Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,728 stories synthesized.
A new macOS information stealer, PamStealer, has been discovered by Jamf Threat Labs, impersonating the Maccy clipboard manager and exploiting Pluggable Authentication Modules (PAM) to steal user credentials.
Intezer has launched Custom Agents, allowing security teams to build their own AI agents within the Intezer platform to automate unique security tasks and workflows.
A new study analyzing SSH honeypots reveals a significant shift in attacker tactics, with non-interactive commands making up over 99% of post-login sessions.
A researcher leveraged Anthropic's Claude AI to exploit an unauthenticated SQL injection in Front Gate Tickets, gaining administrative control over major US music festival ticketing.
A former European Parliament member, Stelios Kouloglou, was repeatedly infected with Pegasus spyware while serving on a committee investigating the misuse of such surveillance tools.
Digi International introduces DANI, an AI-powered network operations agent embedded in its Digi Remote Manager (DRM) platform, to automate diagnostics and improve network visibility.
A developer was unexpectedly charged over $11,000 by Google Cloud for AI image generation after their account was hijacked via a compromised Firebase service account key.
Video conferencing startup MeetingTV is suing Palo Alto Networks' Koi Security, alleging an AI-generated threat report falsely linked the company to Chinese espionage, leading to global service disruptions.
Researchers at Palo Alto Networks have successfully reverse-engineered and integrated WebAuthn authentication into a browser-based RDP client, enabling passwordless access via hardware security keys.
The FCC's ban on foreign-manufactured routers, despite recent waivers, risks leaving millions of home routers without critical security updates, potentially impacting home security systems.
Apple is shifting its long-standing patch release strategy to a faster cadence, acknowledging the escalating threat posed by AI-driven cyberattacks that shorten the window for exploitation.
The FBI, with industry partners, has seized hundreds of domains associated with NetNut, a residential proxy service linked to the Popa botnet, disrupting a major tool used by cybercriminals.
Wordfence Intelligence has identified 199 vulnerabilities across 169 WordPress plugins and 9 themes during the week of June 22-28, 2026, highlighting ongoing security challenges in the popular CMS ecosystem.
Cisco Talos researchers have identified ARToken, a sophisticated phishing-as-a-service platform that shares infrastructure and operational patterns with the EvilTokens platform, offering advanced capabilities for business email compromise operations.
A sophisticated phishing campaign is distributing the AsyncRAT malware by abusing trusted cloud services like Dropbox and TryCloudflare tunnels, employing a multi-stage process involving obfuscated scripts and Python for stealthy payload deployment.
A Chinese businessman received a 30-year sentence for a massive crypto fraud, while a Hollywood director was jailed for defrauding Netflix of $11 million intended for a film project.
A vulnerability chain in Anthropic's Claude Cowork for Windows allows local code execution to escalate privileges to root within the product's Linux sandbox, bypassing security protections.
CISA has issued an advisory detailing two critical vulnerabilities in ST Engineering iDirect iQ-Series terminals that could allow for unauthorized information access and denial-of-service conditions.
CISA has issued an advisory detailing critical vulnerabilities in Gardyn IoT Hub devices, including CVE-2026-13768, which could allow unauthenticated attackers to execute arbitrary commands and pivot to other network devices.
CISA has issued an advisory for CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20, detailing CVE-2026-13743, a vulnerability allowing malicious firmware uploads via physical access.
Malwarebytes Labs reports on ClickFix campaigns using fake Google and Cloudflare verification pages to trick users into executing malicious commands, distributing multiple malware families.
Microsoft is implementing enhanced security measures and stricter vetting for its Cloud Solution Providers (CSPs) to counter nation-state actors exploiting partners as an entry point to customer networks.
This week's security landscape is marked by diverse threats, from AI compute hijacking and an Apple email privacy flaw to sophisticated ransomware campaigns and platform-aware phishing.
A researcher chained a guardrail bypass with a path traversal vulnerability in ChatGPT's file download feature to access sensitive system files like /etc/passwd.