Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,567 stories synthesized.
A sophisticated phishing campaign has been impersonating Facebook Business account verification to steal user credentials, MFA codes, and sensitive personal documents.
Multiple Tenda router models are vulnerable to CVE-2026-11405, an authentication backdoor allowing full administrative access without valid credentials.
A new framework envisions an AI scientist capable of automating the entire cybersecurity research lifecycle, from vulnerability discovery to report generation.
Companies are rapidly integrating AI tools without adequate security oversight, leading to a growing attack surface and potential data breaches.
BeyondTrust has disclosed critical vulnerabilities in its Remote Support and Privileged Remote Access solutions, enabling unauthenticated attackers to bypass access controls and gain elevated privileges.
Microsoft unveiled Microsoft Execution Containers (MXC), a new cross-platform layer designed to enforce runtime constraints on AI agents and applications, preventing malicious or unintended actions.
A critical path traversal vulnerability (CVE-2026-52830) in fast-mcp-telegram versions up to 0.19.0 allows unauthenticated attackers to access sensitive Telegram session files.
Mandiant details a method for attackers to recover active Active Directory Federation Services (ADFS) signing keys using Machine DPAPI, enabling the forging of high-privilege SAML tokens.
The 'Armored Likho' threat group is leveraging the 'BusySnake' infostealer to compromise critical infrastructure, including government agencies and electrical power entities, across Russia, Brazil, and Kazakhstan.
Canada's Communications Security Establishment (CSE) executed state-authorized cyberattacks against ransomware gangs, drug traffickers, and extremist organizations in 2025.
BonkDAO, the decentralized governance body for the BONK cryptocurrency, announced that attackers exploited a malicious governance proposal to steal approximately $20 million worth of BONK tokens.
A sophisticated phishing campaign is impersonating over 30 major brands, including Adobe, Netflix, and OpenAI, to trick marketing professionals into revealing their Google account credentials through fake job interview invitations.
Key findings • Four Denial of Service vulnerabilities in VLLM disclosed on July 6, 2026. • Vulnerabilities affect /v1/completions, structured outputs API, and speculative decoding. • Flaw…
Multiple U.S. Army websites were defaced through a 404 hijacking campaign, displaying pro-Kurdish messages and anti-Trump sentiments.
A critical 16-year-old use-after-free vulnerability in Linux's KVM hypervisor, CVE-2026-53359, dubbed 'Januscape,' enables guest virtual machines to escape to the host system on Intel and AMD x86 architectures.
A flaw in Google's Gemini Live API, stemming from misconfigured ephemeral tokens, allows attackers to inject tools and execute code within AI voice sessions.
Exploitation attempts for a critical Gitea Docker image vulnerability (CVE-2026-20896) have been observed just 13 days after its public disclosure, highlighting the rapid pace of threat actor activity.
Cybercriminals are increasingly leveraging sophisticated AI-generated images to lend credibility to financial scams, fake dating profiles, and fraudulent fundraising appeals, making visual verification unreliable.
Frost & Sullivan's 2025 Frost Radar™ for Cloud Security Posture Management highlights a market shift from compliance tools to integrated risk-based governance within CNAPPs, projecting significant growth.
A new Go-based ransomware strain, 'The Gentlemen,' is rapidly spreading across networks using a sophisticated worm engine and 21 remote execution techniques, targeting organizations globally.
A new indirect prompt injection technique embeds hidden text on malicious websites to manipulate AI agents into unauthorized actions, including cryptocurrency payments.
Insignary Clarity's new platform analyzes compiled software to ensure accurate Software Bills of Materials (SBOMs), addressing regulatory gaps and prioritizing vulnerabilities based on exploitability.
A critical Use-After-Free vulnerability (CVE-2026-57992) in Microsoft Edge allows remote attackers to execute arbitrary code by tricking users into visiting a malicious webpage.
Rich Communication Services (RCS), the successor to SMS, utilizes DNS NAPTR records to dynamically locate its servers, enabling modern IP-based communication.