Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,566 stories synthesized.
An exposed server has revealed the inner workings of a large-scale WordPress site-hacking operation, including tools, logs, and target lists for over 1.4 million websites.
Criminals are exploiting individuals, particularly students and job seekers, by recruiting them to open gambling accounts used for laundering illicit funds.
A new study of 281 free Android VPN applications found that a significant number suffer from critical security flaws, including traffic leaks and unencrypted data transmission, affecting billions of installations.
Odyssey Stealer is actively infecting macOS users in over 100 countries, employing social engineering tactics to steal credentials, browsing data, and cryptocurrency assets from hundreds of wallet extensions and desktop applications.
The new open-source Xalgorix platform uses an AI agent and an independent verifier to confirm vulnerabilities, offering a distinct approach to automated penetration testing.
Patchstack has partnered with web hosts, starting with Hostinger, to provide automated vulnerability protection and supply chain security for NodeJS applications, aiming to shield non-technical users from open-source dependency risks.
Cybercriminals are impersonating Robinhood in callback phishing attacks, using fake sign-in alerts to trick users into calling fraudulent phone numbers for social engineering.
Key findings • Six vulnerabilities disclosed in GNU patch and GNU Wget between July 8-10, 2026. • GNU patch vulnerable to NULL pointer dereference and DoS via crafted patch files (CVE-2026-56…
Key findings • Three vulnerabilities in Vim's completion scripts and spell-checking function were disclosed on July 10, 2026. • CVE-2026-59856 and CVE-2026-59858 affect PHP and C omni-complet…
NHS Forth Valley is investigating a data breach where a staff member emailed a spreadsheet containing personal details of approximately 150 maternity patients to their personal account.
Attackers are embedding large, obfuscated HTML files within phishing emails, using a "comment stuffing" technique to bypass AI-driven security filters.
A flaw in the random number generation for cryptocurrency wallet recovery phrases, dubbed 'Ill Bloom,' has led to the theft of over $3.1 million from hundreds of wallets.
The UK's National Health Service (NHS) has issued a stark warning to its staff, reminding them that unauthorized access to patient medical records is a criminal offense punishable by imprisonment.
A new Golang-based backdoor, GigaWiper, observed since October 2025, combines destructive disk wiping capabilities with deceptive file encryption, posing a significant threat to Windows systems.
A critical SQL injection vulnerability (CVE-2026-1207) in Django's GIS module, affecting GeoDjango with PostGIS, is actively exploited in the wild.
Attackers leveraged a vast network of approximately 200 GitHub repositories to host and distribute malware, initiating infection chains through Go modules and PowerShell.
A malicious NuGet package impersonating Braintree's .NET library has been discovered, targeting production payment systems by intercepting live transaction data and stealing sensitive environment secrets.
A new paper proposes a typology of open-source software projects, arguing that understanding a project's origin and governance is crucial for assessing its security and stability risks.
Microsoft is advising organizations to accelerate Windows update deployment timelines due to AI advancements that shorten the window for attackers to exploit vulnerabilities.
Researchers uncover six critical vulnerabilities in the U-Boot bootloader, impacting embedded systems and server BMCs with risks of code execution and denial-of-service attacks.
Group-IB's Anastasia Tikhonova proposes integrating Software Bill of Materials (SBOMs) into daily security operations for enhanced vulnerability management and incident response.
A new report reveals that only 28% of financial sector employees use phishing-resistant multi-factor authentication, leaving the industry vulnerable to credential theft.
Codenotary's new AgentMon 3 platform uses AI to dynamically adjust security policies based on observed AI agent behavior and organizational workflows.
Angelo John Martino III, a former ransomware negotiator for DigitalMint, has been sentenced to 70 months in prison for defrauding clients and conspiring with BlackCat ransomware affiliates.