Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,922 stories synthesized.
Google has patched a critical remote code execution vulnerability in the Android System component that could allow attackers to execute code as a shell user without user interaction.
A sophisticated campaign targeting the sales engagement platform Drift has exposed the systemic risks of persistent OAuth tokens, which allow attackers to bypass MFA and gain long-term access to sensitive cloud environments.
A critical code injection vulnerability in MetInfo CMS is being actively exploited in the wild, allowing unauthenticated attackers to achieve remote code execution on vulnerable servers.
VIAVI Solutions has introduced the CyberFlood CF1000, a 400G appliance designed to validate the security and performance of multi-terabit AI data centers and critical network infrastructure.
Oracle has introduced a new monthly Critical Security Patch Update (CSPU) cycle to help customers address vulnerabilities more quickly while maintaining its existing quarterly patch schedule.
Certificate authority SSL.com has begun rotating its root certificate hierarchy, prompting warnings for organizations with custom trust configurations to audit their systems for potential service disruptions.
Meta has patched two vulnerabilities in WhatsApp that could allow attackers to manipulate media handling and disguise malicious files, though no active exploitation has been observed.
Google has overhauled its Android and Chrome bug bounty programs, offering up to $1.5 million for high-end exploits while scaling back rewards for vulnerabilities easily identified by AI.
The Apache Software Foundation has released critical patches for the Apache HTTP Server and the Apache MINA framework to address over a dozen vulnerabilities, including several that could lead to remote code execution.
A sophisticated phishing campaign impersonating internal compliance notices successfully targeted over 35,000 users to conduct adversary-in-the-middle attacks and steal session tokens.
Trail of Bits released detailed walkthroughs of two C/C++ security challenges from its Testing Handbook, revealing subtle bugs in a Linux ping program and a Windows driver, and introduced a new Claude skill for automated code review.
A Latvian member of the Karakurt ransomware gang has been sentenced to 8.5 years in prison for his role in extorting victims and managing negotiations for the criminal group.
Google researchers have identified a sophisticated iOS zero-day exploit chain named DarkSword, which has been used by state-sponsored actors and surveillance vendors to fully compromise devices since late 2025.
A scan of 1 million exposed AI services has uncovered widespread security failures, including default-off authentication and leaked API keys, leaving enterprise infrastructure vulnerable to data exfiltration and unauthorized code execution.
Anomali has unveiled ThreatStream Next-Gen, a new platform designed to accelerate threat response by automating intelligence-driven decision-making across security workflows.
A Latvian national has been sentenced to 8.5 years in U.S. prison for his role as a negotiator for the Karakurt extortion gang, a group linked to hundreds of millions of dollars in losses and deep ties to Russian state corruption.
Cisco Talos has uncovered a China-nexus threat actor, tracked as UAT-8302, that is leveraging a shared arsenal of sophisticated malware to infiltrate government networks across South America and Europe.
A sophisticated new malware campaign is abusing the Microsoft Phone Link application to intercept SMS-based authentication codes and credentials from Windows PCs.
Threat actors are actively exploiting critical, unauthenticated remote code execution vulnerabilities in MetInfo CMS and Weaver E-cology, leading to potential full server compromise.
The North Korean state-sponsored group ScarCruft has compromised a regional gaming platform to distribute trojanized Windows and Android software, enabling long-term espionage against ethnic Koreans in China.
The North Korean-aligned APT group ScarCruft has compromised a regional gaming platform to distribute sophisticated Windows and Android backdoors in a targeted supply-chain attack.
Cybersecurity vendor Trellix has revealed that threat actors gained unauthorized access to a portion of its source code repository, raising concerns about potential supply chain attacks.
Meta has patched two medium-impact vulnerabilities in WhatsApp while simultaneously upgrading the cryptographic transparency of its end-to-end encrypted backup infrastructure.
Microsoft has uncovered a massive, multi-stage phishing campaign that leveraged enterprise-themed lures and adversary-in-the-middle tactics to bypass multi-factor authentication for over 35,000 users.