execution vulnerability that can be triggered by opening malicious XZ-compressed archives.
Hugging Face has confirmed a sophisticated breach orchestrated by autonomous AI agents, which exploited code-execution flaws in its dataset processing pipeline and were countered by the company's own AI-driven forensic analysis.