Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,960 stories synthesized.
Trail of Bits released CoBRA, an open-source tool that simplifies Mixed Boolean-Arithmetic (MBA) obfuscation with a 99.86% success rate on over 73,000 expressions from seven datasets, giving malware analysts and reverse engineers a powerful new deobfuscation capability.
Researchers at Abnormal Security have uncovered a credential theft campaign from November 2025 to March 2026 targeting C-suite executives via a previously undocumented phishing-as-a-service platform named Venom, which uses AiTM and device code flow to bypass MFA.
A misconfigured npm package exposed Anthropic's internal Claude Code source code, and within 24 hours threat actors weaponized the leak to distribute Vidar and GhostSocks malware via fake GitHub repositories.
A critical arbitrary file deletion vulnerability (CVE-2026-4350) in the Perfmatters WordPress plugin, affecting over 200,000 sites, allows unauthenticated attackers to delete arbitrary files including wp-config.php via path traversal.
Researchers at Varonis have uncovered a new infostealer called Storm that exfiltrates encrypted browser data to attacker-controlled servers for remote decryption, bypassing endpoint security tools that flag local decryption attempts.
Apple has expanded iOS 18.7.7 and iPadOS 18.7.7 to additional devices, patching six vulnerabilities exploited by the DarkSword exploit kit in watering-hole attacks that deploy data-stealing malware.
Fortinet reports a multi-stage malware campaign targeting South Korean users via malicious LNK files that use GitHub repositories as a covert C2 channel.
Halcyon researchers report that the Akira ransomware group Akira can complete the entire attack lifecycle in under one hour, using intermittent encryption and zero-day exploits to maximize speed and evade detection.
WatchTowr researchers disclosed a pre-authenticated remote code execution chain in Progress ShareFile's on-premises Storage Zone Controller, affecting roughly 30,000 internet-facing instances.
Mozilla has patched a critical type confusion vulnerability in the IonMonkey JIT compiler's switch statement optimization, tracked as CVE-2026-4698, which allows remote code execution via a malicious webpage or file.
A command injection vulnerability in Microsoft Visual Studio Code's handling of mcp.json files allows remote code execution when a user opens a malicious project, with a CVSS score of 7.8.
A local privilege escalation vulnerability in Foxit PDF Reader's Update Service, tracked as CVE-2026-3775, allows attackers with low-privileged code execution to gain SYSTEM-level access.
Mandiant released a comprehensive defender's guide detailing the BRICKSTORM backdoor that targets VMware vSphere Virtual Center, providing persistent access to virtual infrastructure.
GitHub Security Lab warns of a growing attack pattern where adversaries compromise GitHub Actions workflows to exfiltrate secrets and publish malicious packages, urging adoption of OIDC-based trusted publishing and CodeQL workflow reviews.
Researchers at BlackFog have identified Venom Stealer, a malware-as-a-service platform that uses ClickFix social engineering to automate continuous credential theft and cryptocurrency wallet cracking.
Chinese state-backed group TA416 (Mustang Panda) has resumed targeted espionage campaigns against European governments after a lull since 2023, using web bugs, spoofed Cloudflare pages, OAuth redirects, and C# project files to deliver the PlugX backdoor.
Trail of Bits announced MuTON and mewt, two new mutation testing tools optimized for agentic use, along with a configuration optimization skill to help AI agents set up campaigns efficiently.
Threat actors hijacked the npm account of Axios maintainer Jason Saayman to publish malicious versions of the widely used JavaScript library, deploying cross-platform remote access Trojans that could compromise millions of developer environments.
This week's Risky Business podcast covers a North Korean backdoor in a 100M-downloads-a-week npm package, a TeamPCP breach of Cisco's source code, active exploitation of a Citrix NetScaler memory leak, and AI tools like Claude finding zero-day vulnerabilities.
Jonathan Spalletta, 36, has been charged with hacking the Uranium Finance decentralized exchange twice in April 2021, stealing over $53 million by exploiting smart contract flaws and laundering proceeds through Tornado Cash.
Group-IB has uncovered a sustained phishing campaign delivering Phantom Stealer, a .NET-based infostealer sold as part of a commercial toolkit with subscription tiers, targeting European logistics, manufacturing, and technology sectors.
Check Point Research discovered CVE-2026-3502, a zero-day vulnerability in the TrueConf video conferencing client exploited in a campaign dubbed 'TrueChaos' targeting Southeast Asian government entities with the Havoc payload.
Check Point researchers discovered a vulnerability in ChatGPT that enabled attackers to exfiltrate sensitive data, including messages and uploaded files, through a single malicious prompt exploiting a DNS side channel.
Wiz researchers report a 'dangerous convergence' as the TeamPCP supply chain threat group partners with Lapsus$ and Vect ransomware to validate, exfiltrate, and monetize stolen cloud and Kubernetes credentials.