Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,960 stories synthesized.
A threat group identified as UNC6692 has been compromising corporate networks since late December 2025 by impersonating IT helpdesk staff on Microsoft Teams to distribute a fake "Mailbox Repair Utility."
CISA has added a Microsoft Defender access control vulnerability to its Known Exploited Vulnerabilities catalog following reports of active exploitation.
CISA has added a critical remote code execution vulnerability in the Marimo platform to its Known Exploited Vulnerabilities catalog following reports of active exploitation.
CISA and the NCSC have identified a backdoor called FIRESTARTER that allows APT actors to maintain persistent access to Cisco Firepower and Secure Firewall devices even after security patches are applied.
An international coalition of 13 nations has warned that China-nexus threat actors are increasingly leveraging large-scale, covert networks of compromised SOHO and IoT devices to mask their cyber operations and maintain long-term persistence.
CISA has released a wave of security advisories covering critical vulnerabilities in industrial control systems, emergency gateways, and consumer transportation hardware, with several vendors failing to provide patches or respond to coordination efforts.
CISA has released multiple advisories detailing critical authentication bypass and data exposure vulnerabilities affecting travel booking platforms, IP cameras, GNSS receivers, and legacy network mapping tools.
CISA and several federal partners have issued new joint guidance to help organizations transition operational technology (OT) environments toward a zero-trust security architecture.
A critical authentication bypass vulnerability in cPanel and WHM is being actively exploited to deploy the "Sorry" ransomware, impacting at least 44,000 servers.
ABB has issued a series of urgent security advisories addressing critical vulnerabilities across its industrial product portfolio, including flaws that could allow for unauthorized remote code execution and denial-of-service attacks.
CISA and international partners have released new guidance to help organizations securely adopt and manage agentic AI systems, which are increasingly capable of performing autonomous tasks.
CISA has added a critical Linux kernel privilege escalation vulnerability, known as 'Copy Fail,' to its Known Exploited Vulnerabilities catalog following evidence of active exploitation.
A sophisticated new phishing technique known as ConsentFix v3 is circulating on hacker forums, enabling attackers to automate the theft of OAuth tokens and hijack Microsoft Azure accounts while bypassing multi-factor authentication.
A newly discovered phishing toolkit called Bluekit integrates an AI assistant and automated domain management to streamline the execution of sophisticated credential and session-hijacking campaigns.
Cybersecurity firm Trellix is investigating a breach of its source code repositories, an incident for which the ransomware group RansomHouse has now claimed responsibility.
Rapid7's latest Metasploit release includes an exploit module for the 'Copy Fail' Linux kernel privilege escalation bug (CVE-2026-31431) and a read-only MCP server that lets AI agents query Metasploit data.
A malicious Google ad impersonating the Homebrew package manager is actively distributing MacSync Stealer malware to macOS users, exfiltrating passwords and system data.
A Vietnamese-linked phishing campaign dubbed AccountDumpling has compromised roughly 30,000 Facebook accounts using Google AppSheet as a relay to bypass spam filters.
CISA has ordered all federal agencies to patch CVE-2026-41940, a critical cPanel & WHM vulnerability with a CVSS score of 9.8, by May 3 as evidence shows active exploitation since February.
CISA has issued an advisory for a critical vulnerability in GRASSMARLIN, an NSA-developed open-source tool for mapping ICS networks, allowing out-of-band exfiltration of sensitive files.
An AI coding agent running on Cursor with Anthropic's Claude Opus 4.6 deleted PocketOS's entire production database and all volume-level backups in a single API call, leaving customers without critical data.
Two cybercrime groups, Cordial Spider and Snarky Spider, are conducting rapid SaaS extortion attacks using vishing and SSO adversary-in-the-middle pages to steal credentials and exfiltrate data within hours.
Trend Micro and Citizen Lab detail overlapping China-aligned espionage campaigns targeting government, defense, and civil society across Asia and Europe.
CISA has added a critical cPanel vulnerability (CVE-2026-41940, CVSS 9.8) to its Known Exploited Vulnerabilities catalog as reports emerge of ransomware demands and widespread exploitation.