Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 6,164 stories synthesized.
Trend Micro's Q1 2026 threat intelligence report warns that U.S. government agencies and educational institutions are under unprecedented attack, with Salt Typhoon breaching Congress, ransomware surging, and state systems exposed.
Researchers at Unit 42 have discovered a critical IAM misconfiguration in the AWS Bedrock AgentCore starter toolkit that grants overly broad permissions, enabling a compromised AI agent to escalate privileges and access every other agent in the account.
A structural flaw in Google's API key system automatically grants existing keys access to Gemini AI endpoints, exposing over 500 million Android app installs to data theft and financial abuse.
A critical arbitrary file upload vulnerability (CVSS 9.8) in the Ninja in the Ninja Forms – File Upload Plugin for WordPress allows unauthenticated attackers to upload malicious files and achieve remote code execution, affecting versions up to 3.3.26.
Anthropic has launched Project Glasswing, an initiative using its Claude Mythos Preview LLM to autonomously discover and patch zero-day vulnerabilities in critical software, including a 27-year-old flaw in OpenBSD.
The US DoJ and FBI have neutralized a DNS hijacking network operated by Russian APT28 hackers that compromised SOHO routers across 23 states to steal credentials.
A remote code execution vulnerability in Apache ActiveMQ Classic, discovered with the help of Anthropic's Claude AI, went undetected for 13 for 13 years and is now patched.
CISA warns that Iranian-affiliated threat actors have been actively exploiting internet-facing Rockwell Automation PLCs since March 2026, disrupting government, water, and energy sectors across the United States.
GitLab released versions 18.10.3, 18.9.5, and 18.8.9 on April 8, 2026, patching multiple vulnerabilities including a critical WebSocket method exposure (CVE-2026-5173, CVSS 8.5) and two high-severity denial-of-service flaws.
Russian GRU hackers compromised over 18,000 end-of-life MikroTik and TP-Link routers to hijack DNS settings and intercept OAuth authentication tokens from Microsoft Office users, bypassing multi-factor authentication without deploying malware.
UK NCSC warns that Russian APT28 (Fancy Bear) is exploiting vulnerable SOHO routers to hijack DNS settings and steal credentials via adversary-in-the-middle attacks.
Researchers demonstrate GPUBreach, a GPU-based Rowhammer attack that corrupts GDDR6 memory to escalate privileges and gain root-level access across GPU and CPU environments.
Attackers are exploiting a novel vulnerability named GrafanaGhost to silently exfiltrate sensitive enterprise data from Grafana environments by chaining weaknesses in application logic and AI behavior.
The UK's National Cyber Security Centre has published an advisory detailing how Russian military intelligence group APT28 is exploiting vulnerable routers to conduct DNS hijacking attacks that intercept login credentials and access tokens.
The UK's NCSC has revealed that Russian state-sponsored APT28 has been exploiting small office/home office routers since 2024 to hijack DNS settings and conduct adversary-in-the-middle attacks targeting credentials for web and email services.
An independent security audit of WhatsApp's Private Inference feature, which uses AMD SEV-SNP and Nvidia TEEs to process encrypted messages with AI, found 28 vulnerabilities including 8 high-severity flaws that could have broken the system's privacy promises. Meta has patched all issues.
Microsoft reveals that the financially motivated threat actor Storm-1175 has been conducting rapid Medusa ransomware attacks since 2023, exploiting at least 16 vulnerabilities including the zero-day CVE-2025-10035 in GoAnywhere MFT.
Fortinet has released an emergency hotfix for a critical FortiClient EMS vulnerability, CVE-2026-35616, that is being actively exploited to allow unauthenticated remote code execution.
Threat actors continue to exploit a packaging error in Anthropic's Claude Code npm release to distribute Vidar, GhostSocks, and PureLog Stealer malware via fake GitHub repositories.
A critical arbitrary file upload vulnerability (CVE-2026-0740, CVSS 9.8) in the Ninja Forms – File Upload WordPress plugin allows unauthenticated attackers to achieve remote code execution on up to 50,000 sites.
Check Point Research has exposed TrueChaos, a campaign exploiting a zero-day vulnerability (CVE-2026-3502) in TrueConf's on-premises update process to push malicious updates and Havoc payloads to Southeast Asian government networks.
A type confusion vulnerability in Labcenter Electronics Proteus, tracked as CVE-2026-5496, allows remote code execution when users open malicious PDSPRJ files, and the vendor has confirmed the software is end-of-life with no patch available.
A zero-day vulnerability (CVE-2026-5494) in Labcenter Electronics Proteus allows remote code execution via malicious PDSPRJ files, but the vendor has declared the product end-of-life and will not issue a patch.
A zero-day out-of-bounds write vulnerability (CVE-2026-5495) in Labcenter Electronics Proteus allows remote code execution through malicious PDSPRJ file parsing, with no patch available as the product has been discontinued.