Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,727 stories synthesized.
A new Java-based remote access trojan, QuimaRAT, is being sold as a Malware-as-a-Service (MaaS), offering cross-platform compatibility for Windows, Linux, and macOS.
A vulnerability in Opera GX enabled malicious websites to silently install add-ons capable of stealing user data from visited pages without interaction.
A wave of malicious browser extensions and deceptive online advertisements are distributing malware, targeting users across multiple platforms and browsers.
A recent incident involving a compromised AI agent in finance underscores the critical need to assess AI agent security risks based on their potential business impact, not solely on their access levels.
Parrot OS 7.3 has been released, featuring optimized package builds for modern CPUs, a new Go-based menu system for on-demand tool installation, and official Vagrant boxes.
The new open-source Omnigent framework acts as a meta-harness for multiple AI coding agents, aiming to standardize credential handling and command execution to improve oversight and cost management for development teams.
Kaseya's 2026 SaaS Security Report highlights significant risks from unmanaged guest accounts, weak MFA, and insecure OAuth implementations in SaaS environments.
Criminals are increasingly leveraging AI and organized tactics to automate payment fraud, from credential stuffing to sophisticated impersonation scams, while consumers prioritize robust fraud protection.
Cisco Talos has released ClamAV versions 1.5.3 and 1.4.5, addressing seven security flaws, including heap buffer overflows and denial-of-service vulnerabilities, in its malware scanning engine.
The open-source T3MP3ST framework empowers AI coding agents to conduct autonomous red-teaming operations, finding zero-day vulnerabilities without new API keys.
A personal account of a significant financial loss underscores the risks associated with financial institutions and major tech companies not mandating multi-factor authentication (MFA).
Flipper Devices is restructuring its open-source firmware development for the Flipper Zero, introducing new rules for community contributions to manage feature requests and pull requests.
Anthropic's advanced AI model, Claude Mythos 5, capable of generating exploits and achieving privilege escalation, has been cleared for redeployment to US critical infrastructure after a government-imposed suspension.
Key findings • Four Linux kernel vulnerabilities disclosed on July 5, 2026, affecting af_unix, ipv6, and KVM subsystems. • CVE-2026-53361 addresses a race condition in af_unix garbage collect…
Key findings • Three Linux Kernel vulnerabilities disclosed on July 5, 2026, affecting af_unix, ipv6, and KVM subsystems. • CVE-2026-53361 involves a race condition in af_unix garbage collect…
Microsoft has issued KB5095189, a cumulative update specifically for the Windows 11 Out-of-Box Experience (OOBE) on versions 24H2 and 25H2, enhancing initial device setup stability.
A U.S. government entity reportedly paid $1 million to the Kairos group to prevent the leak of stolen data, highlighting a new extortion tactic that bypasses traditional ransomware encryption.
New research reveals fundamental flaws in attested TLS protocols used for confidential computing's remote attestation, enabling diversion and relay attacks that undermine trust.
Rapid7's Metasploit Framework receives a significant update, introducing modules for upgrading SMB sessions to Meterpreter, an RCE exploit for Peyara Remote Mouse, and a new payload for Linux loongarch64 systems.
Security researchers have disclosed seven vulnerabilities in the FatFs filesystem library, a component embedded in millions of devices, potentially allowing attackers to corrupt memory and execute code.
A critical use-after-free vulnerability in the Linux kernel, dubbed 'Bad Epoll' (CVE-2026-46242), enables unprivileged users to escalate privileges to root, impacting Linux systems, servers, and Android devices.
A sophisticated new modular malware framework named Avalon has emerged, combining extensive credential harvesting, lateral movement, and ransomware capabilities, including the CrownX variant, while employing advanced techniques to evade security defenses.
India's government has mandated Google and Apple to remove three apps allegedly misused to remotely disable e-rickshaws, citing passenger safety risks.
Organizations face escalating security risks as shadow IT evolves into shadow SaaS, shadow AI, and autonomous agents, overwhelming traditional governance models.