Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,727 stories synthesized.
A vulnerability in OpenAI's Codex desktop app for macOS allows attackers to inject prompts that cause the app to fetch remote images containing sensitive data, leading to potential exfiltration.
The UK government has introduced a voluntary Cyber Resilience Pledge, securing 60 corporate signatories including major retailers and tech firms, aiming to elevate cybersecurity to board-level responsibility.
Kaspersky's latest report indicates a three-year low in blocked malware on industrial control systems, though specific regions and sectors, particularly biometric systems, continue to experience significant threats.
Cisco Talos reports on APT actor UAT-7810, which continues to develop and deploy custom malware, including new backdoors LONGLEASH, DOGLEASH, and JARLEASH, exploiting n-day vulnerabilities to build Operational Relay Box (ORB) networks.
Key findings • Nine Radare2 vulnerabilities disclosed between July 5-7, 2026, affecting versions up to 6.1.6. • Multiple integer overflow and buffer overflow vulnerabilities require local acc…
Microsoft will automatically enable its Windows settings backup and restore tool for enterprise devices upgrading to Windows 11 26H2, simplifying management and user experience.
Scammers are using generative AI to create photorealistic images of fantastical, non-existent flowers and selling their seeds on major online marketplaces, defrauding unsuspecting buyers.
A China-aligned espionage group has compromised U.S. and Canadian universities by chaining two Roundcube vulnerabilities to steal credentials and establish persistent access.
A sophisticated phishing campaign has been impersonating Facebook Business account verification to steal user credentials, MFA codes, and sensitive personal documents.
Multiple Tenda router models are vulnerable to CVE-2026-11405, an authentication backdoor allowing full administrative access without valid credentials.
A new framework envisions an AI scientist capable of automating the entire cybersecurity research lifecycle, from vulnerability discovery to report generation.
Companies are rapidly integrating AI tools without adequate security oversight, leading to a growing attack surface and potential data breaches.
BeyondTrust has disclosed critical vulnerabilities in its Remote Support and Privileged Remote Access solutions, enabling unauthenticated attackers to bypass access controls and gain elevated privileges.
Microsoft unveiled Microsoft Execution Containers (MXC), a new cross-platform layer designed to enforce runtime constraints on AI agents and applications, preventing malicious or unintended actions.
A critical path traversal vulnerability (CVE-2026-52830) in fast-mcp-telegram versions up to 0.19.0 allows unauthenticated attackers to access sensitive Telegram session files.
Mandiant details a method for attackers to recover active Active Directory Federation Services (ADFS) signing keys using Machine DPAPI, enabling the forging of high-privilege SAML tokens.
The 'Armored Likho' threat group is leveraging the 'BusySnake' infostealer to compromise critical infrastructure, including government agencies and electrical power entities, across Russia, Brazil, and Kazakhstan.
Canada's Communications Security Establishment (CSE) executed state-authorized cyberattacks against ransomware gangs, drug traffickers, and extremist organizations in 2025.
BonkDAO, the decentralized governance body for the BONK cryptocurrency, announced that attackers exploited a malicious governance proposal to steal approximately $20 million worth of BONK tokens.
A sophisticated phishing campaign is impersonating over 30 major brands, including Adobe, Netflix, and OpenAI, to trick marketing professionals into revealing their Google account credentials through fake job interview invitations.
Key findings • Four Denial of Service vulnerabilities in VLLM disclosed on July 6, 2026. • Vulnerabilities affect /v1/completions, structured outputs API, and speculative decoding. • Flaw…
Multiple U.S. Army websites were defaced through a 404 hijacking campaign, displaying pro-Kurdish messages and anti-Trump sentiments.
A critical 16-year-old use-after-free vulnerability in Linux's KVM hypervisor, CVE-2026-53359, dubbed 'Januscape,' enables guest virtual machines to escape to the host system on Intel and AMD x86 architectures.
A flaw in Google's Gemini Live API, stemming from misconfigured ephemeral tokens, allows attackers to inject tools and execute code within AI voice sessions.