Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,965 stories synthesized.
Key findings • A coordinated drop of 40 malicious npm packages was simultaneously disclosed and removed on May 28, 2026. • The campaign targeted two specific scopes: '@cloudplatform-single-sp…
Google Threat Intelligence Group warns that Chinese-language phishing-as-a-service platforms are using AI, encrypted messaging, and real-time OTP interception to bypass MFA and provision stolen payment cards into attacker-controlled digital wallets worldwide.
Six vulnerabilities, including two rated High severity, were disclosed on May 27, 2026, in Microsoft's open-source UFO intelligent automation framework, spanning session hijacking, privilege escalation, path traversal, and OS command injection.
Fifteen vulnerabilities spanning command injection, authentication bypass, symlink attacks, and data races were disclosed on May 27, 2026, in Mcdope's Pam Usb Linux authentication module, with fixes available in version 0.9.1.
A SANS diary demonstrates how defenders can reconstruct an Akira ransomware intrusion from initial access to encryption using only SSLVPN syslog and Windows EVTX logs, without EDR or memory captures.
Group-IB uncovered a Chinese-speaking threat actor operating over 300 fake FIFA domains with a custom React phishing kit, targeting 2026 World Cup fans.
The long-running Grandoreiro banking trojan has resurfaced with sophisticated campaigns targeting Portuguese banks and companies across Spain, Mexico, and Latin America using DLL side-loading and cloud platform abuse.
Elastic Security Labs reveals how the Tycoon 2FA Phishing-as-a-Service kit defeats multi-factor authentication on Microsoft Entra ID and Google Workspace by stealing session tokens via reverse proxy.
CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog on May 27, 2026, including two supply-chain style malicious code flaws in Daemon Tools Lite and Nx Console, plus an unspecified bug in TanStack.
Eighteen security vulnerabilities in the open-source Budibase low-code platform were disclosed on May 27, 2026, including a critical SCIM auth bypass (CVSS 9.9) and multiple SSRF flaws, all fixed in versions 3.39.0 and earlier.
A sophisticated npm supply chain attack published 22 versions of the 'forge-jsxy' package in 22 days, deploying a persistent backdoor that steals cryptocurrency wallet keys, browser credentials, and sensitive data across Windows, macOS, and Linux.
Six high-severity vulnerabilities hit Kirby CMS on May 26–27, 2026, spanning XSS, path traversal, permission bypass, and arbitrary method call — all patched in versions 5.4.1 and 4.6.1.
Key findings • CISA added CVE-2026-48027, a Nrwl vulnerability, to the KEV catalog on May 27, 2026. • The flaw is confirmed under active exploitation and tied to ransomware campaigns. • F…
Twenty vulnerabilities, four with CVSS 10.0, were disclosed in the open-source Free5gc 5G core network, all fixed in version 4.2.2.
Tenable Research's graph-based model linking 600+ threat groups to vulnerabilities across 7,800 customer environments reveals that 68% of organizations carry at least one CVE previously exploited by a named adversary.
A leak allegedly exposing 5.8 million records of Uruguayan citizens has been linked to Latin American cybercriminals who systematically target government agencies to monetize stolen citizen data.
Microsoft uncovered a cryptojacking campaign that poisons LLM-based AI chatbot recommendations to steer users toward malicious download sites for popular utilities, deploying miners and remote access tools.
Attackers are using AI to dramatically reduce the time needed to develop working exploits for CVEs, outpacing traditional vulnerability scanners and accelerating the weaponization of disclosed flaws.
Researchers discovered a malicious npm package, 'mouse5212-super-formatter,' that exfiltrates files from Anthropic Claude's dedicated user data directory to a threat actor-controlled GitHub account.
A hidden preinstalled system app called Smart Feed on Motorola smartphones intercepts Amazon app launches and silently redirects them through affiliate tracking URLs, injecting affiliate codes without user consent.
A critical vulnerability in Starlette, tracked as CVE-2026-48710, allows attackers to bypass authentication on FastAPI-based AI infrastructure by crafting malicious HTTP Host headers.
Jenkins disclosed 13 vulnerabilities across 11 plugins on May 27, 2026, including two High-severity flaws enabling remote code execution and arbitrary file reads.
IBM disclosed 25 vulnerabilities across a dozen product lines on May 27, 2026, including critical buffer-overflow bugs in Aspera High-Speed Transfer and a critical RCE in Langflow.
A critical Windows kernel vulnerability, CVE-2026-40369, allows unprivileged processes to achieve deterministic SYSTEM-level privilege escalation from browser sandboxes without race conditions or heap spraying.