Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,961 stories synthesized.
Dutch security firm Hadrian has released OpenHack, an MIT-licensed project that packages AI-powered vulnerability research into a file-based workspace compatible with coding harnesses like Claude Code, Codex, and Cursor.
Researcher H-mmer has open-sourced Pentest Agent Suite, a fully autonomous bug-bounty framework integrating 50 specialized security agents across seven AI coding platforms including Claude Code, OpenAI Codex, and Cursor.
A sophisticated supply chain campaign dubbed TrapDoor has compromised 34 packages across npm, PyPI, and Crates.io, targeting crypto, DeFi, Solana, and AI developers with credential-stealing malware.
Mandiant reveals a booming Chinese-language PhaaS ecosystem with real-time MFA bypass, AI-generated phishing pages, and digital wallet tokenization.
Mandiant reports active exploitation of a critical ViewState deserialization vulnerability in KnowledgeDeliver, a Japanese LMS, allowing unauthenticated remote code execution via hardcoded ASP.NET machine keys.
Wireshark 4.6.6 fixes one security vulnerability and 11 bugs, and updates Npcap to version 1.88 for Windows users.
A critical SQL injection vulnerability in Ghost CMS is being actively exploited in a large-scale campaign to inject malicious JavaScript and redirect users to fake CAPTCHA pages that deliver malware.
TeamPCP breached GitHub's internal codebase by poisoning a VS Code extension, while a critical NGINX vulnerability was actively exploited in the wild.
Hexastrike released PyrsistenceSniper, an open-source Python tool that detects 117 persistence mechanisms across Windows, Linux, and macOS by scanning offline disk images and forensic collections.
GitHub has made staged publishing generally available on npm, requiring maintainers to pass a 2FA challenge before a package version becomes publicly installable, alongside new install source flags.
A coordinated supply chain attack on Packagist infected eight Composer packages with malicious code that executes a Linux binary hosted on GitHub Releases, targeting JavaScript projects alongside PHP dependencies.
Italian police dismantled the CINEMAGOAL piracy app, which bypassed Netflix, Disney+, and Spotify by stealing authentication codes every three minutes, causing an estimated €300 million in lost revenue.
Four medium-severity memory corruption vulnerabilities were disclosed in the Free5GC Access and Mobility Management Function, all affecting NGAP message handlers with public exploits available.
A critical heap buffer overflow in NGINX's rewrite module, dubbed nginx-poolslip, allows unauthenticated remote attackers to cause denial of service or potentially execute code.
A maximum-severity vulnerability in the LiteSpeed User-End cPanel Plugin is being actively exploited, allowing any cPanel user to execute arbitrary scripts with root privileges.
Attackers compromised multiple Laravel-Lang PHP packages on Packagist, publishing over 700 malicious tags that deploy a sophisticated credential stealer targeting cloud tokens, crypto wallets, and browser data across Windows, Linux, and macOS.
Anthropic's Project Glasswing has discovered over 10,000 high- or critical-severity vulnerabilities in widely used software using its Claude Mythos AI model, marking a major leap in automated vulnerability research.
A ClickFix malware campaign on the Based Apparel merchandise page, co-founded by FBI Director Kash Patel, targeted macOS shoppers with a fake Cloudflare verification to deploy an infostealer.
The RondoDox botnet is exploiting CVE-2018-14714, a nearly decade-old unauthenticated remote code execution vulnerability in Asus routers, to compromise devices and launch DDoS attacks.
Over 1,350 active command-and-control servers were found across 98 Middle Eastern infrastructure providers, with Saudi Telecom Company alone hosting 72% of regional C2 infrastructure.
Russian threat groups including Sandworm, APT28, and Gamaredon dramatically escalated cyber operations in 2025, with CERT-UA recording 5,927 incidents—a 37.4% increase over 2024—using RDP exploitation, VPN vulnerabilities, supply chain attacks, and social engineering for initial access.
The art-template npm package was backdoored in a supply-chain attack delivering the Coruna iOS exploit kit, turning any site using the compromised package into a watering hole for Apple device owners.
A Russian-speaking threat actor used a jailbroken Google Gemini LLM to orchestrate a year-long crypto fraud campaign targeting MAGA and QAnon communities, emptying at least one victim's wallets.
The INJ3CTOR3 hacker group is targeting over 3,000 FreePBX VoIP systems with a novel PHP webshell called JOMANGY that uses six self-healing persistence layers to maintain access for toll fraud.