Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,728 stories synthesized.
Organizations face escalating security risks as shadow IT evolves into shadow SaaS, shadow AI, and autonomous agents, overwhelming traditional governance models.
Malicious npm packages disguised as Rollup polyfill tools have been distributed by North Korean threat actors to steal developer secrets and establish remote access.
Key findings • Ten malicious npm packages were disclosed on July 3, 2026. • All advisories were published within a 29-minute window, indicating coordination. • Most packages were newly pu…
Key findings • Three moderate-severity vulnerabilities in Keycloak's FGAP v2 implementation were disclosed on July 3, 2026. • CVE-2026-14615 and CVE-2026-14613 allow bypassing permission filt…
A roundup of cybersecurity news includes the sentencing of a Canadian hacker, the disclosure of numerous zero-day vulnerabilities in open-source projects, and the sentencing of two individuals for ATM jackpotting.
A new buyer's guide ranks the top Post-Quantum Cryptographic Solutions for 2026, evaluating vendors on standards compliance, crypto-agility, and enterprise maturity as the threat of quantum computing looms.
AdaptHealth disclosed a breach where attackers used social engineering against a third-party contractor to gain access to cloud systems and steal patient data, including insurance billing passwords.
Cybercriminals are impersonating well-known brands in online advertisements to lure unsuspecting users to fraudulent gambling websites, employing sophisticated tactics like AI-generated videos and fake app stores.
Attackers are increasingly targeting AI agents with indirect prompt injection, using SEO poisoning and hidden HTML to trick them into executing malicious commands, including fraudulent payments and trusting fake websites.
Cybercriminals are employing sophisticated social engineering tactics, using a verified X ad to distribute Mac malware and a new technique called ConsentFix to hijack Microsoft 365 accounts.
BerylliumSec's open-source Nebula platform brings AI-powered vulnerability assessment and exploit script generation directly into the command-line interface for penetration testers.
Montenegrin authorities, with FBI assistance, arrested an Iranian national accused of orchestrating cyberattacks against over 150 U.S. universities, causing billions in damages that allegedly benefited Iranian state entities.
The FBI has issued a warning about TeamPCP, a threat group compromising developer tools like Trivy and KICS to steal cloud credentials, SSH keys, and Kubernetes secrets in large-scale supply chain attacks.
A new partnership between the Vect ransomware group and the TeamPCP credential theft collective signals a significant shift towards industrialized cyber-attacks, raising alarms among cybersecurity experts and law enforcement.
Flock's surveillance cameras can now identify vehicles using unique 'Vehicle Fingerprints' derived from decals and stickers, enabling law enforcement to track vehicles even without license plate data.
Apple's upcoming iOS 27 will feature 'Trust Insights,' an on-device framework designed to detect and alert users in real-time about social engineering scams by analyzing behavioral patterns.
A new advanced persistent threat group, Armored Likho, is actively targeting government and electric power entities in Russia, Brazil, and Kazakhstan with a sophisticated campaign utilizing a custom infostealer and AI-generated initial payloads.
Key findings • 21 CVEs disclosed across Apache ActiveMQ, Tomcat, Shiro, Kerby, and HttpComponents between June 26 and July 3, 2026. • Multiple denial-of-service vulnerabilities affect Apache …
Key findings • Four vulnerabilities disclosed in Erlang/OTP on July 3, 2026, impacting SSL/TLS and SFTP components. • CVE-2026-53422 allows authenticated SFTP users to enumerate files outside…
Key findings • Six vulnerabilities disclosed across GNOME ecosystem components, primarily GLib and GIMP. • GLib vulnerabilities include out-of-bounds reads, path traversal, and state confusio…
Key findings • Six ClamAV vulnerabilities disclosed simultaneously on July 3, 2026, affecting file format parsers. • Vulnerabilities primarily lead to Denial-of-Service (DoS) conditions due t…
Key findings • 25 vulnerabilities disclosed on July 3, 2026, for Google Chrome, all fixed in version 150.0.7871.46. • Flaws span multiple components including V8, ANGLE, Dawn, Skia, and Tint,…
Three high-severity vulnerabilities in WatchGuard Firebox OS allow authenticated attackers to achieve arbitrary code execution and file writes via management interfaces.
North Korean threat actors are leveraging the PolinRider campaign to inject malicious JavaScript loaders into popular open source ecosystems, including npm, Packagist, and Go modules.