Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,960 stories synthesized.
Apple has released emergency patches for CVE-2026-28950, a Notification Services flaw in iOS and iPadOS that caused deleted message alerts to persist in system storage, potentially exposing sensitive content to forensic recovery.
A joint international advisory details how China-nexus cyber actors are using large-scale covert networks of compromised SOHO routers and IoT devices for reconnaissance, malware delivery, and espionage.
The UK's National Cyber Security Centre warns that China-nexus cyber actors are constructing dynamic, large-scale covert networks from compromised routers and edge devices, rendering traditional static defenses ineffective.
Anthropic's Project Glasswing, powered by the Mythos Preview model, discovered vulnerabilities across major OSes and browsers including a 27-year-old bug in OpenBSD, but fewer than 1% were patched, exposing a critical remediation gap.
The FBI forensically recovered deleted Signal messages from an iPhone by accessing the device's push notification database, which retained message previews even after the app was removed.
Apple has fixed CVE-2026-28950, a logging flaw in iOS and iPadOS that caused deleted notifications—including chat message previews from apps like Signal—to be retained in a device database, a bug law enforcement exploited to recover messages from an unlocked iPhone.
Palo Alto Networks' Unit 42 researchers have built a proof-of-concept multi-agent LLM system called Zealot that autonomously chains SSRF exploitation, metadata service credential theft, and data exfiltration in Google Cloud Platform environments.
Palo Alto Networks Unit 42 researchers have built 'Zealot,' an autonomous multi-agent AI system that executed a complete cloud attack chain from initial access to data exfiltration in under three minutes using a single natural-language prompt.
Forcepoint researchers have identified 10 real-world indirect prompt injection payloads that poison web content to hijack AI agents, enabling data theft, file destruction, and fraudulent payments.
ESET has uncovered a China-aligned APT group, GopherWhisper, that has compromised at least 12 Mongolian government systems using a suite of Go-based backdoors that abuse legitimate services like Discord and Slack for command-and-control.
ESET researchers have uncovered a previously undocumented China-aligned APT group, GopherWhisper, which uses a suite of custom Go-based backdoors to target a Mongolian governmental entity.
Vercel has identified additional customer accounts compromised in a breach originating from Context.ai, with evidence of prior independent compromises via social engineering or malware.
Siemens SINEC NMS is vulnerable to an authentication bypass flaw (CVE-2026-24032, CVSS 7.3) that allows remote unauthenticated attackers to bypass authentication.
A critical stack-based buffer overflow vulnerability in Delta Electronics ASDA-Soft (CVE-2026-5726) allows remote code execution via malicious PAR files, with a CVSS score of 7.8 and a fix now available.
A high-severity local privilege escalation vulnerability in Docker Desktop's Enhanced Container Isolation feature, tracked as CVE-2026-6406, allows attackers with low-privileged code execution inside a container to break out and access host resources.
A high-severity privilege escalation vulnerability in Siemens SINEC NMS, tracked as CVE-2026-25654, allows authenticated remote attackers to access restricted resources.
Mandiant has identified a new threat group, UNC6692, that combines social engineering via Microsoft Teams with a custom modular malware suite to achieve deep network penetration.
The Gentlemen ransomware-as-a-service group has rapidly risen to prominence since mid-2025, claiming 202 attacks in Q1 2026 and deploying sophisticated tools like SystemBC and Cobalt Strike to compromise corporate environments at scale.
SentinelOne reveals three distinct zero-day supply chain attacks targeting LiteLLM, Axios, and CPU-Z in spring 2026, all blocked by its platform without prior signatures.
Cisco Talos research reveals that attackers are increasingly repurposing native macOS tools like Remote Application Scripting and Spotlight metadata for living-off-the-land attacks, exploiting the platform's growing enterprise presence.
An exposed server reveals a large-scale credential harvesting operation using the Bissa scanner platform, with AI tools embedded in the operator's workflow.
North Korean threat actor Void Dokkaebi has weaponized fake job interviews to turn compromised developer repositories into worm-like infection vectors, infecting over 750 repos in March 2026 alone.
A surge in phishing emails with empty subject lines is targeting high-value users, exploiting blind spots in email defenses and leveraging legitimate remote monitoring tools for persistence.
A malicious website posing as an AI-powered trading assistant called TradingClaw is distributing Needle Stealer, a modular Golang infostealer that can hijack browser sessions, steal cryptocurrency wallets, and install malicious browser extensions.