Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 6,172 stories synthesized.
Microsoft will automatically enable Memory Integrity protection on eligible Windows devices starting October 2026, enhancing kernel-level security and potentially enabling Virtualization-based Security (VBS).
Anthropic's Claude AI can now execute tasks in the background on macOS and Windows, raising new security considerations for enterprises.
Key findings • Ten malicious npm packages disclosed simultaneously on September 3, 2026. • Packages impersonated internal development tools for Apple and Google Cloud. • All packages were…
The SANS Internet Storm Center's Honeypot-Omaha sensor uses the Cowrie tool to emulate SSH and Telnet, attracting and logging detailed threat actor activities for analysis.
Attackers are impersonating IT support on Microsoft Teams to trick users into granting remote access, leading to enterprise-wide compromise.
Key findings • 25 CVEs disclosed simultaneously for Drupal on September 2, 2026, spanning multiple modules. • Vulnerabilities include Missing Authorization, XSS, LDAP Injection, and Privilege…
Booz Allen's Cyber Weapon Index found Anthropic's Claude Mythos autonomously completed the full cyber kill chain, including network compromise and privilege escalation, raising alarms about imminent AI-driven attacks.
A 17-year-old from Maine is the first minor to be federally charged and detained for involvement in the violent extremist collective 764, signaling a shift in law enforcement's approach to prosecuting juveniles.
Key findings • 24 WordPress plugin vulnerabilities disclosed on September 2, 2026, ranging from Medium to Critical severity. • Two Critical vulnerabilities (CVE-2026-4357, CVE-2025-9314) allo…
The open-source authorization tool OpenLeash now intercepts potentially dangerous AI agent actions, blocking clear threats and requiring human approval for uncertain operations to prevent unintended harm.
An AI agent's attempt to establish an online presence highlights how CAPTCHAs, IP reputation, and account age restrictions act as significant barriers, often before identity verification is even considered.
A human attacker leveraged advanced AI agents to execute a complete ransomware attack, including reconnaissance, intrusion, and data exfiltration, in under 10 hours, then left the victim with a detailed security report.
Google, Anthropic, and OpenAI unveil new AI models and initiatives aimed at bolstering cybersecurity defenses, while also addressing potential misuse.
Key findings • Two High and three Medium severity vulnerabilities disclosed in Sonatype Nexus Repository 3 on September 2, 2026. • Vulnerabilities include authorization bypasses in blobstore …
CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation across various software and hardware products.
A newly discovered WhatsApp vulnerability on Android allows unauthorized access to a device's photo gallery by exploiting the 'Create with Meta AI' feature during a video call.
Key findings • Cisco disclosed 11 vulnerabilities on September 2, 2026, across IOS XR, Secure Email, Nexus 9000, and IP Phones. • Six high and two critical vulnerabilities in Cisco IOS XR Sof…
Ireland's Data Protection Commission has fined the Health Service Executive (HSE) for GDPR violations after sensitive psychiatric patient records were found abandoned and contaminated at disused hospitals.
Google has launched Gemini 3.8 Flash Cyber, an AI model designed to autonomously find and fix software security flaws, available to vetted teams through the Fairwind Program.
A threat group known as 'Spring Ring' is actively targeting Microsoft Teams users with sophisticated vishing attacks to compromise accounts and gain unauthorized access.
CrowdStrike's Falcon platform now offers real-time protection against malicious code injection within development pipelines and compromised build tools, extending endpoint security to safeguard against supply chain threats.
Key findings • 25 Jenkins vulnerabilities disclosed on September 2, 2026, covering RCE, XSS, and permission bypasses. • High-severity flaws include insecure deserialization and Stapler compon…
Key findings • 14 vulnerabilities disclosed simultaneously for Jenkins on September 2, 2026. • Multiple high-severity flaws (CVSSv3 8.8) related to insecure deserialization and Stapler compon…
Cyberattacks in August targeted US and EU firms using sophisticated phishing lures to hijack Microsoft 365 sessions and abuse legitimate remote management tools.