Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,566 stories synthesized.
Key findings • Three Coturn vulnerabilities disclosed on July 10, 2026, including arbitrary code execution via SQL injection. • CVE-2026-53450 allows localhost services to be exposed through …
Two significant legal actions against ransomware actors, including a guilty plea from a Ryuk operator and a lengthy prison sentence for a Blackcat/AlphV conspirator, underscore ongoing global efforts to dismantle cybercrime syndicates.
Cyberattacks targeting healthcare businesses, particularly service providers, more than doubled in frequency during the first half of 2026, outpacing attacks on hospitals and clinics.
Operation First Light 2026 arrests 5,811 suspects and seizes $293 million, while a new PhaaS operation, Forg365, targets Microsoft 365 accounts with AI-powered lures.
Progress Software has issued an urgent warning to customers using its on-premises ShareFile Storage Zone Controllers, advising them to immediately shut down their servers due to a credible external security threat.
CISA has detailed its incident response to a breach involving exposed AWS GovCloud credentials and sensitive internal data found in a public GitHub repository.
A Bulgarian national already serving time for crypto money laundering is now charged with stealing $290,000 in seized cryptocurrency from behind bars.
Fortinet FortiGate has been named the top Unified Threat Management (UTM) solution for 2026, lauded for its value and comprehensive security features, though a recent CISA KEV addition underscores the critical need for diligent patching.
The Department of Homeland Security confirmed a breach of its HSIN database, while Adobe announced a move to bi-monthly security updates and Canadian authorities revealed successful disruption of ransomware operations.
Researchers have demonstrated a sophisticated laser fault injection attack capable of resetting passwords on Tangem hardware cryptocurrency wallets, posing a risk to unpatchable cards.
A researcher has detailed how three patched vulnerabilities in the OpenClaw AI assistant can be chained to achieve credential theft, privilege escalation, and arbitrary code execution, potentially leading to full host compromise.
The rapid proliferation of AI agents within organizations is creating a significant identity security gap, overwhelming traditional governance models and increasing the risk of breaches.
Security flaws have been identified in a wrapper used with Microsoft BitLocker, potentially exposing ATMs and organizational systems to unauthorized access.
Researchers demonstrate how AI assistants from Anthropic and OpenAI, designed for cybersecurity tasks, can be exploited for remote code execution.
A new Rust-based RAT, MODBEACON, attributed to the China-linked Silver Fox group, employs gRPC streaming for encrypted C2 traffic and SEO poisoning for distribution.
Cloudflare's Smart Tiered Cache now supports origins hosted on public cloud platforms by allowing users to specify a cloud region hint, improving cache efficiency and reducing latency.
A sophisticated attack campaign uses disguised Windows shortcuts to deliver a backdoor, leveraging PowerShell and Node.js for execution and the TON blockchain for command and control.
Four critical vulnerabilities in GNU Guix's package substitution and channel management features allow for remote privilege escalation, data corruption, and local file disclosure.
A vulnerability in the Linux kernel's FUSE subsystem, CVE-2026-31694, enables local attackers to gain root privileges by corrupting memory through oversized directory entries.
Danish e-commerce platform Miinto has confirmed a data breach exposing customer names, contact details, and payment method types, prompting warnings of potential phishing attacks.
SentinelOne reports that both China and India-linked threat actors have targeted Pakistan's Balochistan Police for over two years, highlighting sustained state-sponsored interest in a specific national entity.
A critical vulnerability in Alibaba's XQUIC library, nicknamed XRING, enables remote attackers to crash HTTP/3 servers with minimal, standard traffic, and no patch is currently available.
Zimbra has released a patch for a critical cross-site scripting (XSS) vulnerability in its Classic Web Client, urging immediate updates to prevent account takeovers.
A novel Windows technique dubbed 'Process Parameter Poisoning' allows attackers to hide malicious code within legitimate process startup data, evading detection by leading EDR solutions.