Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,960 stories synthesized.
A ransomware affiliate leak exposes the inner workings of a new ransomware group that splintered from Qilin, revealing advanced evasion techniques and internal tensions.
Zimperium zLabs reports a 56% increase in Android banking trojan attacks in 2025, with 1,243 financial brands targeted across 90 countries as malware families like TsarBot, CopyBara, and Hook dominate the threat landscape.
ESET researchers analyzed almost 90 EDR killers actively used in ransomware attacks, finding that affiliates choose the tools and driver-based attribution is often misleading.
AWS warns that the Interlock ransomware group has been exploiting CVE-2026-20131, a critical Cisco Secure Firewall Management Center zero-day, since January 26, with ongoing attacks.
A critical integer overflow vulnerability in GIMP's ANI file parsing, tracked as CVE-2026-4151, allows remote attackers to execute arbitrary code when a user opens a malicious ANI file.
A heap-based buffer overflow vulnerability in GIMP's PSP file parsing (CVE-2026-4153) could allow remote attackers to execute arbitrary code when a user opens a malicious PSP file. The flaw, disclosed by Zero Day Initiative as ZDI-26-220, carries a CVSS score of 7.8 and has been patched by the GIMP project.
A critical integer overflow vulnerability in GIMP's PSD file parser, tracked as CVE-2026-4150, allows remote attackers to execute arbitrary code when a user opens a malicious PSD file.
A heap-based buffer overflow in GIMP's JP2 file parsing (CVE-2026-4152) allows remote code execution when a user opens a crafted JP2 file, with a CVSS score of 7.8.
A critical integer overflow vulnerability in GIMP's XPM file parsing, tracked as CVE-2026-4154, can be exploited to achieve remote code execution via a specially crafted XPM file.
A targeted campaign uses copyright violation lures to deliver PureLog Stealer entirely in memory, hitting healthcare and government organizations in Germany and Canada.
A local privilege escalation vulnerability in Ubuntu Desktop 24.04 and later allows attackers to gain root access via a timing-based attack chain exploiting snap-confine and systemd-tmpfiles.
Okta Threat Intelligence has taken down the 'ShieldGuard' crypto scam, a malicious Chrome extension that stole wallet addresses, captured HTML content from major crypto platforms, and executed remote code via a command-and-control server.
Jenkins released a security advisory on March 18, 2026, fixing three vulnerabilities including a high-severity symlink bug that can lead to arbitrary code execution and a DNS rebinding flaw in the WebSocket CLI.
Acronis Threat Research Unit has uncovered a widespread campaign using hundreds of GitHub repositories and Reddit posts to distribute the Vidar 2.0 infostealer disguised as free game cheats.
watchTowr Labs disclosed four pre-authentication vulnerabilities in BMC FootPrints that chain to achieve remote code execution, affecting versions 20.20.02 to 20.24.01.001.
This week's Risky Business podcast covers Iran-linked hacktivists using Microsoft Intune to wipe devices at medical device maker Stryker, Qihoo 360 leaking a wildcard TLS private key from an AI agent, and vulnerabilities in IP KVMs from four manufacturers.
Mandiant reports that DarkSword, an iOS exploit chain using six zero-day vulnerabilities, is being deployed by multiple threat actors in targeted campaigns.
Trend Micro Research warns that electric grid operators must monitor east-west traffic inside operational networks to detect lateral movement attacks that bypass traditional perimeter defenses.
Attackers exploited a misconfigured Spring Boot Actuator endpoint and plaintext credentials in a spreadsheet to authenticate to SharePoint via the OAuth2 ROPC flow, bypassing MFA and exfiltrating data.
CloudSEK researchers have uncovered an Android attack technique that uses the LSPosed framework to manipulate the runtime environment manipulation, enabling attackers to hijack payment apps without modifying code or triggering Google Play Protect.
Proofpoint researchers have identified the CursorJack attack path, which abuses Model Context Protocol deeplinks in the Cursor IDE to enable code execution through social engineering.
QNAP has patched an authentication bypass vulnerability in its TS-453E NAS devices, discovered and exploited during Pwn2Own Berlin 2026 by the DEVCORE team.
Check Point's latest weekly threat intelligence report details a cyberattack on Stryker by Iranian group Handala Hack, a Telus Digital breach claimed by ShinyHunters, targeted phishing against Signal users, and active exploitation of vulnerabilities in SolarWinds, Chrome, and n8n.
Qualys researchers have discovered nine vulnerabilities in the Linux AppArmor security module, collectively named CrackArmor, that allow unprivileged local users to escalate privileges to root and bypass container isolation.