Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,960 stories synthesized.
A critical vulnerability in the Cline Kanban server allows any website a developer visits to silently hijack the AI coding agent, exfiltrate data, and execute commands.
Dragos reports that attackers used Anthropic's Claude and OpenAI's GPT models in a campaign targeting a municipal water utility in Mexico, marking a novel use of commercial LLMs in critical infrastructure attacks.
Palo Alto Networks disclosed CVE-2026-0300, a zero-day in its User-ID Authentication Portal, exploited by the likely Chinese state-sponsored group CL-STA-1132 for root-level access.
A fraudulent Claude AI website distributes a site distributes a previously undocumented backdoor named Beagle through a DLL sideloading chain that abuses a signed G DATA antivirus updater.
Cloudflare has published a detailed postmortem of its response to the 'Copy Fail' Linux kernel local privilege escalation vulnerability (CVE-2026-31431), confirming no impact to its infrastructure and highlighting how its behavioral detections could identify the exploit within minutes.
Adversa AI researchers disclosed a class-level security issue affecting AI coding tools that fail to adequately warn users about malicious MCP server execution with full system privileges.
Kaspersky's Q1 2026 vulnerability report reveals a new exploit chain targeting Microsoft Office that bypasses Protected View using three CVEs, alongside a rise in exploit kit activity and persistent veteran exploits.
Disc Soft confirmed that Daemon Tools Lite version 12.5.1 was trojanized in a supply chain attack, with malicious installers distributed from the official website since April 8.
Three malicious PyPI packages have been discovered delivering a new malware that uses Zulip's REST APIs as its command-and-control infrastructure, targeting both Windows and Linux systems.
ESET researchers uncovered 28 fraudulent Android apps on Google Play, collectively named CallPhantom, that tricked over 7.3 million users into paying for fake call logs and SMS records generated from hardcoded data.
Cofense warns that low-skilled threat actors are increasingly abusing Vercel's generative AI platform v0.dev to create convincing phishing pages mimicking brands like Microsoft, Spotify, and Nike.
Researchers have identified a cyberattack on a Mexican water utility where threat actors used generative AI to develop custom hacking tools and independently identify critical industrial control systems.
BlueRock has launched an open-source runtime sensor that allows developers to monitor Model Context Protocol (MCP) servers and Python application behavior without modifying source code.
Enterprises are struggling to manage the operational and security complexities of deploying multiple AI models across hybrid multicloud environments, according to new industry data.
The SANS Internet Storm Center released its daily Stormcast briefing on May 7, 2026, providing security professionals with an updated assessment of the current threat landscape.
A new research project demonstrates how Large Language Models can dynamically generate secure, adaptive dashboards for analyzing web honeypot logs, simplifying threat detection for security teams.
North Korean state-sponsored hackers known as APT37 have targeted ethnic Koreans in China with a sophisticated Android backdoor called 'BirdCall' distributed through a compromised mobile gaming platform.
Palo Alto Networks disclosed CVE-2026-0300, a critical buffer overflow in the PAN-OS Captive Portal allowing unauthenticated remote code execution, with limited exploitation by a likely state-sponsored threat cluster tracked as CL-STA-1132.
Microsoft is rolling out a new "Brand Impersonation Protection" feature for Teams Calling to automatically alert users to suspicious, high-risk VoIP calls from external impersonators.
Attackers are using malicious Google search advertisements to lure ManageWP users into a real-time adversary-in-the-middle phishing scheme that bypasses multi-factor authentication.
Kaspersky researchers have uncovered a new bypass of Google Chrome's App-Bound Encryption (ABE) by the VoidStealer Trojan, which attaches to the browser as a debugger to capture the decryption key from memory.
Instructure, the vendor behind the Canvas learning management system, disclosed a data breach on May 1 where a threat actor stole names, emails, student IDs, and user messages.
A critical out-of-bounds write vulnerability in Palo Alto Networks' PAN-OS is being actively exploited by a state-sponsored group, prompting an urgent directive from CISA.
A new Mirai-derived botnet named xlabs_v1 is hijacking internet-exposed Android devices and IoT hardware via the Android Debug Bridge to power a DDoS-for-hire service.