Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,564 stories synthesized.
Critical 'wp2shell' vulnerabilities in WordPress Core, CVE-2026-63030 and CVE-2026-60137, are now exploitable via public proof-of-concept code, prompting urgent calls for updates.
WordPress 7.0.2 addresses two critical vulnerabilities: a facilitated SQL injection and a REST API confusion leading to RCE, affecting versions 6.9 and earlier.
Microsoft has observed a significant increase in attacks using the ACR Stealer malware, which targets enterprise customers to exfiltrate sensitive data like passwords and documents.
Key findings • Nine RabbitMQ vulnerabilities disclosed on July 18, 2026, impact authentication, authorization, and management functionalities. • Key risks include OAuth secret leakage (CVE-20…
Two vulnerabilities in Citrix Secure Access Client and Endpoint Analysis Client for Windows could allow local attackers to escalate privileges to SYSTEM level.
Sophisticated AI-powered phishing toolkits are becoming widely accessible, enabling attackers to craft more personalized and effective campaigns that can bypass multi-factor authentication.
WordPress core has been updated to fix a critical SQL injection flaw and a chained vulnerability leading to unauthenticated remote code execution.
Abbott Laboratories is probing two distinct cybersecurity incidents, one involving unauthorized access to legacy Exact Sciences systems and another concerning a breach of its LabCentral portal, with threat actors claiming data theft.
Seven malicious npm packages targeting the Vite ecosystem have been discovered, employing a novel blockchain-based C2 infrastructure to deliver a remote access trojan (RAT) to unsuspecting developers.
WordPress 7.0.2, released July 17, 2026, patches a critical SQL injection flaw and a high-severity REST API confusion leading to RCE, with forced updates enabled.
A newly discovered OpenSSL vulnerability, dubbed 'HollowByte,' enables unauthenticated remote attackers to cause a denial-of-service by sending a minimal 11-byte payload, exploiting memory allocation flaws during TLS handshakes.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has detailed its response and recommendations following a data leak incident where sensitive information was exposed on a public GitHub repository.
A new Go-based botnet named NadMesh is actively scanning the internet for and exploiting publicly accessible AI services to steal cloud API keys and Kubernetes tokens.
PentestCode, an open-source AI agent, automates penetration testing by integrating 18 specialized tools to perform reconnaissance, exploitation, and post-exploitation tasks with minimal human intervention.
Authorities in the US, UK, and EU have intensified efforts against cybercriminals, sanctioning Russian GRU and FSB-linked entities, a VPN provider, and indicting operators of bulletproof hosting services.
A subgroup of the GoldenEyeDog Chinese cybercrime group, CylindricalCanine, is linked to the April 2026 DigiCert breach where code-signing certificates were stolen.
Microsoft Security will present insights on defending against AI-powered threats and ongoing supply chain attacks at Black Hat USA 2026, highlighting how threat actors exploit trust in digital ecosystems.
Global professional services firm Ernst & Young (EY) has revealed a data breach stemming from the compromise of a third-party support ticket system, potentially exposing client tax information.
Cybercriminals are increasingly scrutinizing residential proxies, prioritizing 'clean' IPs with no prior fraud history to bypass advanced fraud detection systems.
North Korean state-sponsored actors are employing steganography within SVG image files to hide malware, delivered through social engineering lures disguised as job offers and coding challenges.
A critical vulnerability in Shark's AWS IoT policy allows a compromised robot vacuum to access other devices, potentially exposing cameras, home maps, and Wi-Fi passwords.
Key findings • Nine moderate-severity vulnerabilities disclosed in Keycloak services between July 14-17, 2026. • Flaws impact authorization, session management, JWT/OIDC handling, and informa…
Google Cloud is integrating Wiz capabilities into a new agentic defense platform, aiming to automate threat detection and remediation against increasingly sophisticated AI-powered cyber threats.
Armenia has detained a Russian tourist, Aleksandr Ermakov, based on a U.S. extradition request for a key figure in the REvil ransomware group, though the detained man's lawyers assert he is the wrong individual.