Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,960 stories synthesized.
A critical unauthenticated remote code execution vulnerability (CVE-2026-25874, CVSS 9.3) has been disclosed in Hugging Face's LeRobot open-source robotics platform, with no patch currently available.
North Korean threat group BlueNoroff has compromised over 100 cryptocurrency organizations across 20+ countries using typosquatted Zoom domains, AI-generated deepfakes, and ClickFix clipboard injection attacks.
Chinese national Xu Zewei, a member of the Silk Typhoon hacking group, has been extradited from Italy to the U.S. for allegedly stealing COVID-19 vaccine data and exploiting Microsoft Exchange zero-days.
A privilege escalation flaw in Microsoft Entra ID's Agent ID Administrator role allowed users to take over arbitrary service principals, potentially granting attackers broader tenant control.
Microsoft has confirmed that CVE-2026-32202, a Windows Shell spoofing vulnerability patched in April 2026, is being actively exploited in the wild as a zero-click credential theft vector.
The Zero Day Initiative has published a sandbox escape vulnerability in OpenAI Codex as a 0-day advisory after OpenAI rejected the report as out of scope for its bug bounty program.
A race condition in Oracle VirtualBox's SoundBlaster 16 virtual device, tracked as CVE-2026-35230, allows a guest attacker with high privileges to execute arbitrary code in the hypervisor context.
Checkmarx has confirmed that data posted by the Lapsus$ extortion group originated from its GitHub repository, accessed via a prior compromise of the Trivy open-source scanner in an ongoing supply-chain campaign targeting security and developer tools.
Google Threat Intelligence and Mandiant have identified a new financially motivated threat actor, UNC6692, that blends social engineering via Microsoft Teams with custom malware and AWS S3 bucket abuse.
An unpatched architectural flaw in Windows RPC, dubbed PhantomRPC, allows low-privileged attackers to escalate to SYSTEM by impersonating legitimate services.
Checkmarx has confirmed that data from its GitHub repository was published on the dark web following a March 23 supply-chain attack attributed to threat actor TeamPCP.
The TeamPCP supply chain campaign resumed after a 26-day pause with three concurrent compromises targeting Checkmarx KICS, Bitwarden CLI, and xinference, alongside the discovery of a self-propagating npm worm called CanisterSprawl.
This week's cybersecurity news covers a Lua-based malware predating Stuxnet, a backdoor targeting U.S. federal agencies, a wiper aimed at Venezuelan energy systems, and multiple ransomware developments.
Researchers at SentinelOne have discovered fast16, a previously undocumented malware framework dating back to 2005 that predates Stuxnet as the earliest known cyber sabotage tool, designed to corrupt high-precision calculations in engineering and scientific software.
Check Point's weekly threat report details a Vercel breach via compromised OAuth tokens, a Bitwarden supply-chain attack, and critical out-of-band patches from Microsoft for ASP.NET Core.
Pro-Ukrainian hacktivist group PhantomCore exploited three TrueConf Server vulnerabilities to breach Russian networks since September 2025, using a chain of authentication bypass, arbitrary file read, and command injection flaws.
Home security giant ADT has confirmed a cyber intrusion on April 20 after the ShinyHunters group attempted extortion group claimed to have stolen over 10 million Salesforce records containing customer PII.
Socket researchers have identified 73 cloned VS Code extensions on the Open VSX repository linked to the GlassWorm v2 campaign, with six confirmed malicious and the rest acting as sleeper packages.
Researchers at SentinelOne have identified Fast16, a previously unknown malware family from 2005 designed to sabotage Iran's nuclear program, making it the earliest known state-backed cyber-sabotage operation, predating Stuxnet by five years.
A financially motivated extortion group tracked as BlackFile has been targeting retail and hospitality firms since February 2026, using vishing attacks, MFA bypass, and SaaS data exfiltration to demand seven-figure ransoms.
A massive international revenue share fraud campaign uses fake CAPTCHA pages to trick victims into sending premium-rate SMS messages, while over 120 malicious campaigns abuse the Keitaro traffic distribution system for malware delivery and cryptocurrency theft.
A use-after-free vulnerability in Foxit PDF Reader's Annotation object handling, tracked as CVE-2026-5940, allows remote attackers to execute arbitrary code by tricking users into opening a malicious PDF file.
A use-after-free vulnerability in Foxit PDF Reader's handling of AcroForm Signature objects could allow attackers to leak sensitive memory contents by tricking users into opening a malicious PDF file.
A critical authentication bypass vulnerability in Flowise, a popular low-code platform for building LLM applications, allows unauthenticated remote attackers to compromise systems via a flawed password reset mechanism.