Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,567 stories synthesized.
Ubiquiti has addressed 25 security vulnerabilities across its UniFi ecosystem, with several critical flaws rated 9.9 and 10.0 CVSS allowing for unauthenticated command injection and SQL injection.
Japanese telecommunications giant NTT has disclosed a cyberattack impacting an email system used by five internet service providers, potentially exposing 12 million customer email addresses.
A new vulnerability named 'GitLost' allows attackers to trick GitHub's AI Agentic Workflows into leaking private repository contents through prompt injection in GitHub Issues.
A new attack pattern, dubbed Cordyceps, exploits GitHub Actions workflows, bypassing standard security scanners and enabling attackers to compromise high-impact repositories.
Two critical vulnerabilities in PHP's PDO drivers, CVE-2026-25289 and CVE-2026-25290, allow SQL injection and denial of service, respectively. Both have been patched.
A critical session isolation flaw, dubbed WriteOut, in the enterprise AI platform Writer has been patched, preventing attackers from hijacking user accounts and accessing sensitive data across different tenants.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is reportedly using Anthropic's advanced AI model, Mythos, to scan federal government code repositories for vulnerabilities.
A DigiCert survey reveals that 78% of enterprises have experienced AI-related security incidents or vulnerabilities, largely due to poor governance and misconfigured AI agents.
Commvault introduces a novel AI-powered simulation tool, 'Commvault Minutes to Recovery,' enabling organizations to test their cyber resilience by acting as attackers and defending against AI-driven threats.
Key findings • Forty malicious RubyGems packages were disclosed on July 7, 2026. • All 40 advisories were published within a 25-minute window, indicating a coordinated campaign. • Many pa…
A widespread phishing campaign impersonates major brands, using fake recruiter emails and career pages hosted on legitimate services to steal Gmail credentials via a deceptive Browser-in-Browser attack.
Attackers are actively exploiting CVE-2026-48282, a critical path traversal vulnerability in Adobe ColdFusion, just days after patches were released.
Key findings • 16 malicious packages were disclosed on PyPI within a minute on July 7, 2026. • The packages included two distinct naming campaigns: 'pygremlinbox-malware-' (6 packages) and 'c…
Google has filed a lawsuit against a Chinese scam operation, Outsider Enterprise, for leveraging its Gemini AI to create sophisticated phishing websites and campaigns.
Spanish police, acting on an FBI tip, have arrested a man suspected of coordinating cyberattacks for pro-Russia hacktivist groups like CARR and NoName057(16), which target critical national infrastructure.
Attackers are exploiting Microsoft Teams calls and social engineering to trick victims into installing EtherRAT, a sophisticated cross-platform trojan.
A vulnerability in OpenAI's Codex desktop app for macOS allows attackers to inject prompts that cause the app to fetch remote images containing sensitive data, leading to potential exfiltration.
The UK government has introduced a voluntary Cyber Resilience Pledge, securing 60 corporate signatories including major retailers and tech firms, aiming to elevate cybersecurity to board-level responsibility.
Kaspersky's latest report indicates a three-year low in blocked malware on industrial control systems, though specific regions and sectors, particularly biometric systems, continue to experience significant threats.
Cisco Talos reports on APT actor UAT-7810, which continues to develop and deploy custom malware, including new backdoors LONGLEASH, DOGLEASH, and JARLEASH, exploiting n-day vulnerabilities to build Operational Relay Box (ORB) networks.
Key findings • Nine Radare2 vulnerabilities disclosed between July 5-7, 2026, affecting versions up to 6.1.6. • Multiple integer overflow and buffer overflow vulnerabilities require local acc…
Microsoft will automatically enable its Windows settings backup and restore tool for enterprise devices upgrading to Windows 11 26H2, simplifying management and user experience.
Scammers are using generative AI to create photorealistic images of fantastical, non-existent flowers and selling their seeds on major online marketplaces, defrauding unsuspecting buyers.
A China-aligned espionage group has compromised U.S. and Canadian universities by chaining two Roundcube vulnerabilities to steal credentials and establish persistent access.