Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,946 stories synthesized.
Key findings • 25 vulnerabilities disclosed together for the Android SDK on June 1, 2026. • CVE-2025-48595, a high-severity zero-day, is reportedly under limited, targeted exploitation. •…
Key findings • Four Android vulnerabilities disclosed on June 1st, 2026, all enabling privilege escalation. • High-severity CVE-2026-0097 allows remote privilege escalation via Bluetooth LE p…
Spanish National Police have arrested an individual for leaking sensitive personal data of government employees, impacting key state organizations like the National Cybersecurity Institute (INCIBE).
Key findings • Ten high-severity vulnerabilities disclosed in FlexRIC v2.0.0 on June 1st, 2026. • Most vulnerabilities stem from assertion failures and improper input validation. • Exploi…
A critical cybersecurity vulnerability database run by NIST has become ineffective due to significant processing backlogs and mismanagement, an internal watchdog report revealed.
Security researchers have documented over 5,000 election-themed domains registered in April and May, alongside thousands of leaked credentials, posing significant risks for phishing and misinformation campaigns targeting the upcoming US midterm elections.
Key findings • Five vulnerabilities in IBM WebSphere Application Server and IBM i Access Family disclosed on June 1, 2026. • Three critical vulnerabilities (CVE-2026-9319, CVE-2026-9311, CVE-…
Key findings • 25 Nextcloud vulnerabilities disclosed simultaneously on June 1, 2026. • High severity flaws include SQL injection in the Tables app and calendar access bypass. • Multiple …
OpenAI has implemented a mandatory passkey requirement for users in its Trusted Access for Cyber (TAC) program to secure access to its most advanced AI models.
A critical remote code execution vulnerability, CVE-2026-8633, in IBM WebSphere's Web Server Plug-ins allows unauthenticated attackers to achieve full system compromise.
A malware campaign has compromised nearly 2,000 WordPress websites by using Steam Community profile comments as a command-and-control mechanism to hide malicious payloads.
A critical PHP object injection vulnerability in the Mirasvit Cache Warmer plugin for Magento and Adobe Commerce allows unauthenticated attackers to achieve remote code execution.
A critical CORS misconfiguration in MCP Toolbox allows attackers to exploit DNS rebinding, potentially exposing enterprise database connectors to unauthorized access.
A firmware regression in Cloudflare's Gen12 bare-metal fleet caused boot times to balloon from minutes to hours due to inefficient UEFI network interface polling.
Meta is rolling out enhanced fraud detection and content moderation systems to combat a surge in World Cup-themed phishing, counterfeit ticket sales, and hospitality scams.
A new Android banking trojan dubbed OverlayPhantom is targeting users across ten countries by abusing Accessibility Services to steal credentials from over 180 financial applications.
A critical unauthenticated privilege escalation vulnerability in the Kirki WordPress plugin, tracked as CVE-2026-8206, allows attackers to take over administrator accounts.
Check Point's weekly threat intelligence report covers Carnival Corp's 6M-record breach, Charter Communications' ShinyHunters leak, AI-driven attacks by GREYVIBE, exploited PAN-OS and Ghost CMS flaws, and more.
A fake website impersonating the BlueWallet Bitcoin wallet tricks Mac users into running a malicious AppleScript that steals passwords, browser logins, cryptocurrency wallets, and performs clipboard hijacking.
Attackers hijacked GitHub Actions OIDC tokens to backdoor over 30 official @redhat-cloud-services npm packages, deploying a credential-stealing worm variant of the Mini Shai-Hulud malware family.
Key findings • Four high-severity vulnerabilities disclosed together for Praisonai platform on June 1, 2026. • CVE-2026-47412 allows any workspace member to delete the entire workspace. •…
A data breach at Atlas Menu, a cheat service for GTA V and CS2, leaked 64,000 email addresses, bcrypt-hashed passwords, and Rockstar Games account identifiers after an attacker dumped the database on GitHub.
This week's cybersecurity roundup covers active exploitation of a PAN-OS flaw, a critical unpatched Gogs RCE, the takedown of the GlassWorm C2 operation, and AI-powered attacks against Ukraine.
depthfirst has introduced Dependency Firewall, a product that inspects every open-source package download across an organization and blocks malicious dependencies before they reach developers or AI agents.