Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,564 stories synthesized.
A law firm's internal system featured a master password allowing any user to impersonate any other staff member or client, including access to sensitive health records.
A stealthy Windows backdoor named Backdoor.Stupig has emerged, enabling attackers to gain SYSTEM shell access by typing a specific username prefix at the Windows login screen.
A tech support scam targeting a contact center agent led to a massive data breach at Qantas, but the Australian Privacy Commissioner has ruled the airline did not breach its obligations.
Four major cybersecurity vendors have released patches for severe vulnerabilities affecting their respective products, urging customers to update promptly.
Sophisticated AI agents are poised to become a significant threat vector in supply chain attacks, automating reconnaissance and exploitation with unprecedented efficiency.
Key findings • 11 Rockwell Automation vulnerabilities disclosed July 14-16, 2026, including one critical flaw. • High-severity DoS vulnerabilities affect Flex 5000, Compact/ControlLogix contr…
Key findings • Six vulnerabilities in AutomationDirect Productivity Suite disclosed on July 16, 2026, primarily involve memory corruption. • Flaws include out-of-bounds reads/writes and a div…
A new study analyzing German government funding for open-source projects shows that financial support significantly increases development activity but does not attract new contributors or reduce existing backlogs.
A significant disconnect exists between identifying software vulnerabilities and effectively fixing them, leaving many organizations exposed to known threats.
OpenAI's automated red-teaming model, GPT-Red, has demonstrated superior performance over human red teamers in identifying prompt injection vulnerabilities in large language models.
F5 has released patches for three high-severity vulnerabilities in NGINX Plus and Open Source, with one flaw potentially allowing unauthenticated attackers to execute arbitrary code.
Threat actors are increasingly using phishing emails that mimic routine financial communications to bypass security controls and gain initial access, according to a Cofense report.
Mandiant outlines best practices for integrating AI agents into CI/CD pipelines for vulnerability management, addressing architectural risks and proposing operational guardrails.
A cyberattack on Nichirei Group, a major Japanese frozen food logistics firm, has caused system failures, disrupting operations and impacting KFC Japan's supply chain, leading to order cancellations and potential store closures.
Cyberstalkers are exploiting Google Chrome's sync feature to gain unauthorized access to users' browsing history and stored passwords, researchers warn.
Identity compromise, driven by phishing and compromised credentials, has surpassed vulnerability exploitation as the primary entry point for ransomware attacks, according to Sophos's latest research.
A critical vulnerability in Zoom's Windows desktop client and SDK (CVE-2026-53412) allows unauthenticated attackers to hijack user accounts.
A moderately critical cross-site scripting vulnerability has been identified in Drupal core's Layout Builder module, requiring specific user interaction for exploitation.
Drupal core versions 11.2.x, 11.3.x, and 11.4.x contain a moderately critical cross-site scripting vulnerability due to insufficient sanitization of certain HTMX attributes.
The Destiny Stealer malware is increasingly targeting corporate accounts and sensitive data across the US and Europe, with some variants evading initial detection and escalating threats before security teams can respond.
A Russian-speaking threat actor has weaponized Google's open-source Gemini CLI AI tool, using it as a sophisticated hacking agent to manage a botnet and compromise sensitive data.
An advanced AI model, GPT-5.6 Sol Ultra, has successfully constructed a complete exploit chain for Google Chrome by analyzing publicly available security patch commits, demonstrating a significant acceleration in exploit development capabilities.
Genetic testing company 23andMe has agreed to an $18 million settlement with 42 state attorneys general over cybersecurity failures that led to a massive data breach.
Threat actors are leveraging Anthropic's Claude AI platform and Google Ads to distribute the MacSync Stealer malware on macOS, tricking users into running malicious commands.