Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,961 stories synthesized.
CISA warns of multiple critical vulnerabilities in ABB Ability Camera Connect due to an outdated VLC media player component, with CVSS scores up to 9.8.
CISA issued an advisory for CVE-2025-9970, a high-severity cleartext storage vulnerability in ABB LVS MConfig that could allow local attackers to extract plaintext passwords from memory dumps.
CISA published an advisory for CVE-2025-5517, a heap-based buffer overflow in ABB Terra AC wallbox chargers that could let attackers remotely control the device and alter firmware via crafted OCPP messages.
Iranian state-linked group MuddyWater targeted nine organizations across nine countries in Q1 2026 using DLL side-loading to deliver malware and steal data.
Lithuanian prosecutors are investigating a major breach of the state Centre of Registers, where attackers stole over 600,000 records including personal and property data, with suspicions of Russian involvement.
Google Threat Intelligence Group identifies a dozen mature Chinese-language PhaaS offerings that primarily target non-Chinese organizations, signaling a shift in the global phishing landscape.
Microsoft Defender for Endpoint automatically isolates compromised workstations upon detecting high-confidence ransomware or sophisticated attacks, cutting network access while preserving telemetry.
Malwarebytes uncovers a campaign using fake installers for ChatGPT, Claude, and other software on GitHub and SourceForge to deliver the DinDoor RAT, which leverages the Deno runtime for stealth.
A rapidly expanding ransomware operation codenamed NightSpire has compromised at least 64 organizations across 33 countries since March 2025, relying on trusted remote administration tools like Chrome Remote Desktop and AnyDesk for stealthy persistence.
Microsoft is testing a new automatic endpoint isolation feature in Defender for Endpoint that cuts compromised devices off from the network while maintaining security monitoring.
A cyberattack on 7-Eleven exposed personal data of approximately 185,000 people, with the ShinyHunters extortion gang claiming responsibility and leaking a 9.4 GB archive.
A timing side-channel vulnerability in Memcached's SASL authentication, CVE-2026-47783, allows attackers to infer valid usernames, lowering the barrier for brute-force attacks.
The open-source tool DockSec, now an OWASP incubator project, correlates findings from Trivy, Hadolint, and Docker Scout and uses an LLM to produce plain-English remediation and exact Dockerfile patches.
Microsoft patched CVE-2026-45659, a high-severity remote code execution vulnerability in SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.
CVE-2026-44930 in Apache CXF's XKMS service allows LDAP injection, enabling attackers to extract arbitrary digital certificates from vulnerable systems.
A high-severity vulnerability in ConnectWise Automate (CVE-2026-9089) allows attackers to bypass integrity checks during agent plugin loading and self-updates, enabling remote code execution without user interaction.
Attackers are bypassing push-based MFA by flooding users with authentication requests until they accept, exploiting fatigue and social engineering rather than technical flaws.
Check Point Research's March-April 2026 AI Threat Landscape Digest reveals criminal operators using Claude Code and GPT-4.1 to compromise nine Mexican government agencies, alongside the weaponization of agentic config files as persistent jailbreak vectors.
Two former executives of a call tracking company admitted to selling phone infrastructure to Indian tech support scammers impersonating Microsoft and Apple.
Apple released the first beta of tvOS 26.6 to developers, including unspecified security patches alongside the usual testing cycle.
Apple released the first beta of visionOS 26.6 to developers, promising security patches alongside new features for the Vision Pro headset.
India's CERT-In has issued new guidelines requiring organizations to patch critical vulnerabilities in internet-exposed systems within 12 hours, citing the need to counter AI-assisted cyber threats.
Researchers at ESET have identified BTMOB, a new Android RAT sold as a malware-as-a-service platform that includes a no-code APK builder, enabling attackers to rapidly generate targeted phishing lures with minimal technical skill.
A new ransomware strain called Payload has been active since February 2026, targeting Windows systems globally with per-file encryption using ChaCha20 and Curve25519 ECDH.