Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,567 stories synthesized.
A novel exploit chain named IonStack demonstrates a critical vulnerability in Android 17, allowing full device control with a single URL click by chaining two zero-day exploits.
As passkeys become the norm, cybercriminals are shifting from credential stuffing to compromising identity verification and recovery processes for account takeovers.
Japanese telecom giant KDDI has disclosed a significant data breach impacting over 12 million individuals, with attackers accessing an email platform and exposing email addresses and passwords.
Researchers discovered that GitHub Copilot can be tricked into generating malicious code by breaking down requests into seemingly innocuous steps within its code editor interface, bypassing chat-based safety filters.
A joint Five Eyes intelligence alliance statement highlights the growing threat of AI in cybersecurity, warning that advanced AI models are rapidly diminishing the need for deep technical skill to launch sophisticated attacks.
Trail of Bits' open-source mutation testing engine, Mewt, now supports DAML, improving the assessment of test suite effectiveness for Canton Network applications.
Key findings • Seven vulnerabilities disclosed across multiple Perl modules including DBI, String::Util, and Mojo::JSON. • Issues range from denial-of-service and code injection to heap overf…
A significant majority of WordPress websites are running outdated PHP versions, leaving them vulnerable to known exploits and cyberattacks.
Automox MCP Server 2.2 introduces visual review capabilities and AI-driven patch policy creation, offering IT teams more contextual and trustworthy control over endpoint operations.
ESET's latest report reveals over 25,000 malicious AI skills designed to steal data, execute malware, and manipulate AI agents, significantly expanding the AI attack surface.
A new AI cybersecurity clearinghouse, mandated by executive order, aims to coordinate vulnerability discovery and patching in critical infrastructure, but faces challenges in accelerating the slow process of fixing and deploying patches.
ESET's H1 2026 threat report highlights the rapid growth of AI skills, the emergence of AI-powered Android malware like PromptSpy, and evolving phishing tactics including record quishing levels.
Ubiquiti has released urgent security updates for its UniFi OS, patching seven critical vulnerabilities, including a maximum-severity flaw that allows for command injection attacks.
A newly released stack simulator tool from SANS instructor Xavier Mertens aims to demystify stack memory operations crucial for malware analysis and reverse engineering.
A 15-year-old Linux kernel vulnerability, dubbed GhostLock, has been disclosed, allowing any logged-in user to achieve root privileges and escape containerized environments on unpatched systems.
A wave of new open-source cybersecurity tools is emerging, addressing critical areas from AI security and vulnerability research to container security and penetration testing.
A new benchmark, MacAgentBench, reveals that macOS is becoming a significant platform for AI agents performing automated tasks, though current impressive performance often relies on pre-written scripts.
A critical denial-of-service vulnerability (ZDI-26-403) in Ollama allows unauthenticated remote attackers to crash the application by exploiting improper validation of array indexes in the downloadBlob function.
A critical denial-of-service vulnerability (ZDI-26-401) in AnyDesk allows local attackers with low-privileged code execution to crash affected installations.
A critical vulnerability in Glarysoft Glary Utilities allows local attackers to escalate privileges to SYSTEM by abusing a file deletion function.
A critical improper certificate validation vulnerability (ZDI-26-399) in Lorex 2K Indoor Wi-Fi Security Cameras allows network-adjacent attackers to execute arbitrary code on affected devices.
Key findings • Two "important" vulnerabilities (CVSSv3 7.1 and 7.5) disclosed in Gstreamer on July 7-8, 2026. • Heap out-of-bounds write in rfbsrc/librfb (CVE-2026-59691) and stack buffer ove…
GitLab has issued urgent patch releases (19.1.2, 19.0.4, 18.11.7) to address several security flaws, including critical Cross-Site Scripting and HTML Injection vulnerabilities.
Global IT services giant Accenture has confirmed a data breach after a threat actor claimed to have exfiltrated 35 GB of source code and other sensitive data, which is now being offered for sale.