Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,179 stories synthesized.
Drupal core has released a critical security advisory (SA-CORE-2026-014) for a remote code execution vulnerability in the Field UI module, with multiple exploit paths, some unauthenticated.
Microsoft has released an out-of-band update to resolve critical issues with Remote Desktop Services, shared folder access in Linux VMs, and USB audio devices, which were introduced by earlier September security patches.
Key findings • 25 vulnerabilities disclosed simultaneously for Go Gitea on October 14, 2026. • High-severity flaws include privilege escalation and workflow bypasses. • Multiple vulnerabi…
Siemens released 17 ICS advisories, while Rockwell Automation patched a critical flaw in its ArmorBlock devices allowing unauthorized takeover.
The United Kingdom has imposed sanctions on the cryptocurrency platform Cryptomus for its role in processing illicit payments linked to ransomware, darknet markets, and other cybercrime services that aid Russia in circumventing financial restrictions.
Key findings • 25 Linux kernel vulnerabilities disclosed on October 14, 2026, affecting diverse subsystems. • Fixes address critical areas including RDMA, Wi-Fi drivers, memory safety, and po…
An attack in France exploited vulnerabilities in outdated IoT software to manipulate refrigeration units, causing some to overheat.
Cybercriminals are impersonating WatchGuard's VPN download portal to trick users into revealing their login credentials before providing the legitimate software.
A threat group with suspected ties to Kazakhstan, known as UAT-6275, has been actively targeting government organizations across the Commonwealth of Independent States (CIS), with a particular focus on water resources and energy sectors.
Russian travel booking platform Anydayanyway has suspended all reservations due to a cyberattack, preventing customers from booking tickets and hotel rooms.
Microsoft, alongside international partners, has successfully dismantled a large Chinese-language phishing kit ecosystem operated by the threat group Storm-2990, which generated over 1 billion phishing messages targeting 75,000 organizations globally.
A Russian influence operation, dubbed 'Dark Clark,' is employing AI-driven tactics to spread disinformation and sow political division across Latin America, targeting educational institutions and local politics.
Cloudflare has detailed a rare MySQL caching bug in its Hyperdrive database connection pooler, stemming from character set encoding negotiation problems.
Curl has fixed a critical use-after-free vulnerability in its HTTP/2 upload handling that could allow a malicious server to achieve client-side code execution.
Organizations can proactively defend against sophisticated voice-cloned deepfake attacks by conducting structured readiness drills that test and refine verification processes.
Threat actors are using sophisticated phishing pages disguised as Calendly interview scheduling tools to steal Facebook and Google credentials, including two-factor authentication codes.
A new Android banking trojan, Hirudo, circumvents security by replacing legitimate banking applications with specially patched versions designed to bypass built-in checks.
A comprehensive security audit of 25 popular package managers by Trail of Bits has uncovered significant integrity issues, leaving many vulnerable to supply-chain attacks.
An AI penetration testing agent autonomously identified and demonstrated a critical authentication bypass vulnerability on a major insurer's live production website, highlighting AI's growing offensive security capabilities.
VirusTotal now allows users to query threat intelligence data within ChatGPT, streamlining malware analysis through a conversational interface.
Radware introduces MCP Server Protection to secure the increasing adoption of its Model Context Protocol as AI agents integrate more deeply with enterprise applications and workflows.
Chainguard Harness introduces an AI-driven approach to finding and fixing exploitable vulnerabilities in running applications, utilizing advanced models like Anthropic's Claude Mythos 5.1.
XBOW researchers leveraged GPT-5.6 AI agents to discover a complex, full-chain exploit for Google Chrome in just six days, earning a $250,000 bounty from Google.
Microsoft has patched CVE-2026-85851, a critical Windows SmartScreen vulnerability enabling local privilege escalation via a use-after-free flaw.