Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 6,126 stories synthesized.
Key findings • 17 Dovecot vulnerabilities disclosed on August 28, 2026, ranging from Low to Critical severity. • Critical flaw CVE-2026-42007 involves use-after-free in mail editing via Sieve…
Security researcher Olivier Laflamme has disclosed two independent vulnerabilities, CVE-2026-76639 and CVE-2026-76640, that allow root remote code execution on Unitree G1 EDU humanoid robots, with one flaw being exploitable over Bluetooth Low Energy.
A sophisticated phishing campaign is targeting academic researchers with a fake student resume designed to deliver the SNOWLIGHT and VShell remote-access trojans.
Rubrik CEO Bipul Sinha highlights a growing enterprise demand for integrated platforms that manage AI agent identities, provide visibility into their actions, and enable robust recovery capabilities.
CISA's latest review reveals that common, long-standing vulnerability classes like injection flaws and improper input validation remain the most exploited, highlighting a critical gap in software development practices.
ServiceNow has released patches for four critical vulnerabilities in its AI Platform, three of which carry a CVSS score of 10.0 and could allow unauthenticated attackers to execute arbitrary code and perform SQL injection attacks.
Suspected North Korean remote workers are increasingly infiltrating legitimate companies by posing as sales, marketing, and even medical professionals, presenting a novel challenge for cybersecurity defenses.
Mathematicians and AI researchers convened to assess AI's current and future role in mathematical discovery, concluding that while AI excels at problem-solving, true theoretical novelty remains a human domain, for now.
Two undocumented factory implants, SPEAKINGSTONE and DARKLANTERN, discovered in ZBT router firmware allow unauthenticated attackers to gain root access and execute commands.
Leaked documents from Bauman Moscow State Technical University reveal a GRU cyber training program that appears to feed personnel into notorious APT28 and Sandworm units.
Cisco research indicates that country-of-origin labels for AI models are insufficient, as upstream dependencies can obscure true lineage and potential security risks.
A critical vulnerability in the popular GiveWP WordPress plugin allows unauthenticated attackers to achieve remote code execution with a CVSS score of 10.0.
Android 17 introduces significant network security enhancements, including default support for Encrypted Client Hello (ECH), to shield users from Wi-Fi tracking and web snooping.
A new backdoor, HOOKEDGE, linked to the APT28 threat group, has been deployed against European government and diplomatic organizations, utilizing batch scripts and webhook services for command and control.
Key findings • 25 Linux kernel vulnerabilities disclosed on August 28, 2026, affecting diverse subsystems. • Issues range from improper validation and buffer overflows to race conditions and …
Researchers demonstrate a multi-step prompt injection attack that bypasses Claude Code Opus 5's Auto Mode safeguards, leading to arbitrary code execution.
A deep dive into 23.5 million malicious files from Malware Bazaar highlights the continued prevalence of 32-bit Portable Executable (PE) files and significant challenges in identifying their origins.
Running open-weight AI models on-premises introduces significant, often underestimated, operational costs and security responsibilities that demand careful planning, especially for teams with limited resources.
PaperCut is urging customers to apply an emergency patch or take servers offline following active exploitation of a zero-day vulnerability in its NG and MF print management products.
Key findings • 25 WordPress plugins disclosed with vulnerabilities between August 27-28, 2026. • Critical vulnerabilities include RCE and PHP Object Injection in plugins like Tutor LMS, Hash …
Threat actors are leveraging overlooked Active Directory Service Principal Name (SPN) misconfigurations, dubbed 'Ghost SPN,' to conduct stealthier Kerberoasting attacks, potentially leading to privilege escalation.
A critical vulnerability (CVE-2026-65643) in cPanel and WHM allows low-privileged authenticated users to gain root-level control of a server by exploiting the domain parking functionality.
Key findings • Six Wazuh vulnerabilities disclosed on August 28, 2026, affecting versions 4.0.0 through 4.14.6. • Critical CVE-2026-61800 allows remote code execution as root via cluster key …
Key findings • Seven critical and high-severity vulnerabilities disclosed on August 28, 2026, affect Cisagov CSAF products. • Vulnerabilities include missing authentication, command injection…