Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 6,175 stories synthesized.
A coordinated supply-chain attack dubbed "Mini Shai-Hulud" hit 1,800+ npm and PyPI developers over multiple May 18 victim batches, targeting TanStack, SAP, Intercom, Mistral AI, Guardrails AI, Lightning, and hijacked OIDC tokens to sign malicious packages with valid provenance.
A 9-year-old Linux kernel privilege escalation vulnerability, CVE-2026-31431, allows any local user to gain root access with a 10-line exploit that works 100% of the time and leaves no disk trace.
Scammers are manipulating the subject line of legitimate PayPal payment notifications to trick recipients into calling fraudulent tech support numbers.
A new phishing-as-a-service platform called Bluekit provides over 40 realistic templates and an integrated AI assistant to help cybercriminals draft phishing emails, marking another step in the commoditization of AI-enhanced cybercrime tooling.
Wordfence reported 158 vulnerabilities in 123 WordPress plugins and 27 themes during the week of April 20–26, 2026, with 42 remaining unpatched and 6 rated critical severity.
Google has patched a critical remote code execution vulnerability in Gemini CLI that could allow attackers to compromise CI/CD pipelines via malicious workspace configuration files.
Threat actors compromised the PyTorch Lightning Python package and the Intercom npm/Packagist packages on April 30, 2026, as part of the ongoing Mini Shai-Hulud campaign to steal developer credentials.
Ukrainian authorities arrested three individuals for hacking over 610,000 Roblox accounts using infostealer malware distributed via social engineering lures promising in-game bonuses.
A high-severity local privilege escalation vulnerability in the Linux kernel's cryptographic subsystem, dubbed 'Copy Fail,' allows any local user to gain root access on virtually every major Linux distribution released since 2017.
Ukrainian authorities arrested three individuals in Lviv for stealing over 610,000 Roblox accounts, including 357 elite accounts, using infostealing malware disguised as game-enhancement tools.
The April 2026 KB5083769 security update for Windows 11 24H2 and 25H2 is breaking third-party backup software that relies on VSS snapshots, leading to timeouts and failures.
A new Python-based backdoor named Deep#Door uses obfuscated batch scripts and embedded payloads to evade detection on Windows systems, enabling long-term surveillance and credential theft.
A Brazilian DDoS mitigation company, Huge Networks, was unknowingly used as a platform for a botnet that launched massive DDoS attacks against Brazilian ISPs, exploiting TP-Link routers and misconfigured DNS servers.
Cloudflare has announced general availability of post-quantum encryption for its IPsec product, using hybrid ML-KEM per draft-ietf-ipsecme-ikev2-mlkem, with confirmed interoperability with Fortinet FortiOS 7.6.6+ and Cisco 8000 Series routers.
Canadian authorities arrested three men for operating an SMS blaster device that mimicked a cellular tower to send phishing texts, marking the first such case in the country.
A critical authentication bypass vulnerability in cPanel and WHM (CVE-2026-41940) has been exploited in the wild since at least February 23, with a patch released only on April 28.
Researchers have uncovered DEEP#DOOR, a Python-based backdoor that uses the bore.pub Rust-based tunneling service for C2 and steals browser, cloud, and system credentials from compromised hosts.
A high-severity local privilege escalation vulnerability named 'Copy Fail' in the Linux kernel's authencesn cryptographic template allows unprivileged users to reliably gain root access on virtually every major distribution shipped since 2017.
Atos TRC has uncovered a March 2026 campaign targeting enterprise admins and DevOps with malicious MSI installers disguised as PsExec, AzCopy, and Sysmon, using Ethereum smart contracts for takedown-resistant command and control.
TrendAI researchers have identified a new China-linked threat group, Shadow-Earth-053, that has compromised over a dozen critical networks across Poland and multiple Asian countries since December 2024, exploiting years-old Microsoft Exchange Server vulnerabilities.
Researchers have reverse-engineered Fast16, a state-sponsored malware likely of US origin, deployed against Iran years before Stuxnet, capable of silently sabotaging high-precision calculations and simulations.
A critical CRLF injection vulnerability in cPanel and WHM (CVE-2026-41940, CVSS 9.8) allows unauthenticated attackers to gain root access, with evidence suggesting exploitation as a zero-day for at least 30 days.
A high-severity Linux kernel LPE vulnerability, CVE-2026-31431, dubbed 'Copy Fail', allows unprivileged local users to gain root access on all major distributions shipped since 2017.
Google has fixed a critical vulnerability in the Gemini CLI npm package and GitHub Actions workflow that could allow unauthenticated attackers to execute arbitrary commands in CI/CD environments, while a separate bug in the Cursor AI coding tool also enables code execution via prompt injection.