Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,569 stories synthesized.
OpenAI has expanded its Daybreak cybersecurity initiative, combining AI models and Codex Security to help organizations identify, validate, and fix software vulnerabilities.
Fortra warns that attackers are abusing Outlook Groups and Microsoft 365 collaboration features to make phishing campaigns appear routine.
Healthcare AI company Xsolis disclosed a data breach affecting nearly 1.4 million individuals after a targeted phishing attack in January exposed personal and medical information.
Researchers developed EVOHUNT, a system that evolves a plain-text playbook to guide AI agents, achieving a 11.3% vulnerability detection rate against Codex Security's 9.2% for just $1,400.
Spur Intelligence found that 34% of scanned smart TV apps on LG webOS and Samsung Tizen contain residential proxy SDKs, turning home connections into proxy exit nodes without clear user consent.
A financially motivated threat actor has deployed the custom Golang tool FortigateSniffer across over 430,000 FortiGate firewalls globally, harvesting more than 110 million credentials since February 2026.
Ransomware group World Leaks published over 200,000 files from Tata Electronics, including confidential Apple iPhone specs and Tesla engineering drawings, exposing critical supply-chain risks.
OpenAI released GPT-5.5-Cyber, its strongest vulnerability-finding model, and launched Patch the Planet with Trail of Bits to secure open-source projects.
A SANS ISC audit of 14 patched SonicWall firewalls reveals that 12 still harbor stale local accounts and 11 never rotated passwords after firmware upgrades, explaining why Akira and Fog ransomware groups continue exploiting CVE-2024-40766 two years after the patch.
Microsoft reports that North Korean threat actor BlueNoroff compromised a Mastra npm maintainer account and published over 140 malicious packages targeting AI development environments.
The open-source CVE Lite CLI, endorsed by OWASP, now audits dependency overrides for stale or broken entries that silently leave transitive vulnerabilities unpatched.
Key findings • Eleven DoS vulnerabilities disclosed simultaneously for OpenLink Virtuoso-opensource 7.2.11. • All vulnerabilities are triggered by crafted SQL statements targeting various int…
Key findings • CISA added two actively exploited Ubiquiti Inc vulnerabilities to the KEV catalog on June 23, 2026. • CVE-2026-34908 and CVE-2026-34909 are confirmed under active in-the-wild e…
Trend Micro researchers detail a cryptomining campaign exploiting CVE-2026-33017, an unauthenticated RCE vulnerability in the Langflow AI workflow tool, exposing the pivot from targeting traditional infrastructure to AI application endpoints.
OpenAI released an updated GPT-5.5-Cyber vulnerability-finding model, expanded its Daybreak partner program, and launched Patch the Planet to help secure 30 open-source projects.
A global malware campaign is hijacking WhatsApp accounts to send malicious VBScript files disguised as business documents, ultimately installing remote access trojans via the legitimate ManageEngine Endpoint Central tool.
OpenAI announced the Daybreak Cyber Partner Program, enabling 30 cybersecurity vendors and service providers to integrate GPT-5.5 into customer-facing security products for the first time.
Unit 42 researchers disclosed a bucket hijacking technique that exploits globally unique bucket names across AWS, Azure, and Google Cloud to silently reroute data streams to attacker-controlled storage.
An attacker tricked the JaredFromSubway Ethereum MEV bot into approving $15 million in withdrawals by injecting fake trading opportunities that exploited the bot's automated arbitrage logic.
Key findings • Ten vulnerabilities disclosed in MessagePack C# on June 22, 2026. • Issues include denial-of-service via excessive memory allocation and CPU exhaustion. • Security bypasses…
Four vulnerabilities in the open-source AI platform Dify allow attackers to silently access and exfiltrate sensitive AI chat histories, researchers warn.
FFmpeg version 8.1.2 fixes CVE-2026-8461, a high-severity heap out-of-bounds write in the MagicYUV decoder that can enable remote code execution on Jellyfin servers and denial-of-service across dozens of media applications.
A typosquatted npm package mimicking a popular CSS tool delivers a full-featured Windows RAT that uses RC4-encrypted HTTP C2, registry persistence, and Chrome credential theft.
A phishing campaign targeting Indian users delivers Remcos RAT via a malicious GST debit note attachment, using in-memory execution and .NET Bitmap steganography to evade detection.