Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,960 stories synthesized.
A critical authentication bypass vulnerability in cPanel and WHM (CVE-2026-41940) has been exploited in the wild since at least February 23, with a patch released only on April 28.
Researchers have uncovered DEEP#DOOR, a Python-based backdoor that uses the bore.pub Rust-based tunneling service for C2 and steals browser, cloud, and system credentials from compromised hosts.
A high-severity local privilege escalation vulnerability named 'Copy Fail' in the Linux kernel's authencesn cryptographic template allows unprivileged users to reliably gain root access on virtually every major distribution shipped since 2017.
Atos TRC has uncovered a March 2026 campaign targeting enterprise admins and DevOps with malicious MSI installers disguised as PsExec, AzCopy, and Sysmon, using Ethereum smart contracts for takedown-resistant command and control.
TrendAI researchers have identified a new China-linked threat group, Shadow-Earth-053, that has compromised over a dozen critical networks across Poland and multiple Asian countries since December 2024, exploiting years-old Microsoft Exchange Server vulnerabilities.
Researchers have reverse-engineered Fast16, a state-sponsored malware likely of US origin, deployed against Iran years before Stuxnet, capable of silently sabotaging high-precision calculations and simulations.
A critical CRLF injection vulnerability in cPanel and WHM (CVE-2026-41940, CVSS 9.8) allows unauthenticated attackers to gain root access, with evidence suggesting exploitation as a zero-day for at least 30 days.
A high-severity Linux kernel LPE vulnerability, CVE-2026-31431, dubbed 'Copy Fail', allows unprivileged local users to gain root access on all major distributions shipped since 2017.
Google has fixed a critical vulnerability in the Gemini CLI npm package and GitHub Actions workflow that could allow unauthenticated attackers to execute arbitrary commands in CI/CD environments, while a separate bug in the Cursor AI coding tool also enables code execution via prompt injection.
The Silver Fox threat group is targeting organizations in Russia and India with tax-themed phishing emails that deliver a modified Rust-based loader and a new Python-based backdoor named ABCDoor.
A new variant of the Redtail cryptominer, dubbed 'libredtail,' is actively spreading via HTTP by exploiting CVE-2024-4577 to compromise PHP servers and deploy cryptocurrency mining payloads.
A high-severity local privilege escalation vulnerability in the Linux kernel's authencesn cryptographic template, dubbed Copy Fail, allows unprivileged users to gain root access on nearly all distributions released since 2017.
Trend Micro reveals Shadow-Earth-053, a China-aligned cyberespionage campaign exploiting unpatched Microsoft Exchange vulnerabilities to target government and defense sectors across Asia.
GitHub disclosed CVE-2026-3854, a high-severity remote code execution vulnerability in GitHub Enterprise Server, discovered by Wiz using an AI-powered reverse-engineering tool that cut analysis time from weeks to under 48 hours.
A critical authentication bypass vulnerability in cPanel & WHM (CVE-2026-41940, CVSS 9.8) is being actively exploited in the wild, granting unauthenticated attackers root-level access to over a million exposed servers.
An AI-driven code analysis by Aisle has revealed 38 previously unknown vulnerabilities in OpenEMR, the open-source EHR platform used by over 100,000 healthcare providers, including a critical SQL injection flaw rated CVSS 10.0.
Microsoft and CISA warn that CVE-2026-32202, a zero-click authentication coercion flaw in Windows Shell stemming from an incomplete fix for a Russian-APT28-exploited bug, is being actively exploited.
A critical authentication bypass vulnerability in cPanel and WebHost Manager, CVE-2026-41940, is being actively exploited by threat actors to deploy backdoors and harvest credentials on a global scale.
A supply chain attack has compromised four SAP-related npm packages with credential-stealing malware that steals credentials, cloud secrets, and targets AI coding agent configurations for persistence.
CISA has flagged CVE-2026-6807, an XXE vulnerability in the NSA-developed OT network tool GrassMarlin, which can leak sensitive data via crafted session files.
A design flaw in the Vect 2.0 ransomware-as-a-service variant causes it to permanently destroy large files instead of encrypting them, making recovery impossible even for victims who pay the ransom.
A high-severity vulnerability in the AI coding tool Cursor allows any installed extension to access locally stored API keys and session tokens without user interaction.
ReversingLabs has uncovered PromptMink, a North Korean threat-actor campaign that uses malicious npm packages introduced by an AI coding assistant to steal cryptocurrency from developers in the Web3 space.
ReversingLabs has uncovered a malicious npm package, @validate-sdk/v2, linked to North Korean threat actor Famous Chollima (APT37), which was added to an autonomous trading agent via an AI-assisted commit co-authored by Anthropic's Claude Opus model.