Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,568 stories synthesized.
Threat actors are injecting fake purchase receipts into the popular Shopify order-tracking app Shop to launch callback phishing attacks, according to Gen Digital research.
Key findings • Thirteen vulnerabilities disclosed for pnpm on June 25, 2026, including ACE, info disclosure, and supply chain risks. • Multiple CVEs detail arbitrary code execution via path t…
Microsoft's foundational Secure Boot certificates have begun expiring as of June 24, 2026, affecting over a billion UEFI-capable devices and Linux distributions, with critical security update implications.
CISA warns of multiple vulnerabilities in EVoke Systems' Charging Station Management System, including a missing authentication flaw that could let attackers take remote control of electric vehicle charging stations worldwide.
CISA published an advisory for CVE-2026-12897, a high-severity out-of-bounds read vulnerability in Horner Automation Cscape versions prior to 10.2 SP3 that could allow local attackers to execute arbitrary code.
CISA disclosed a high-severity vulnerability in Yokogawa's FAST/TOOLS and CI Server that leaks sensitive configuration data in cleartext, potentially aiding further attacks.
CISA disclosed three vulnerabilities in Schneider Electric's PowerLogic P7 protection and control platform, including an OS command injection flaw that could allow unauthorized privileged command execution.
CISA disclosed a critical path traversal vulnerability in the open-source pydicom pynetdicom library, allowing unauthenticated remote attackers to write files to arbitrary paths, with a CVSS score of 9.1.
CISA disclosed two high-severity vulnerabilities in H.VIEW HV-500S6 IP cameras that could allow authenticated attackers to execute arbitrary code and upload malicious files.
CISA disclosed CVE-2026-12473, a high-severity SSRF vulnerability in the OHIF DICOM Web Viewer Framework that could let attackers steal authenticated clinicians' OIDC bearer tokens via crafted links.
CISA disclosed a high-severity deserialization vulnerability in Delta Electronics DTM Soft that could let attackers execute arbitrary code on industrial control systems.
CISA disclosed three vulnerabilities in Daktronics Controller Firmware that could let unauthenticated attackers gain root-level control of digital display controllers used worldwide.
A new macOS malware variant named Gaslight embeds prompt injection strings and fake debugging data to confuse LLM-based analysis tools into misclassifying the sample as benign.
The U.S. DOJ seized a Huione Group cloud account linked to cybercrime; Aztec suffered a second $2M exploit; and a HyperFund promoter pleaded guilty in a $1.8B fraud case.
Law enforcement agencies led by the Alliance for Creativity and Entertainment seized 44 domains used by the PirloTV sports piracy network, which generated over 950 million visits annually, dealing a blow to illegal streaming just ahead of the FIFA World Cup.
Apple released Xcode 26.6 (17F113) with security updates addressing vulnerabilities in the development toolchain, urging developers to update immediately.
The Bluekit phishing-as-a-service platform has evolved with nearly 70 new hostnames and now uses browser-in-the-middle techniques to intercept login credentials and session tokens in real time.
Security researchers discovered that the 'Adblock for YouTube' Chrome extension, with over 10 million users, contains a dormant JavaScript injection capability that could be remotely activated to steal data.
Symantec reveals a new backdoor called Mistic, deployed since April 2026 and linked to the initial access broker Woodgnat, targeting multiple sectors with stealthy, memory-resident capabilities.
A 25-year-old authentication bypass flaw in cURL, present since version 7.7 from 2001, has been patched in curl 8.21.0 alongside a record 18 CVEs, including critical bugs discovered by AI-powered security platforms.
A new LokiBot campaign uses a JScript email attachment to initiate a multi-stage infection chain, stealing credentials from over 100 applications via process injection into aspnet_compiler.exe.
A newly discovered adversary-in-the-middle phishing kit targets Amazon Web Services users by live-relaying credentials and MFA tokens to the attacker's server, bypassing multi-factor authentication protections.
This week's ThreatsDay roundup covers a 24-year-old curl vulnerability, smart TVs turned into proxyware, AI-powered crime forums, and 13 other security stories.
Ukraine's state postal operator Ukrposhta reported a cyberattack disrupting its mobile app, with a pro-Russian group claiming responsibility.