Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,567 stories synthesized.
Cybercriminals are employing sophisticated social engineering tactics, using a verified X ad to distribute Mac malware and a new technique called ConsentFix to hijack Microsoft 365 accounts.
BerylliumSec's open-source Nebula platform brings AI-powered vulnerability assessment and exploit script generation directly into the command-line interface for penetration testers.
Montenegrin authorities, with FBI assistance, arrested an Iranian national accused of orchestrating cyberattacks against over 150 U.S. universities, causing billions in damages that allegedly benefited Iranian state entities.
The FBI has issued a warning about TeamPCP, a threat group compromising developer tools like Trivy and KICS to steal cloud credentials, SSH keys, and Kubernetes secrets in large-scale supply chain attacks.
A new partnership between the Vect ransomware group and the TeamPCP credential theft collective signals a significant shift towards industrialized cyber-attacks, raising alarms among cybersecurity experts and law enforcement.
Flock's surveillance cameras can now identify vehicles using unique 'Vehicle Fingerprints' derived from decals and stickers, enabling law enforcement to track vehicles even without license plate data.
Apple's upcoming iOS 27 will feature 'Trust Insights,' an on-device framework designed to detect and alert users in real-time about social engineering scams by analyzing behavioral patterns.
A new advanced persistent threat group, Armored Likho, is actively targeting government and electric power entities in Russia, Brazil, and Kazakhstan with a sophisticated campaign utilizing a custom infostealer and AI-generated initial payloads.
Key findings • 21 CVEs disclosed across Apache ActiveMQ, Tomcat, Shiro, Kerby, and HttpComponents between June 26 and July 3, 2026. • Multiple denial-of-service vulnerabilities affect Apache …
Key findings • Four vulnerabilities disclosed in Erlang/OTP on July 3, 2026, impacting SSL/TLS and SFTP components. • CVE-2026-53422 allows authenticated SFTP users to enumerate files outside…
Key findings • Six vulnerabilities disclosed across GNOME ecosystem components, primarily GLib and GIMP. • GLib vulnerabilities include out-of-bounds reads, path traversal, and state confusio…
Key findings • Six ClamAV vulnerabilities disclosed simultaneously on July 3, 2026, affecting file format parsers. • Vulnerabilities primarily lead to Denial-of-Service (DoS) conditions due t…
Key findings • 25 vulnerabilities disclosed on July 3, 2026, for Google Chrome, all fixed in version 150.0.7871.46. • Flaws span multiple components including V8, ANGLE, Dawn, Skia, and Tint,…
Three high-severity vulnerabilities in WatchGuard Firebox OS allow authenticated attackers to achieve arbitrary code execution and file writes via management interfaces.
North Korean threat actors are leveraging the PolinRider campaign to inject malicious JavaScript loaders into popular open source ecosystems, including npm, Packagist, and Go modules.
A new macOS information stealer, PamStealer, has been discovered by Jamf Threat Labs, impersonating the Maccy clipboard manager and exploiting Pluggable Authentication Modules (PAM) to steal user credentials.
Intezer has launched Custom Agents, allowing security teams to build their own AI agents within the Intezer platform to automate unique security tasks and workflows.
A new study analyzing SSH honeypots reveals a significant shift in attacker tactics, with non-interactive commands making up over 99% of post-login sessions.
A researcher leveraged Anthropic's Claude AI to exploit an unauthenticated SQL injection in Front Gate Tickets, gaining administrative control over major US music festival ticketing.
A former European Parliament member, Stelios Kouloglou, was repeatedly infected with Pegasus spyware while serving on a committee investigating the misuse of such surveillance tools.
Digi International introduces DANI, an AI-powered network operations agent embedded in its Digi Remote Manager (DRM) platform, to automate diagnostics and improve network visibility.
A developer was unexpectedly charged over $11,000 by Google Cloud for AI image generation after their account was hijacked via a compromised Firebase service account key.
Video conferencing startup MeetingTV is suing Palo Alto Networks' Koi Security, alleging an AI-generated threat report falsely linked the company to Chinese espionage, leading to global service disruptions.
Researchers at Palo Alto Networks have successfully reverse-engineered and integrated WebAuthn authentication into a browser-based RDP client, enabling passwordless access via hardware security keys.