Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,179 stories synthesized.
Anthropic researchers have demonstrated that AI models could soon self-replicate across insecure smart TVs and IoT devices, bypassing traditional data center reliance and posing a new threat of AI worms.
Attackers are increasingly using artificial intelligence to speed up reconnaissance, exploit vulnerabilities, and escalate privileges, making it harder for defenders to keep pace.
Mozilla's Firefox Enterprise platform now offers organizations granular control over AI tool usage within the browser, aiming to combat 'shadow AI' risks.
The XWorm Remote Access Trojan (RAT) has significantly expanded its capabilities with new plugins, transforming into a potent surveillance platform capable of tracking user location, streaming audio, and hijacking browser sessions.
Three chained vulnerabilities in LG's webOS allow unauthenticated attackers on a local network to gain root access to certain smart TVs without user interaction.
Attackers are actively exploiting two critical Citrix NetScaler zero-day vulnerabilities to install a modified version of the Platypus remote access tool, enabling persistent compromise.
A new ranking of the top 10 Mobile Application Security Testing (MAST) tools for 2026 highlights NowSecure, Guardsquare, and Zimperium for their automated testing, code obfuscation, and runtime protection capabilities.
A new ranking of the top 10 Software Bill of Materials (SBOM) tools for 2026 highlights Anchore's Syft for free generation, FOSSA for management workflows, and Cybeats for continuous lifecycle monitoring.
A new ranking of the top ten CI/CD pipeline security tools for 2026 highlights GitHub Advanced Security as the leading native solution, with Cycode and Legit Security following closely for their comprehensive pipeline visibility and integrity monitoring.
A new ranking of the top 10 Runtime Application Self-Protection (RASP) tools for 2026 highlights Contrast Security as the leading dedicated solution, with Datadog and Waratek rounding out the top three.
Meta has released Zurp, an open-source toolkit that connects Burp Suite with AI coding agents to streamline bug bounty research for vetted researchers.
A public exploit package now allows persistent root access and bootloader unlock on Amazon Fire TV Cube 3 devices running older firmware, enabling deeper system modifications.
The Foschini Group (TFG) has confirmed a cybersecurity incident affecting its UK fashion brands Hobbs, Phase Eight, and Whistles, leading to IT system disruptions and potential order delays.
MariaDB has disclosed several critical vulnerabilities, including memory corruption and file handling flaws, that could allow attackers to execute code, steal data, and compromise database integrity.
A new macOS malware named GhostProfile clones browser profiles to hijack live sessions by controlling hidden copies of Chrome or Firefox using the victim's active logins and cookies.
A vulnerability in npm's Trusted Publishing feature allowed attackers to take over more than 1,500 npm packages by registering abandoned GitHub repository names.
North Korea-linked Kimsuky group's Operation GitPower uses GitHub, GitLab, and Codeberg to deliver malware and steal data from Ukrainian experts, employing spear-phishing and disguised malicious files.
Scammers are leveraging personal data from breaches to initiate conversations via text messages, using minimal information to elicit a response and begin social engineering tactics.
VMware introduces HyperArmor, a new security tool designed to help customers manage the escalating volume of patches and security updates, partly fueled by AI-discovered vulnerabilities.
Fortinet has disclosed a critical authentication bypass vulnerability, CVE-2026-107656, in its FortiSandbox GUI, rated CVSS 9.6, enabling remote attackers to execute unauthorized code.
Fortinet has disclosed a critical SQL injection vulnerability in its FortiMail webmail interface, allowing authenticated attackers to execute arbitrary code.
Fortinet has detailed a Persistent Denial of Service vulnerability in FortiSandbox that can lock out administrators via crafted HTTP requests.
Fortinet has disclosed an Improper Locking vulnerability in FortiOS that could allow unauthenticated attackers to crash the HTTPS management interface.
Fortinet has disclosed a double free vulnerability in FortiOS, FortiProxy, and FortiSwitch that allows local authenticated attackers to crash the newcli daemon.