Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,960 stories synthesized.
Google has increased its top vulnerability bounty to $1.5 million for zero-click Pixel Titan M2 exploits as part of a major overhaul to its Android and Chrome bug reward programs.
A China-linked threat actor known as UAT-8302 is targeting government agencies in South America and Europe using a shared arsenal of malware previously tied to multiple other APT groups.
Software Composition Analysis (SCA) tools are failing to detect vulnerabilities in end-of-life (EOL) software because official CVE records often omit older versions from their affected ranges, creating a massive blind spot for security teams.
Security teams are facing a critical blind spot as industry-standard vulnerability scanners fail to report flaws in end-of-life (EOL) software, leading to a massive volume of unflagged, exploitable components.
A phishing campaign dubbed Venomous#Helper has compromised over 80 US organizations since April 2025, using fake SSA emails to deliver a signed SimpleHelp RAT that establishes dual persistent backdoors via SimpleHelp and ConnectWise ScreenConnect.
Real estate giant Cushman & Wakefield is investigating a data breach after being targeted by both the ShinyHunters and Qilin cybercrime groups following a successful vishing attack.
Principal Security Researcher Joey Melo is advancing the field of AI red teaming by applying traditional penetration testing methodologies to successfully jailbreak and manipulate large language models.
The ShinyHunters extortion gang has leaked data belonging to 119,200 Vimeo users after compromising the video platform through a third-party integration with data analytics firm Anodot.
The Center for Internet Security has introduced specialized hardened OS images for AWS to help organizations secure AI and high-performance computing workloads by providing pre-configured, compliant baselines.
Security researchers have discovered that Microsoft Edge stores user passwords in cleartext within its process memory, allowing local users or malware to extract credentials without elevated privileges.
Australia has established a new Cyber Incident Review Board to conduct no-fault, post-incident investigations into major cyberattacks, granting the body the power to compel information from organizations.
A Latvian national has been sentenced to 102 months in prison for his role in a sophisticated ransomware syndicate that extorted over 54 organizations using various aliases, including Conti and Akira.
A critical heap out-of-bounds vulnerability in the Ollama AI inference engine, dubbed 'Bleeding Llama,' is exposing roughly 300,000 internet-accessible instances to unauthenticated information theft.
A data breach involving third-party analytics provider Anodot has resulted in the exposure of over 119,000 Vimeo user email addresses, according to data confirmed by the breach notification service Have I Been Pwned.
Google has patched a critical remote code execution vulnerability in the Android System component that could allow attackers to execute code as a shell user without user interaction.
A sophisticated campaign targeting the sales engagement platform Drift has exposed the systemic risks of persistent OAuth tokens, which allow attackers to bypass MFA and gain long-term access to sensitive cloud environments.
A critical code injection vulnerability in MetInfo CMS is being actively exploited in the wild, allowing unauthenticated attackers to achieve remote code execution on vulnerable servers.
VIAVI Solutions has introduced the CyberFlood CF1000, a 400G appliance designed to validate the security and performance of multi-terabit AI data centers and critical network infrastructure.
Oracle has introduced a new monthly Critical Security Patch Update (CSPU) cycle to help customers address vulnerabilities more quickly while maintaining its existing quarterly patch schedule.
Certificate authority SSL.com has begun rotating its root certificate hierarchy, prompting warnings for organizations with custom trust configurations to audit their systems for potential service disruptions.
Meta has patched two vulnerabilities in WhatsApp that could allow attackers to manipulate media handling and disguise malicious files, though no active exploitation has been observed.
Google has overhauled its Android and Chrome bug bounty programs, offering up to $1.5 million for high-end exploits while scaling back rewards for vulnerabilities easily identified by AI.
The Apache Software Foundation has released critical patches for the Apache HTTP Server and the Apache MINA framework to address over a dozen vulnerabilities, including several that could lead to remote code execution.
A sophisticated phishing campaign impersonating internal compliance notices successfully targeted over 35,000 users to conduct adversary-in-the-middle attacks and steal session tokens.