Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,569 stories synthesized.
Homebrew 6.0 introduces a new tap-trust mechanism and a Linux sandbox based on Bubblewrap, alongside a vulnerability scanning subcommand and performance improvements, while phasing out Intel macOS support.
Key findings • Apache disclosed 7 CVEs across Shiro, DolphinScheduler, and Airflow on June 17, 2026 • Five of the seven are authorization bypass flaws in Apache DolphinScheduler, all fixed in…
A new Malware-as-a-Service operation called ErrTraffic uses compromised WordPress sites to trick victims into running malicious PowerShell commands via fake CAPTCHA screens.
Fortra disclosed a critical OS command injection vulnerability (CVE-2026-9862) in its Core Privileged Access Manager (BoKS) that allows unauthenticated remote attackers to execute arbitrary commands.
Rockwell Automation released patches for multiple vulnerabilities across its Logix controllers, FactoryTalk suite, RSLinx software, and Flex I/O adapters, including critical authentication bypass and DoS flaws.
Rapid7 researchers identified a sophisticated campaign by the Dropping Elephant threat actor using a China energy-sector decoy and DLL side-loading via a legitimate Microsoft binary to deliver a heavily reworked in-memory RAT.
Researchers discovered a publicly exposed Elasticsearch cluster containing 24 billion credential records from infostealer logs, Telegram channels, and prior breaches, posing massive account takeover risks.
Android 17 launches on Pixel devices with enhanced security: anti-theft tools, scam detection, location privacy upgrades, and on-device AI threat monitoring.
Key findings • Nine CVEs disclosed on June 17, 2026 for the JetEngine WordPress plugin • Four unauthenticated SQL injection flaws, including CVE-2026-12360 via the listing_load_more AJAX hand…
Researchers uncovered 15 malicious JetBrains plugins stealing AI API keys and two Chrome ad-blocker extensions capturing AI chatbot conversations in a coordinated campaign.
Oracle released its June 2026 Critical Security Patch Update, the second monthly batch, addressing 245 vulnerabilities across major product families, including a PeopleSoft flaw exploited by the ShinyHunters group.
Google and Mozilla released security updates for Chrome and Firefox, fixing over 70 vulnerabilities including critical memory safety bugs that could lead to remote code execution.
Researcher pikpikcu released AIRecon, an autonomous penetration testing agent that runs entirely offline by combining a self-hosted Ollama LLM with a Kali Linux Docker sandbox, eliminating cloud data exposure.
Attackers hijacked a former contributor's npm account to publish malicious versions of 144 @mastra/* packages, deploying a cryptocurrency-stealing infostealer via a cloned dayjs library.
A critical vulnerability in LiteLLM proxy allows attackers to bypass authentication by manipulating the Host header, gaining unauthorized access to management endpoints.
Kodak has confirmed a security breach after the ShinyHunters extortion gang claimed to have stolen over 2.2 million records containing customer PII and internal corporate data.
A new Remote Access Trojan built on the Deno runtime is being delivered via mailbombing and fake Microsoft Teams calls impersonating IT support, evading endpoint detection.
Threat actors are abusing Anthropic's Claude and OpenAI's Codex AI coding assistants to automate reconnaissance, exploitation, and data exfiltration, compromising at least 14 organizations in a single campaign.
Microsoft has released AntiSSRF, a free open-source library under the MIT license, to help developers validate URLs and prevent server-side request forgery (SSRF) attacks in .NET and Node.js applications.
Key findings • All 40 malicious packages share the @mastra/ npm scope — a single-organization campaign • Every advisory was published within a 7-minute window (05:05–05:12 UTC) on 2026-06…
Key findings • 25 high-severity CVEs disclosed together on June 17, 2026, all fixed in Chrome 149.0.7827.155 • Multiple sandbox escape chains: renderer compromise can lead to full system acce…
A sophisticated multi-stage loader campaign dubbed OnionDrop has been active since February 2026, delivering LegionLoader, CGrabber Infostealer, and Vidar Stealer via a gainmsg C2 server.
Cybercriminals hijacked Google Ads searches for AI developer tools, redirecting over 2,000 victims to fake download pages via claude.ai shared chat links.
Key findings • 16 CVEs disclosed in a single coordinated batch on June 16, 2026 • Three prototype pollution CVEs form a chain from MS SQL node to Merge node to public webhooks • Credentia…