Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,566 stories synthesized.
Microsoft details its internal Secure Future Initiative (SFI), a multi-agent AI system designed to proactively identify and remediate complex vulnerabilities in its cloud infrastructure at unprecedented speed.
DuckDuckGo's browser now automatically blocks YouTube ads by integrating community-maintained filter lists, enhancing privacy and reducing the attack surface.
Taiwanese prosecutors have charged two businessmen accused of leasing popular LINE messaging app accounts to Chinese intelligence operatives for espionage purposes.
A threat actor is using voice phishing to trick Microsoft 365 users into enrolling a fake Entra passkey, aiming to compromise accounts.
SentinelOne identifies a critical security gap in US Federal Government High-Performance Computing (HPC) AI infrastructure, arguing current NIST standards are insufficient for AI workloads.
Key findings • Ten PAN-OS vulnerabilities disclosed simultaneously on July 8, 2026, ranging from low to high severity. • High-severity CVE-2026-0288 in User-ID TSA allows for potential arbitr…
A novel 'HalluSquatting' attack leverages AI coding assistants' tendency to invent non-existent project names, tricking them into downloading and executing malicious code.
Anthropic's Claude Cowork feature now allows users to manage AI sessions remotely from mobile devices, introducing new security considerations for persistent AI workflows.
CrowdStrike has identified five new prompt injection techniques that represent a significant evolution in attacks against AI agents, moving beyond simple chatbot manipulation to more complex methods that embed malicious instructions within data.
The Banana RAT banking trojan is leveraging an exposed backend server to generate polymorphic malware variants, significantly complicating detection and defense efforts.
Artificial intelligence is significantly enhancing the sophistication and effectiveness of social engineering attacks targeting service desks, particularly during employee onboarding.
A critical vulnerability dubbed 'GhostApproval' allows AI coding assistants to bypass sandboxes using symbolic links, potentially leading to remote code execution and SSH key injection.
Censys has updated its Internet Map to include real-time DNS visibility, allowing security teams to directly correlate domains with their underlying internet infrastructure.
A new botnet, dubbed Mycelium Framework, is being marketed as an AI-as-a-Service, allowing criminals to rent computing power from compromised machines for advanced AI tasks.
Blackpoint Cyber's new AI SOC Agent autonomously detects and contains credential-based attacks targeting Microsoft 365 and Google Workspace in under two minutes.
First Recon AI introduces its AI Security Runtime platform, offering enterprises a way to govern and secure AI interactions with audit-ready evidence.
A novel 'ghost phishing' campaign by EvilTokens uses browser-side decryption to hide malicious content, bypassing traditional email security checks and targeting Microsoft 365 accounts.
Cloudflare's Research team has developed Meerkat, an experimental global consensus service utilizing the QuePaxa algorithm to manage control-plane state across its data centers.
A new offensive cybersecurity startup, IRIS C2, which claims to acquire zero-day exploits for millions, is reportedly run by convicted felons Jack Burkman and Jacob Wohl, known for past disinformation campaigns.
Threat actors are leveraging agentic AI to reduce complex cloud compromise campaigns from weeks to mere days, according to a new Sygnia report.
Proof-of-concept exploit code is now available for CVE-2025-53770, a critical RCE vulnerability in on-premises Microsoft SharePoint Server, increasing the risk of widespread exploitation.
Mandatory driver-monitoring systems in new EU cars, set to expand globally, are raising significant privacy and security concerns among experts.
A newly discovered vulnerability allows attackers to rewrite signed Git commits, altering their hashes while maintaining valid signatures and GitHub's 'Verified' status, potentially deceiving reviewers.
A novel exploit chain named IonStack demonstrates a critical vulnerability in Android 17, allowing full device control with a single URL click by chaining two zero-day exploits.