Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,566 stories synthesized.
Insurance company AssuranceAmerica has disclosed a data breach affecting nearly 7 million drivers, with attackers gaining access to sensitive customer information.
ESET researchers report a significant increase in malicious AI agents being planted in open-source tool repositories, posing risks to users and enabling cyber-attacks.
Google Chrome 150 has been released with patches for 27 vulnerabilities, including two critical-severity flaws.
Meta's new AI image generation tool, Muse Image, allows users to incorporate public Instagram photos and reels into AI-created content, raising significant privacy questions.
A red teamer exploited physical security and employee preoccupation with network issues to steal a valuable trophy from a Fortune 500 company.
Microsoft has released a patch for a zero-day vulnerability in Microsoft Defender, dubbed RoguePlanet, which was publicly disclosed by a researcher in dispute with the company.
A critical backdoor vulnerability, CVE-2026-11405, in Tenda firmware allows unauthenticated attackers to gain administrative access to devices via their web interface.
Wireshark 4.6.7, a crucial maintenance release, has patched twelve security flaws discovered in its protocol dissectors and capture file parsing capabilities.
Palo Alto Networks has disclosed CVE-2026-0288, a critical vulnerability in PAN-OS that allows unauthenticated attackers to execute arbitrary code or cause a denial-of-service by sending specially crafted network traffic.
A self-propagating bot observed scanning for open HTTP and SSH ports uses a unique URI string, "/_HELP_ME_ESCAPE_FROM_BELARUS_PLEASE_", which appears to be a genuine plea for assistance rather than an exploit.
A new Android spyware, PromptSpy, is the first mobile malware to use Google's Gemini AI during runtime to dynamically adapt its behavior and evade detection.
The APT-C-20 (Fancy Bear) threat group is employing a sophisticated fileless attack technique, embedding shellcode within PNG images to deploy a C# backdoor and evade traditional security measures.
Key findings • Twelve Wireshark vulnerabilities disclosed on July 8, 2026, primarily DoS flaws. • Flaws affect multiple protocol dissectors and file parsers, including IEEE 802.11, SSH, and p…
Key findings • Ten CVEs disclosed simultaneously for Drupal on July 8, 2026. • All vulnerabilities are detailed in Drupal's official security advisories. • Users are directed to https://w…
Key findings • Five Drupal security advisories disclosed simultaneously on July 8, 2026. • All vulnerabilities are detailed in Drupal's official security advisories. • Users are directed …
Mount Royal University has confirmed a cyberattack where hackers stole and deleted sensitive data from its file storage systems, with a group named CMD Organization claiming responsibility and demanding a $1.9 million ransom.
Key findings • Three GitLab vulnerabilities disclosed simultaneously on July 8, 2026, affecting CE and EE. • CVE-2026-13320 allows arbitrary script execution due to improper input sanitizatio…
Block, Inc., the parent company of Cash App, has agreed to a $45 million settlement with state attorneys general over allegations of inadequate security measures and misleading users about the app's protections.
Key findings • Three Litellm vulnerabilities disclosed on July 8, 2026, including two rated 'important'. • CVE-2026-59819 allows information disclosure via local file read in the test connect…
A sophisticated, long-running operation by the threat actor Lurking Lizard has been discovered, turning unsuspecting users' devices into proxy nodes by distributing malware disguised as legitimate software, most notably a fake 7-Zip installer.
A new report highlights the challenges in understanding and combating the decentralized, adolescent-driven cybercrime collective known as Scattered Spider.
The Paris Peace Forum has established the Integrated Network for Trusted AI in Cyberspace (INTAiC) to foster global collaboration and research on AI-related cybersecurity risks.
A sophisticated campaign uses fake Indian tax notices to deliver two distinct Remote Access Trojans (RATs) through a complex six-stage infection process, exploiting DLL search order abuse and polyglot files.
Sophos researchers observed AI coding agents like Claude Code and Cursor inadvertently triggering endpoint security alerts by performing actions that resemble malicious activity.