Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,569 stories synthesized.
Cloudflare, Google Chrome, Microsoft Edge, and Mozilla Firefox are collaborating on Private Access Control Tokens (PACTs), a privacy-preserving protocol that lets websites issue anonymous tokens to distinguish legitimate traffic from abusive requests.
The Trump administration will sign executive actions Monday that push the federal civilian deadline for adopting quantum-resistant encryption forward to 2029 or 2030 and redirect CHIPS Act financing to boost the domestic quantum computing industry.
Key findings • Eight vulnerabilities disclosed on June 22, 2026, affecting IBM WebSphere Application Server and Liberty profile. • Vulnerabilities include Denial of Service, SSRF, HTTP Reques…
Microsoft outlines a defense-in-depth strategy to protect AI memory in Microsoft 365 Copilot from adversarial memory poisoning attacks that exploit asynchronous memory writes to trigger delayed tool execution.
Key findings • Four vulnerabilities in Dell Wyse Management Suite (WMS) disclosed on June 22, 2026. • Two SQL injection flaws (CVE-2026-44271, CVE-2026-44272) allow unauthorized remote access…
Cloudflare engineers spent six weeks tracking down a race condition in the Rust-based hyper HTTP library that caused silent truncation of large image transformations on the edge network.
Trail of Bits engineers paired with OpenAI's GPT-5.5-Cyber produced 64 pull requests and 51 issues across 19 essential open-source projects, with 37 patches already merged, in the first week of the new Patch the Planet initiative.
CrowdStrike's survey reveals 94% of organizations experienced a cloud breach in the past year, with 67% hit three or more times.
NetSPI researchers disclosed a technique that lets attackers bypass Microsoft Entra Conditional Access Policies by abusing Nested App Authentication to obtain Microsoft Graph tokens without MFA or device compliance checks.
Researchers disclosed four vulnerabilities in the open-source Dify platform, collectively named DifyTap, that allow unauthenticated attackers to read AI conversations across tenant applications.
Attackers are gaming GitHub, YouTube, and VirusTotal to build a fake trust profile for a cross-platform clipboard hijacker that replaces copied crypto wallet addresses to steal funds.
Check Point's weekly threat intelligence bulletin covers a third-party breach at Texas Parks and Wildlife exposing 3 million records, a Klue breach by the Icarus group stealing Salesforce OAuth tokens, and Microsoft's patch for the SearchLeak Copilot prompt injection.
Microsoft's DART investigation of a single intrusion revealed two unrelated threat actors—Storm-2603 and an unnamed second actor—operating in parallel within the same environment, complicating detection and attribution.
The Five Eyes intelligence alliance warns that advanced AI models capable of autonomous hacking will become publicly available within months, urging organizations to urgently strengthen foundational cybersecurity practices.
Microsoft is rolling out an update to Purview sensitivity labels that lets organizations block Copilot and all connected experiences from analyzing content in Word, Excel, and PowerPoint files.
Canadian utility London Hydro disclosed a data breach potentially exposing customer names, addresses, and account numbers, but has not revealed the attack vector or whether operational systems were affected.
A new PHP webshell named ZypeerShell has appeared on GitHub, marketed as undetectable and feature-rich, with a built-in GSocket deploy function for C2 communication and an obfuscated variant using Fortress Layer.
Flare researchers reveal a booming underground market where attackers pay for targeted searches of massive stolen credential databases, enabling precise account takeover without sifting through bulk dumps.
Key findings • Six Mattermost vulnerabilities disclosed on June 22, 2026, impacting core platform and plugins. • Improper permission checks allow User Managers to demote or deactivate bot acc…
A Heartbleed-style memory leak vulnerability in Squid Proxy, present since 1997, allows attackers to siphon sensitive user data from shared proxy environments.
Brazil's national emergency alert system was breached on June 20, sending a fake 'extreme alert' reading 'misantropi4' to devices across four states, prompting a Federal Police investigation.
Key findings • Two critical RCE vulnerabilities in MISP allow authenticated administrators to execute arbitrary code. • Three broken access control and mass assignment flaws enable unauthoriz…
This week's security roundup covers the FortiBleed campaign targeting 80K+ FortiGate devices, active exploitation of a critical Splunk Enterprise RCE flaw, and the Gentlemen RaaS operation's new EDR-killer framework.
GitHub released actions/checkout v7 with secure-by-default behavior that blocks 'pwn request' attacks abusing the pull_request_target event.