Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,960 stories synthesized.
A cyber-espionage group known as HeartlessSoul has been targeting Russian aviation companies and government agencies since September 2025 to steal sensitive geographic information system (GIS) data, including satellite and GPS mapping.
Microsoft has addressed a known issue in the optional KB5083631 preview cumulative update for Windows 11 that caused Remote Desktop security warnings to display incorrectly on multi-monitor setups with different scaling.
A sophisticated Python-based backdoor named Deep#Door targets Windows systems, enabling persistent remote access, surveillance, and destructive operations.
A critical authentication-bypass vulnerability in cPanel and WebHost Manager (WHM), tracked as CVE-2026-41940, is being actively exploited in the wild, allowing attackers to gain administrative access without credentials.
A high-severity zero-day vulnerability dubbed 'Copy Fail' (CVE-2026-31431) that has lurked in the Linux kernel since 2017 was uncovered by a researcher using an AI-driven code analysis platform, affecting all major distributions.
A supply-chain attack campaign using sleeper Ruby gems and Go modules from the GitHub account 'BufferZoneCorp' steals credentials, tampers with GitHub Actions workflows, and establishes SSH persistence.
Threat actors are distributing malware through AI platforms Hugging Face and ClawHub by uploading trojanized shared files that trick users into executing malicious code.
A critical unauthenticated code injection vulnerability in FlowiseAI's Airtable_Agent component, tracked as CVE-2026-41265, allows remote attackers to execute arbitrary Python code with a CVSS score of 9.8.
Unit 42 identified 18 AI-themed browser extensions that operate as remote access Trojans, meddler-in-the-middle tools, and infostealers, intercepting emails, ChatGPT prompts, and passwords.
A coordinated supply-chain attack dubbed "Mini Shai-Hulud" hit 1,800+ npm and PyPI developers over multiple May 18 victim batches, targeting TanStack, SAP, Intercom, Mistral AI, Guardrails AI, Lightning, and hijacked OIDC tokens to sign malicious packages with valid provenance.
A 9-year-old Linux kernel privilege escalation vulnerability, CVE-2026-31431, allows any local user to gain root access with a 10-line exploit that works 100% of the time and leaves no disk trace.
Scammers are manipulating the subject line of legitimate PayPal payment notifications to trick recipients into calling fraudulent tech support numbers.
A new phishing-as-a-service platform called Bluekit provides over 40 realistic templates and an integrated AI assistant to help cybercriminals draft phishing emails, marking another step in the commoditization of AI-enhanced cybercrime tooling.
Wordfence reported 158 vulnerabilities in 123 WordPress plugins and 27 themes during the week of April 20–26, 2026, with 42 remaining unpatched and 6 rated critical severity.
Google has patched a critical remote code execution vulnerability in Gemini CLI that could allow attackers to compromise CI/CD pipelines via malicious workspace configuration files.
Threat actors compromised the PyTorch Lightning Python package and the Intercom npm/Packagist packages on April 30, 2026, as part of the ongoing Mini Shai-Hulud campaign to steal developer credentials.
Ukrainian authorities arrested three individuals for hacking over 610,000 Roblox accounts using infostealer malware distributed via social engineering lures promising in-game bonuses.
A high-severity local privilege escalation vulnerability in the Linux kernel's cryptographic subsystem, dubbed 'Copy Fail,' allows any local user to gain root access on virtually every major Linux distribution released since 2017.
Ukrainian authorities arrested three individuals in Lviv for stealing over 610,000 Roblox accounts, including 357 elite accounts, using infostealing malware disguised as game-enhancement tools.
The April 2026 KB5083769 security update for Windows 11 24H2 and 25H2 is breaking third-party backup software that relies on VSS snapshots, leading to timeouts and failures.
A new Python-based backdoor named Deep#Door uses obfuscated batch scripts and embedded payloads to evade detection on Windows systems, enabling long-term surveillance and credential theft.
A Brazilian DDoS mitigation company, Huge Networks, was unknowingly used as a platform for a botnet that launched massive DDoS attacks against Brazilian ISPs, exploiting TP-Link routers and misconfigured DNS servers.
Cloudflare has announced general availability of post-quantum encryption for its IPsec product, using hybrid ML-KEM per draft-ietf-ipsecme-ikev2-mlkem, with confirmed interoperability with Fortinet FortiOS 7.6.6+ and Cisco 8000 Series routers.
Canadian authorities arrested three men for operating an SMS blaster device that mimicked a cellular tower to send phishing texts, marking the first such case in the country.