Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,960 stories synthesized.
A critical use-after-free vulnerability in Foxit PDF Reader's AcroForm Signature handling allows remote attackers to execute arbitrary code, with a patch now available.
A use-after-free vulnerability in Foxit PDF Reader's handling of AcroForm Annotation objects, tracked as CVE-2026-5943, allows attackers to execute arbitrary code by tricking users into opening a malicious PDF file.
Google's Threat Intelligence Group has identified a new threat group, UNC6692, that combines help desk impersonation via Microsoft Teams with a custom modular malware ecosystem dubbed 'Snow' to steal credentials and establish persistent backdoor access.
New analysis confirms the Lua-based fast16 malware was a pre-Stuxnet cyber sabotage tool designed to corrupt uranium-compression simulations used in nuclear weapon design.
CISA added four actively exploited vulnerabilities to its KEV catalog, affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers, with a federal patch deadline of May 8, 2026.
Rapid7's latest Metasploit Wrap-Up introduces four new modules, including exploits for a directory traversal in Camaleon CMS, a prompt injection RCE in Langflow, and an updated WebDAV PHP Upload module with Linux support.
CISA and NCSC disclosed that an unnamed federal agency's Cisco Firepower device was compromised with the FIRESTARTER backdoor, which persists across firmware updates and reboots.
SentinelOne's Week 17 roundup covers guilty pleas from a Scattered Spider leader and a ransomware negotiator, Chinese-linked botnet expansions, and a newly discovered pre-Stuxnet sabotage framework.
North Korea's Lazarus Group is targeting macOS users in the FinTech and cryptocurrency sectors with a new malware kit delivered through ClickFix social engineering attacks on Telegram.
A dataset containing genetic sequences, blood samples, and medical imaging of half a million UK Biobank volunteers was offered for sale on the Chinese e-commerce platform Alibaba, prompting an emergency government response.
Kaspersky researchers have uncovered 26 malicious apps on the Apple App Store that impersonate popular cryptocurrency wallets to steal recovery phrases and private keys, marking a significant escalation in iOS-targeted crypto theft.
A new campaign attributed to the Chinese-speaking threat group Tropic Trooper uses a trojanized SumatraPDF reader to deliver the AdaptixC2 Beacon, leveraging GitHub for command-and-control and VS Code tunnels for remote access.
Malicious npm packages @automagik/genie and pgserve are spreading worm-like malware that steals credentials, cloud tokens, SSH keys, and cryptocurrency wallet data, with self-propagation capabilities extending to PyPI.
Researchers have disclosed PhantomRPC, a novel privilege escalation technique in the Windows RPC architecture that allows processes with impersonation privileges to gain SYSTEM access on all Windows versions, with no patch available.
A high-severity SSRF vulnerability in LMDeploy's vision-language module is being actively exploited less than 13 hours after public disclosure, with attackers targeting AWS IMDS, Redis, and MySQL.
The China-linked APT23 group has broadened its espionage operations to Japan, South Korea, and Taiwan, using compromised home Wi-Fi routers to hijack DNS and deliver Cobalt Strike beacons through a novel supply-chain attack.
ESET researchers have uncovered a Chinese APT group, GopherWhisper, that has been targeting the Mongolian government since November 2023 with five distinct backdoors abusing Slack, Discord, and Microsoft Outlook for command-and-control.
The UK's NCSC, alongside US and other agencies, warns that China-nexus threat actors are industrializing botnets of compromised SOHO routers and IoT devices for large-scale, deniable cyber operations.
Mandiant has identified UNC6692, a threat actor using Microsoft Teams to impersonate IT help desk staff and deploy the modular SNOW malware suite, with 77% of observed incidents targeting senior executives.
Wordfence's weekly vulnerability report for April 13-19, 2026, discloses 139 vulnerabilities across 118 plugins and 10 themes, with 30 remaining unpatched and 6 rated critical severity.
Cisco Talos has identified that threat actor UAT-4356 is actively exploiting n-day vulnerabilities in Cisco Firepower FXOS devices to deploy a custom backdoor named FIRESTARTER, which achieves persistence through CSP_MOUNT_LIST manipulation and executes arbitrary shellcode within the LINA process.
Cisco researchers demonstrated a technique to compromise Anthropic Claude Code's memory.md file through NPM post-install hooks, achieving persistent code injection across sessions and projects.
The Bitwarden CLI package was briefly compromised via a malicious npm release, part of a broader supply chain campaign linked to Checkmarx, stealing developer secrets and CI/CD tokens.
North Korean threat actor TraderTraitor is suspected in the $290M KelpDAO DeFi hack, which exploited compromised LayerZero RPC nodes rather than a smart contract flaw.