Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 6,172 stories synthesized.
Tech support scams are shifting tactics, moving beyond traditional fake virus alerts to leverage sponsored search results, fake listings, and renewal scams to ensnare victims.
The UK is amending its Cyber Security and Resilience Bill to empower ministers to block high-risk technology suppliers from critical infrastructure, responding to escalating supply chain threats.
Key findings • 14 Craft CMS vulnerabilities disclosed on September 2, 2026, ranging from Medium to Critical severity. • Multiple flaws in GraphQL API allow unauthorized site access and data m…
A new pro-Ukraine hacking collective, VantaCore, is actively targeting Russian companies with custom ransomware, demanding millions in ransom and marking a significant evolution in the cyber conflict.
Researchers confirm Pegasus and a new NoviSpy variant spyware infections targeting Serbian student activists, marking the largest documented surveillance wave in the country.
Senator Ron Wyden is calling on the NSA to provide clearer public guidance on the security limitations of commercial VPNs, particularly against sophisticated foreign adversaries.
Dropbox disclosed that approximately 5,000 user accounts were compromised in August due to attackers exploiting a weakness in its Lenovo ID sign-in integration.
Eight vulnerabilities in AI coding agents like Claude, Codex, and Cursor allow malicious Git configurations to execute attacker-controlled commands with user privileges.
Ransomware operators are employing a new, sophisticated command-and-control framework named TukTuk, designed to steal credentials, conduct surveillance, and disable security tools, according to recent analysis.
Two Russian fundraising projects supporting Ukrainians and political prisoners have suffered data breaches, exposing donor email addresses and partial payment card details due to a compromise of their payment processing integration.
Scammers are becoming more sophisticated, tailoring their attacks to specific platforms and leveraging the likeness of popular figures like MrBeast to increase success rates.
Rockwell Automation has released patches and workarounds for more than a dozen vulnerabilities affecting its industrial automation software and hardware, including critical flaws in RSLinx Classic.
A new Android banking trojan, StreamRat, has been distributed through malicious ads on Meta platforms, targeting Spanish-speaking users and capable of near-complete device control.
A public exploit is now available for CVE-2026-84115, an authentication bypass vulnerability in Freshworks' Cleo Harmony file transfer software, increasing the risk for unpatched systems.
Key findings • Five medium-severity authorization vulnerabilities disclosed together for Kimai time-tracking software. • Issues include bypasses in REST API timesheet collection and user pref…
Palo Alto Networks has acquired Console, an AI-native platform, to enhance its Cortex security operations portfolio and enable AI-driven workflows for autonomous threat investigation and remediation.
Jenkins has issued a critical security advisory detailing numerous vulnerabilities in its core software and a wide array of plugins, with several rated as High severity.
A Chinese-speaking cybercrime group, dubbed Gambling Goblin, is compromising Brazilian government and educational servers to host phishing pages that mimic app stores, pushing online gambling content and manipulating search engine results.
A recent investigation by Palo Alto Networks Unit 42 revealed an enterprise network breach executed autonomously by AI agents within a mere 10 hours, drastically compressing weeks of typical human-led intrusion efforts.
Hackers linked to the Silver Fox (Yinhu) campaign are compromising Windows systems by distributing fake software installers that disable Microsoft Defender and other security measures.
Conversations with AI chatbots like ChatGPT and Claude are being admitted as evidence in legal proceedings, raising privacy concerns for users.
Two chained vulnerabilities in GeoNetwork, an open-source geospatial metadata catalog, allow unauthenticated remote code execution, impacting government geoportals.
A Russian national extradited from Cyprus faces U.S. charges for allegedly leading a malware campaign that used fake freelance accounts to distribute malicious Excel attachments to thousands of users.
A cyberattack targeting grid-connected battery storage systems could convincingly mimic a malfunctioning controller, potentially leading to widespread power outages and significant economic damage.