Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,965 stories synthesized.
Anthropic released a free security-guidance plugin for its Claude Code terminal tool that reviews code edits, model outputs, and commits in real time to catch vulnerabilities before they reach production.
Ten vulnerabilities — nine SQL injection and one cross-site scripting — were disclosed across three Itsourcecode PHP applications between May 24 and May 27, 2026, with public exploit code already available.
GitHub released GHES 3.20.3 fixing a critical pre-authentication SSRF vulnerability (CVE-2026-9312) and two high-severity Linux kernel privilege-escalation bugs collectively known as 'Dirty Frag.'
GitLab has issued urgent security updates to address multiple vulnerabilities in its Community and Enterprise Editions that could lead to unauthorized access and privilege escalation.
Israeli cybersecurity firm Gambit Security attributes the March 2025 LA Metro payment disruption to Iranian state hackers posing as hacktivists.
Four improper-access-control vulnerabilities were disclosed in JeecgBoot on May 26, 2026, affecting versions up to 3.9.1, with public exploits available and a fix in version 3.9.2.
Apple patched seven CVEs across macOS Tahoe 26, Sequoia 15.7, and Sonoma 14.8 on May 26, including two high-severity bugs that could let a malicious app gain root privileges.
Apple shipped fixes for three medium-severity CVEs on May 26, addressing logic and permissions flaws that could let an app access sensitive user data across macOS Tahoe, Sequoia, and Sonoma.
The Oncology Institute, a publicly traded cancer care provider, notified the SEC that patient data was compromised in a 2025 breach involving a third-party billing software vendor.
Microsoft Defender Experts uncovered a targeted cryptojacking campaign that uses SEO poisoning and AI chatbot interactions to deliver malware disguised as system utilities, then abuses ScreenConnect for persistent remote access.
A wave of 19 vulnerabilities spanning six Sourcecodester products — including SQL injection, XSS, CSRF, and unrestricted upload flaws — was disclosed between May 23 and May 26, 2026, with public exploits already available.
Charter Communications confirmed a data breach after the ShinyHunters extortion group threatened to leak stolen customer data unless a ransom is paid.
Apple released its quantum-resistant cryptographic implementations and the formal verification tools used to prove their correctness, making them publicly available for industry-wide review.
Analysis of the TeamPCP threat actor behind the Shai-Hulud worm reveals a group whose success stems more from opportunistic targeting of weak configurations than from advanced technical skill.
A batch of 15 CVEs was disclosed against the open-source DDoS detection tool FastNetmon Community Edition, including three critical-severity BGP parsing bugs and unauthenticated command injection.
Microsoft released an out-of-band security patch for SharePoint Server addressing a critical privilege escalation vulnerability that could expose sensitive enterprise data.
CrowdStrike disrupted the Glassworm botnet, which targeted software developers by distributing malware through fake npm packages to steal credentials and mine cryptocurrency.
IBM disclosed eight CVEs for HTTP Server 8.5 and 9.0 on May 26, including a Critical unauthenticated RCE bug and six High-severity flaws spanning buffer overflows, DoS, and mTLS-specific code execution.
Nvidia disclosed 16 vulnerabilities on May 26, 2026, spanning GPU Display Drivers, vGPU software, and the Transformers4Rec AI library, with seven rated High severity.
MyPillow has been named as a victim by the Play ransomware group, which threatens to leak stolen data including client documents and payroll unless a ransom is paid.
Microsoft patched a high-severity vulnerability in Visual Studio Code that let attackers embed hidden malicious settings inside MCP server install links, granting persistent code execution on developer machines.
High-severity flaws in the Angular Language Service VS Code extension allow remote code execution via JSDoc hover injection and insecure tsdk configuration loading.
The Joomla Project disclosed 18 vulnerabilities on May 26, 2026, including six critical-severity bugs spanning SQL injection, local file inclusion, privilege escalation, and unauthorized webservice access.
A new Linux malware called Quasar Linux (QLNX) is targeting developers and DevOps engineers with fileless execution and an eBPF rootkit, stealing SSH keys and cloud credentials.