Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,726 stories synthesized.
Key findings • Three GitLab vulnerabilities disclosed simultaneously on July 8, 2026, affecting CE and EE. • CVE-2026-13320 allows arbitrary script execution due to improper input sanitizatio…
Block, Inc., the parent company of Cash App, has agreed to a $45 million settlement with state attorneys general over allegations of inadequate security measures and misleading users about the app's protections.
Key findings • Three Litellm vulnerabilities disclosed on July 8, 2026, including two rated 'important'. • CVE-2026-59819 allows information disclosure via local file read in the test connect…
A sophisticated, long-running operation by the threat actor Lurking Lizard has been discovered, turning unsuspecting users' devices into proxy nodes by distributing malware disguised as legitimate software, most notably a fake 7-Zip installer.
A new report highlights the challenges in understanding and combating the decentralized, adolescent-driven cybercrime collective known as Scattered Spider.
The Paris Peace Forum has established the Integrated Network for Trusted AI in Cyberspace (INTAiC) to foster global collaboration and research on AI-related cybersecurity risks.
A sophisticated campaign uses fake Indian tax notices to deliver two distinct Remote Access Trojans (RATs) through a complex six-stage infection process, exploiting DLL search order abuse and polyglot files.
Sophos researchers observed AI coding agents like Claude Code and Cursor inadvertently triggering endpoint security alerts by performing actions that resemble malicious activity.
Microsoft details its internal Secure Future Initiative (SFI), a multi-agent AI system designed to proactively identify and remediate complex vulnerabilities in its cloud infrastructure at unprecedented speed.
DuckDuckGo's browser now automatically blocks YouTube ads by integrating community-maintained filter lists, enhancing privacy and reducing the attack surface.
Taiwanese prosecutors have charged two businessmen accused of leasing popular LINE messaging app accounts to Chinese intelligence operatives for espionage purposes.
A threat actor is using voice phishing to trick Microsoft 365 users into enrolling a fake Entra passkey, aiming to compromise accounts.
SentinelOne identifies a critical security gap in US Federal Government High-Performance Computing (HPC) AI infrastructure, arguing current NIST standards are insufficient for AI workloads.
Key findings • Ten PAN-OS vulnerabilities disclosed simultaneously on July 8, 2026, ranging from low to high severity. • High-severity CVE-2026-0288 in User-ID TSA allows for potential arbitr…
A novel 'HalluSquatting' attack leverages AI coding assistants' tendency to invent non-existent project names, tricking them into downloading and executing malicious code.
Anthropic's Claude Cowork feature now allows users to manage AI sessions remotely from mobile devices, introducing new security considerations for persistent AI workflows.
CrowdStrike has identified five new prompt injection techniques that represent a significant evolution in attacks against AI agents, moving beyond simple chatbot manipulation to more complex methods that embed malicious instructions within data.
The Banana RAT banking trojan is leveraging an exposed backend server to generate polymorphic malware variants, significantly complicating detection and defense efforts.
Artificial intelligence is significantly enhancing the sophistication and effectiveness of social engineering attacks targeting service desks, particularly during employee onboarding.
A critical vulnerability dubbed 'GhostApproval' allows AI coding assistants to bypass sandboxes using symbolic links, potentially leading to remote code execution and SSH key injection.
Censys has updated its Internet Map to include real-time DNS visibility, allowing security teams to directly correlate domains with their underlying internet infrastructure.
A new botnet, dubbed Mycelium Framework, is being marketed as an AI-as-a-Service, allowing criminals to rent computing power from compromised machines for advanced AI tasks.
Blackpoint Cyber's new AI SOC Agent autonomously detects and contains credential-based attacks targeting Microsoft 365 and Google Workspace in under two minutes.
First Recon AI introduces its AI Security Runtime platform, offering enterprises a way to govern and secure AI interactions with audit-ready evidence.