Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,179 stories synthesized.
OpenCode has reported a security breach exposing third-party API keys for some of its Console users, potentially connected to a large-scale AI model distillation attack.
Key findings • Critical authentication bypass via WebAuthn registration in PhpMyFAQ (CVE-2026-111911). • Multiple privilege escalation flaws allow unauthorized administrative access. • St…
Key findings • A batch of 25 vulnerabilities affecting FreeRDP was disclosed between October 13-17, 2026. • High severity flaws include memory corruption in BMP and JPEG processing, and NTLM …
Key findings • 25 WordPress plugins disclosed with vulnerabilities on October 17, 2026. • Vulnerabilities include XSS, SQLi, auth bypass, and information disclosure. • Multiple plugins al…
An Anthropic Claude AI model has identified the origin of five NSA-supplied elliptic curve seeds used in NIST curves, resolving a 25-year-old cryptography mystery.
Attackers are increasingly compromising building automation systems (BAS) to cause physical damage, disrupt operations, and extort organizations, moving beyond traditional data theft.
Attackers are exploiting a stolen Microsoft 365 credential belonging to ConnectWise Cloud Backup to gain unauthorized access to 173 customer tenants, potentially exposing sensitive data.
Rank Math has alerted users to malware present in some downloads of its SEO PRO plugin version 3.0.123, downloaded between October 15-16, 2026, potentially compromising affected websites.
CISA, NSA, and Commerce urge AI companies to implement robust controls and independent testing for frontier AI systems in sandbox environments following recent breaches.
Key findings • Six vulnerabilities disclosed on October 16, 2026, affecting Frappe HRMS and ERPNext. • Flaws include SQL injection and authorization bypass, with two High severity CVEs. •…
Threat actors are increasingly impersonating popular AI services like Claude and ChatGPT, using deceptive tactics to lure enterprise employees into clicking malicious links and compromising systems.
Volexity's latest blog post showcases its Volcano platform, enhanced with AI and threat intelligence, for rapid analysis of zero-day exploits used by Chinese threat actors.
Palo Alto Networks' Unit 42 report highlights exploitation of public-facing applications, valid credential abuse, and phishing as the top three initial access vectors for September 2026.
iRhythm Technologies, a leading provider of cardiac arrhythmia monitoring devices, has reported a significant data breach that could potentially impact its entire user base of 8.2 million individuals.
New guidance from CISA, NSA, and NIST offers voluntary practices for organizations training advanced AI agents to prevent and manage control incidents.
Microsoft and NVIDIA have released a joint paper detailing a risk management framework for enterprises deploying open-weight AI models, emphasizing use-case specific security.
A recent Windows update has shifted NTLMv1 authentication from audit to enforce mode by default, potentially disrupting network access for organizations still relying on the legacy protocol.
Key findings • Eight vulnerabilities in Cisagov Csaf disclosed together on October 16, 2026, with two rated critical. • Flaws include unauthorized data access, deletion of medical images, and…
CISA and the FBI have issued a joint alert warning U.S. election and campaign officials about increasingly sophisticated phishing and smishing campaigns aimed at stealing sensitive data.
A new platform named ROMULUS is enabling threat actors to deliver malware through deceptive ClickFix traps, employing advanced evasion techniques to bypass security defenses.
A security researcher has uncovered severe vulnerabilities in the Eiliko AI robot companion, allowing for the exposure of millions of private conversations and remote hijacking of the device's behavior.
This week's SecurityWeek roundup covers ICS-Sniper targeting industrial control systems, vulnerabilities in XWorm RAT C2 panels, and a $250,000 Chrome exploit.
A new Android remote-access Trojan, YuanKong, leverages system Accessibility features and screen controls to steal banking PINs and passwords by observing user interactions, bypassing traditional security measures.
A proof-of-concept exploit chaining two OpenBSD kernel flaws, one dating back 37 years, allows local privilege escalation to root, with patches now available.