Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,960 stories synthesized.
A firewall bypass vulnerability in QNAP QHora-322 routers, reported through the Pwn2Own contest, allows unauthenticated network-adjacent attackers to bypass IPv6 firewall rules on PPPoE connections.
A local privilege escalation vulnerability in NoMachine (CVE-2026-5054) allows attackers with low-privileged code execution to gain root access via improper file path validation.
A local privilege escalation vulnerability in NoMachine, tracked as CVE-2026-5055, allows attackers with low-privileged code execution to gain SYSTEM access via an uncontrolled search path element.
A critical authentication bypass vulnerability in QNAP QHora-322 routers, CVE-2024-13088, was disclosed on March 30, 2026, as part of the Pwn2Own hacking contest, allowing network-adjacent attackers to authenticate using an arbitrary QCloud account without credentials.
CVE-2026-0955, an out-of-bounds read vulnerability in Digilent DASYLab's DSA file parsing, could allow remote attackers to execute arbitrary code by tricking users into opening a malicious file.
A high-severity out-of-bounds read vulnerability in Digilent DASYLab (CVE-2026-0956) allows remote code execution when users open specially crafted DSA files.
A critical out-of-bounds write vulnerability in Digilent DASYLab, tracked as CVE-2026-0957, allows remote attackers to execute arbitrary code by tricking users into opening a malicious DSA file.
A critical integer overflow vulnerability in the vmwgfx driver of Red Hat Enterprise Linux, discovered during Pwn2Own, allows local attackers to escalate privileges to kernel level.
Three days after compromising LiteLLM, TeamPCP published malicious Telnyx SDK versions to PyPI, using WAV audio steganography and split-file injection to steal credentials across Windows, Linux, and macOS.
watchTowr Labs reveals that CVE-2026-3055 actually covers at least two memory overread vulnerabilities in Citrix NetScaler, with exploitation in the wild observed since March 27th.
Check Point Research reveals that a single developer used a commercial AI-powered IDE to build the sophisticated VoidLink Linux malware framework in under a week, marking a turning point in AI-assisted cybercrime.
Citrix disclosed CVE-2026-3055, a critical memory overread vulnerability in NetScaler ADC and Gateway, with watchTowr Labs warning of a troubling pattern of similar flaws.
Push Security has identified a new wave of Adversary-in-the-Middle phishing pages targeting TikTok for Business accounts, registered on March 24, 2026, using TikTok- or Google-themed content hosted behind Cloudflare.
TeamPCP has compromised the official Telnyx Python SDK on PyPI, publishing malicious versions that exfiltrate SSH private keys and bash history at install time.
The Silver Fox threat actor is conducting a targeted spearphishing campaign against Japanese manufacturers and businesses, exploiting the country's tax filing and HR change season to deliver ValleyRAT.
Researchers at Georgia Tech have documented 74 confirmed CVEs directly introduced by AI coding tools like Claude Code, with 35 disclosed in March 2026 alone, and estimate the real number is 400-700 cases across open-source projects.
A CloudSEK honeypot study reveals that attackers began exploiting CVE-2026-21962, a critical Oracle WebLogic RCE vulnerability with a CVSS score of 10.0, on the same day public exploit code was released.
Researchers at eSentire have uncovered a new EtherRAT campaign that uses Ethereum smart contracts to store command-and-control addresses, enabling stealthy, low-cost infrastructure rotation.
The Iran-linked Pay2Key ransomware group has resurfaced with advanced evasion and anti-forensics capabilities, targeting a US healthcare provider and encrypting its entire infrastructure in three hours.
Trend Micro reveals that TeamPCP compromised the LiteLLM AI proxy package on PyPI, deploying a three-stage malware that stole cloud credentials and Kubernetes secrets in a cascading supply chain attack.
Russia-aligned APT group Pawn Storm has deployed a new malware suite called PRISMEX to target the defense supply chain of Ukraine and its allies, exploiting a Windows zero-day and using steganography to evade detection.
Group-IB research reveals cloud phones—remote Android devices hosted in data centers—are increasingly used in financial fraud, including creating dropper accounts for authorized push payment fraud.
The TeamPCP threat group has compromised the LiteLLM Python package on PyPI, stealing SSH keys, cloud credentials, and Kubernetes secrets from environments with over 95 million monthly downloads.
Security firm Expel has uncovered a wave of malicious Chrome extensions that secretly monitor browser tabs for AI chatbot sessions and exfiltrate user prompts and responses to attacker-controlled servers.