Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,965 stories synthesized.
A JavaScript backdoor campaign targeting energy, automotive, and government finance organizations in Eastern Europe is being powered by bulletproof hosting providers GHOSTYNETWORKS and OMEGATECH.
An access control flaw in Gitea's container registry (CVE-2026-27771) allowed unauthenticated attackers to pull private container images from over 30,000 self-hosted deployments, risking exposure of source code and credentials.
Fortinet researchers have uncovered a new variant of the PureLogs information-stealing malware that uses process hollowing through the legitimate Microsoft build tool MsBuild.exe to evade endpoint security products.
Researchers have disclosed a critical pre-authentication SQL injection vulnerability in Roundcube Webmail that allows unauthenticated attackers to manipulate backend databases, exposing sensitive email data and credentials.
Microsoft is rolling out a Secure Boot certificate refresh ahead of the June 2026 expiration of three 2011-dated certificates, warning that devices that don't transition may lose future boot-level security protections.
Carnival Corporation confirmed a data breach affecting nearly 6 million people, claimed by the ShinyHunters extortion gang after a social engineering attack in April 2026.
A convincing fake ChatGPT download site, openew[.]app, is distributing credential-stealing malware to Windows users and Atomic Stealer (AMOS) to macOS users, targeting passwords, cryptocurrency wallets, and browser data.
Cisco Talos researchers have disclosed a heap overflow vulnerability in the Orthanc DICOM server that can be triggered by uploading a specially crafted DICOM file, potentially compromising hospital PACS systems.
Attackers are artificially inflating npm download counts by publishing hundreds of benign package versions, using automated bot traffic to trick developers into trusting and installing malicious payloads.
ESET's latest APT Activity Report reveals state-sponsored campaigns by Chinese, North Korean, Russian, and Iranian groups targeting oil shipments, drone manufacturers, and a poisoned code library.
ESET's latest APT Activity Report reveals Lazarus compromised the axios npm library, Sandworm deployed new wipers against a Polish energy firm, and China-aligned groups shifted targets amid geopolitical upheaval.
Veeam has patched a high-severity local privilege escalation vulnerability in Backup & Replication that could let attackers with limited access gain administrative control over enterprise backup systems.
Microsoft warned that six zero-day vulnerabilities—including RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma—were publicly disclosed without coordinated vulnerability disclosure, exposing users to exploitation before patches were ready.
Two critical arbitrary code execution flaws in Notepad++ let attackers run malicious programs by injecting commands into configuration files, patched in version 8.9.6.1.
A new threat actor tracked as JINX-0164 is targeting cryptocurrency firms with fake recruiter lures and custom macOS malware to steal digital assets and compromise CI/CD pipelines.
A cybercrime gang has been distributing a cryptocurrency miner through fake video player plugin updates on pirated movie and TV show streaming sites since at least 2022, affecting sites with up to 27.4 million monthly visitors.
State Bank of India has issued an urgent fraud alert warning customers of a social engineering campaign that uses fake SMS, WhatsApp, and email messages claiming the YONO app will be deactivated unless victims update their Aadhaar number via a malicious link or APK file.
Key findings • Twelve vulnerabilities disclosed for Keycloak between May 27-28, 2026. • One high-severity vulnerability (CVE-2026-9796) allows privilege escalation via scope mapping. • Se…
Help Net Security highlights notable open-source cybersecurity tools for May 2026, including Pipelock, an AI agent firewall that restricts shell access and network calls to prevent credential exfiltration.
A high-severity TOCTOU vulnerability in TrendAI's Apex One NT RealTime Scan service lets low-privileged attackers escalate to SYSTEM rights on affected systems.
A high-severity origin validation vulnerability in TrendAI Vision One Security Agent lets local attackers with low privileges escalate to SYSTEM rights on affected systems.
A high-severity origin validation vulnerability in TrendAI Vision One Security Agent lets local attackers with low privileges escalate to SYSTEM rights on affected systems.
Attackers are exploiting CVE-2026-35616 in FortiClient EMS to deploy a previously undocumented credential stealer, EKZ Infostealer, targeting enterprise endpoints.
Key findings • A total of 40 malicious packages were simultaneously removed from the npm registry on May 28, 2026. • The attack targeted three distinct enterprise-themed scopes: @cloudplatfor…