Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,960 stories synthesized.
A cyberattack on the Canvas educational platform by the ShinyHunters gang forced universities across the U.S. to reschedule final exams after attackers defaced the site and exploited a vulnerability in "Free-For-Teacher" accounts.
A campaign of 28 fraudulent Android apps, downloaded over 7.3 million times, tricked users into paying for fake call history data before being removed from the Google Play Store.
Cisco Talos researchers have uncovered a new modular malware campaign that exploits the Microsoft Phone Link application to steal one-time passwords and SMS messages from compromised Windows PCs.
The RansomHouse cybercrime group has claimed responsibility for a breach of Trellix's source code repository, prompting an ongoing investigation by the cybersecurity firm.
Pro-Ukraine hacktivist groups BO Team and Head Mare are increasingly coordinating their cyber operations against Russian and Belarusian targets, according to new research from Kaspersky.
Microsoft has officially classified the Microsoft Edge browser's practice of keeping the entire password vault in plaintext memory as an intentional design choice, despite security concerns regarding credential harvesting.
Meta is reversing its commitment to end-to-end encryption on Instagram, opting to remove the feature from its direct messaging service in the coming months.
Palo Alto Networks has warned of a critical, unpatched zero-day vulnerability in its PAN-OS software that is currently being exploited in the wild to achieve remote code execution.
Poland’s Internal Security Agency has confirmed that five water treatment plants were breached in 2025, with attackers gaining the ability to manipulate critical operational equipment.
AI observability platform Braintrust is urging customers to rotate their API keys after a breach of an internal AWS account exposed credentials used to access third-party AI models.
The ACSC has issued an urgent alert about a widespread campaign using ClickFix social engineering and compromised WordPress sites to distribute the Vidar Stealer infostealer malware.
The hacking group ShinyHunters has compromised the Canvas learning management system, stealing vast amounts of student data and forcing a temporary shutdown of services during the peak of the U.S. academic final exam season.
A security breach at a former third-party technology provider has exposed the personal data of 197,400 Zara customers, according to findings from Have I Been Pwned.
Meta has initiated a judicial review against the UK's Ofcom, challenging the regulator's method of calculating potential fines and fees based on global revenue rather than UK-specific earnings.
CISA has mandated that federal agencies patch a high-severity zero-day vulnerability in Ivanti Endpoint Manager Mobile by May 10 following reports of active exploitation.
A new analysis of 25 million security alerts reveals that enterprise reliance on severity-based triage and automated EDR remediation is leaving organizations vulnerable to one missed breach per week.
Google is integrating Play Policy Insights and SDK compliance checks directly into Android Studio to help developers identify and resolve security and policy issues during the coding process.
Apple has released a massive wave of updates across its entire ecosystem, including version 26.5 for all major platforms and critical security patches for legacy iOS and iPadOS versions.
Two U.S. men have been sentenced to 18 months in prison for operating "laptop farms" that enabled North Korean IT workers to secure remote jobs at nearly 70 American companies and funnel over $1.2 million to Pyongyang.
SentinelOne researchers have uncovered PCPJack, a credential theft framework that worms through cloud infrastructure previously compromised by the TeamPCP cybercrime group, removing their artifacts and stealing credentials.
A Virginia man has been convicted of federal charges for orchestrating the retaliatory destruction of 96 government databases following his termination from a federal contracting firm.
A new, sophisticated Linux backdoor called PamDOORa is being sold on underground forums, offering attackers persistent SSH access and credential harvesting capabilities by exploiting the Pluggable Authentication Module (PAM) framework.
A newly discovered malware framework called PCPJack is systematically purging systems of TeamPCP infections to establish its own credential-harvesting operation.
Snyk has integrated Anthropic’s Claude models into its AI Security Platform to automate vulnerability discovery and remediation for AI-generated code and agentic workflows.