Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,513 stories synthesized.
Decentralized prediction market Polymarket suffered a $3 million hack after attackers compromised a third-party vendor to inject a malicious script into the platform's frontend.
Researchers have tracked a Rust-based infostealer named KuinaExtractor that evolved across four development stages since December 2025, adding Telegram exfiltration, sandbox detection, and multiple UAC bypass techniques.
Fortra researchers have uncovered Mirage2FA, a phishing kit that combines HTML smuggling with obfuscated JavaScript to deliver fake Microsoft 365 login pages and steal credentials during MFA prompts.
A supply-chain attack campaign named Miasma has been discovered hiding malicious payloads in over 20 npm packages, using a binding.gyp file and the Bun runtime to steal developer credentials and cloud secrets.
A malware loader disguised as a fake Minecraft Fabric mod has compromised over 116,000 systems since January 2026, using Ethereum smart contracts and RSA signatures for resilient command-and-control.
ZeroTier released RC2 of its ZeroTier Quantum platform, the final testing milestone before general availability of its post-quantum secure networking solution.
A new open-source tool from Ohio State University, Burnyard, performs malware analysis entirely on the analyst's machine, preventing samples from being uploaded to public repositories where attackers can detect discovery.
Microsoft has extended the Windows 10 Extended Security Updates program for consumers by an additional year, now covering critical patches through October 12, 2027.
Key findings • 25 CVEs disclosed in a single batch on June 26, 2026 • Bluetooth RFCOMM and BNEP bugs allow remote out-of-bounds reads • Netfilter nft_fib leak can expose kernel stack data…
Key findings • Eight vulnerabilities disclosed for Vim on June 26, 2026, patched in version 9.2.0699. • Vulnerabilities affect spell checking, text properties, Python completion, file encrypt…
Qihoo 360 claims its AI bug-finder 'Tulongfeng' outperforms Anthropic's Mythos model, using a multi-agent swarm approach to discover long-dormant vulnerabilities.
Polish authorities arrested four members of an organized cybercrime group accused of SIM-swapping attacks that stole millions in cryptocurrency, with help from the FBI and HSI.
Microsoft warns of an active campaign since April 2026 targeting hospitality organizations in Europe and Asia with photo-themed ZIP archives delivering a Node.js implant via phishing emails abusing Calendly and Google redirects.
Unit 42 identifies a Chinese-speaking threat actor targeting government entities and critical infrastructure in Southeast Asia with a custom backdoor named TinyRCT.
Russia's FSB-linked Gamaredon group has upgraded its malware loading techniques and server obfuscation, making detection harder and requiring organizations to adopt new defenses.
CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-12569 in PTC Windchill and FlexPLM and CVE-2026-20230 in Cisco Unified Communications Manager, both actively exploited.
The FCC voted Thursday to mandate strong passwords, patching, and firewalls for the Emergency Alert System and Wireless Emergency Alerts, while simultaneously overhauling decades-old undersea cable regulations to tighten supply-chain security.
Threat actors are injecting fake purchase receipts into the popular Shopify order-tracking app Shop to launch callback phishing attacks, according to Gen Digital research.
Key findings • Thirteen vulnerabilities disclosed for pnpm on June 25, 2026, including ACE, info disclosure, and supply chain risks. • Multiple CVEs detail arbitrary code execution via path t…
Microsoft's foundational Secure Boot certificates have begun expiring as of June 24, 2026, affecting over a billion UEFI-capable devices and Linux distributions, with critical security update implications.
CISA warns of multiple vulnerabilities in EVoke Systems' Charging Station Management System, including a missing authentication flaw that could let attackers take remote control of electric vehicle charging stations worldwide.
CISA published an advisory for CVE-2026-12897, a high-severity out-of-bounds read vulnerability in Horner Automation Cscape versions prior to 10.2 SP3 that could allow local attackers to execute arbitrary code.
CISA disclosed a high-severity vulnerability in Yokogawa's FAST/TOOLS and CI Server that leaks sensitive configuration data in cleartext, potentially aiding further attacks.
CISA disclosed three vulnerabilities in Schneider Electric's PowerLogic P7 protection and control platform, including an OS command injection flaw that could allow unauthorized privileged command execution.