Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,568 stories synthesized.
SentinelLabs has discovered Gaslight, a Rust-based macOS backdoor tied to North Korea that uses 38 fabricated system messages to manipulate AI-powered analysis tools into misclassifying it as benign.
Key findings • 25 Jenkins plugins were affected by vulnerabilities disclosed on June 24, 2026. • Common themes include missing permission checks and cross-site request forgery (CSRF) across m…
Microsoft's Digital Crimes Unit, in coordination with Europol and industry partners, has disrupted the infrastructure behind the StealC infostealer and Amadey loader, taking down over 200 command-and-control domains and IPs.
NCC Group reports that Iran-linked MuddyWater is masquerading as the Chaos ransomware gang to conceal cyber espionage operations, blurring the line between criminal and state-backed activity.
XM Cyber discovered a privilege-escalation technique abusing macOS CDHash caching that allows standard users to silently disable CrowdStrike Falcon and Kandji MDM, with Apple reportedly declining to fix the underlying OS issue.
Jenkins released a security advisory on June 24, 2026, patching 18 plugins for vulnerabilities ranging from sandbox bypass and arbitrary code execution to CSRF and information disclosure.
Key findings • 25 CVEs disclosed together, all fixed in Capgo 12.128.2 (two in 12.128.12) • Multiple authentication and authorization bypasses, including 2FA bypass at the API level • Sub…
Key findings • Five vulnerabilities disclosed in Unclecode's Crawl4AI between June 21-24, 2026. • Multiple authentication bypass flaws including hardcoded JWT keys and unauthenticated monitor…
Initial access broker Woodgnat is deploying a new remote access trojan called Mistic to gain persistent footholds and resell access to ransomware groups including Qilin, Akira, and Black Basta.
Microsoft DART reveals that threat actor Storm-2603 is exploiting unpatched on-premises SharePoint servers to deploy ransomware and custom backdoors, with a second unknown actor simultaneously exfiltrating Active Directory credentials.
A new stealthy backdoor named Mistic has been tied to the initial access broker KongTuke, deployed against insurance, education, IT, and professional services organizations to enable ransomware attacks.
Kaspersky uncovered StrikeShark, a campaign deploying the new SharkLoader malware to deliver Cobalt Strike Beacon via exploits targeting Exchange, Openfire, GeoServer, and other internet-facing applications.
ReliaQuest's new report details six practical ways attackers are using AI to lower costs, speed up operations, and evade detection, from industrial-scale phishing to deepfake identity fabrication.
Anthropic's Claude Fable 5 autonomously produced a bootable NT-compatible Windows kernel in Rust, raising security implications for AI-authored critical infrastructure.
Google will now notify all administrators when any admin password is reset, expanding the Alert Center rule beyond super admins to improve privileged account oversight.
Cisco disclosed a critical SSRF vulnerability in Unified CM and Unified CM SME that lets unauthenticated attackers write arbitrary files and gain root privileges.
A SANS researcher published a proof-of-concept that spoofs both /proc//comm and /proc//cmdline, evading standard process-name detection.
Praxen, an open-source tool from Exabeam, implements Agent Behavior Verification to audit whether AI agents act within their declared policies, identifying drift and compliance gaps before and during deployment.
A new SQL injection flaw in Quest NetVault Backup's NVBUDashboard component, tracked as CVE-2026-9786 with a CVSS score of 8.8, allows authenticated attackers to bypass authentication and execute arbitrary code.
A critical SQL injection vulnerability in Quest NetVault Backup's NVBUDashboard component, tracked as CVE-2026-7570 with a CVSS score of 8.8, allows authenticated attackers to bypass authentication and execute arbitrary code.
A deserialization vulnerability in MosaicML Composer, tracked as CVE-2026-10043 with a CVSS score of 7.8, allows remote attackers to execute arbitrary code by tricking users into opening malicious checkpoint files.
A high-severity vulnerability in Fuji Electric Tellus allows local attackers to escalate privileges to SYSTEM via exposed dangerous methods in the pcid64 driver.
A critical SQL injection flaw in Quest NetVault Backup's NVBURemovableMedia component, tracked as CVE-2026-9783 with a CVSS score of 8.8, allows authenticated attackers to bypass authentication and execute arbitrary code.
A high-severity vulnerability in Fuji Electric Tellus allows local attackers to escalate privileges to SYSTEM via exposed dangerous methods in the pcid64 driver.