Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,960 stories synthesized.
Chinese state-aligned hackers have been using a Linux backdoor called 'Showboat' to spy on telecommunications providers in Central Asia, with evidence suggesting the malware is shared among multiple APT groups.
Researchers disclose Underminr, a domain-fronting attack exploiting CDN architecture to route malicious traffic through trusted domains, putting 42% of websites at risk.
Rapid7's Q1 2026 Threat Landscape Report reveals vulnerability exploitation overtook social engineering as the top initial access vector, with over 50% of exploited flaws being zero-click and network-facing.
A 2021 breach of the Myspace93 parody web art site has exposed plaintext usernames, passwords, email addresses, and IP addresses of over 46,000 users, according to HaveIBeenPwned.
A routine cached AWS access key on a single Windows machine could have exposed 98% of a company's cloud entities, highlighting identity-based attack paths from normal credential caching.
Google has patched over 200 Chrome vulnerabilities in recent releases marked as internally discovered, a surge the company attributes to AI-driven fuzzing and automated discovery tools.
Twenty-five vulnerabilities, five rated High severity, were disclosed for the open-source Netatalk AFP daemon on May 21, 2026, affecting versions from 1.3 through 4.4.2.
ASAPP has introduced Continuous Red Teaming, an adversarial AI testing capability built on Promptfoo that automatically screens for over 50 vulnerability types during development.
Microsoft has released emergency patches for two actively exploited zero-day vulnerabilities in Microsoft Defender, prompting CISA to order federal agencies to secure their systems.
A threat actor exploited a dormant 'zombie' account belonging to a former city employee to gain domain admin and SCADA access, disabling water system controls.
New research from Dreadnode demonstrates an AI agent that autonomously red-teams LLMs, converting natural-language goals into 674 executed attacks against Meta's Llama Scout in three hours with an 85% success rate.
A critical command injection vulnerability (CVE-2026-3517) in Progress Software's Kemp LoadMaster allows authenticated remote attackers to execute arbitrary code on affected appliances.
A command injection vulnerability in Progress Software's Kemp LoadMaster allows authenticated remote attackers to execute arbitrary code on affected appliances.
CISA has added CVE-2026-48172, a privilege escalation vulnerability in the LiteSpeed cPanel Plugin, to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation.
A solo Russian-speaking threat actor used a jailbroken Google Gemini to run a five-year influence and fraud campaign targeting American MAGA and QAnon communities via Telegram.
An international operation led by France and the Netherlands has dismantled First VPN, a service marketed on Russian-speaking cybercrime forums to help ransomware groups and other criminals hide their attacks.
Wordfence details a CyberPanel attack chain where SnappyMail logs were abused as a root-level backdoor to repeatedly inject redirect malware into WordPress sites.
Threat actors are brute-forcing credentials and bypassing multi-factor authentication on SonicWall Gen6 SSL-VPN appliances due to incomplete patching, deploying tools used in ransomware attacks.
Drupal released an emergency patch for a highly critical SQL injection vulnerability (CVE-2026-9082) in its database abstraction API, affecting all supported branches and potentially allowing anonymous attackers to execute arbitrary SQL on PostgreSQL sites.
CISA has added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, including decades-old flaws in Microsoft Windows and Adobe products, citing evidence of active exploitation.
Cisco has disclosed CVE-2026-20223, a CVSS 10.0 vulnerability in Secure Workload Cluster Software that lets unauthenticated attackers gain Site Admin privileges via crafted API requests.
CrowdStrike outlines the attack chain where infostealers like RedLine and Vidar harvest credentials, cookies, and tokens to bypass MFA and persist access.
Ukrainian authorities have identified an 18-year-old suspect in an international cybercrime operation that compromised nearly 30,000 customer accounts of a U.S.-based online retailer, causing over $250,000 in losses.
Discord has rolled out default end-to-end encryption for all voice and video calls, covering hundreds of millions of users across laptops, phones, and consoles.