Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,942 stories synthesized.
Trail of Bits has redesigned Sigstore's cryptographic architecture to support algorithm suites, enabling post-quantum readiness and compliance without repeating past agility flaws.
A SQL injection vulnerability (CVE-2025-67987) in the Quiz and Survey Master WordPress plugin, with over 40,000 active installations, allows any authenticated user with Subscriber-level access or higher to execute arbitrary SQL commands.
ESET researchers have uncovered an Android spyware campaign using a fake dating app called GhostChat to target individuals in Pakistan, exfiltrating sensitive data through hardcoded access codes and fake female profiles.
Apple has released iOS 12.5.8 (build 16H88) for older iPhone, iPad, and iPod touch models, addressing undisclosed security vulnerabilities.
Apple has released iPadOS 12.5.8 (build 16H88) for older iPad models, addressing security vulnerabilities that could be exploited by attackers.
Security researchers collected over $1 million for responsibly disclosing 76 zero-day vulnerabilities targeting connected vehicles, EV chargers, and automotive systems at Pwn2Own Automotive 2026 in Tokyo.
Trend Micro reveals PeckBirdy, a JScript-based C2 framework used by China-aligned APT groups since 2023 to abuse legitimate system tools for stealthy attacks on gambling and government targets.
ESET Research has attributed a late-2025 cyberattack on Poland's power grid to the Russia-aligned Sandworm APT group, which deployed a new data-wiping malware named DynoWiper on the 10th anniversary of Sandworm's 2015 BlackEnergy attack on Ukraine.
A critical arbitrary file upload vulnerability (CVE-2025-67968) in the RealHomes CRM WordPress plugin allows any authenticated Subscriber+ user to upload arbitrary files, leading to full site takeover.
WatchTowr discloses an unauthenticated password reset bypass in SmarterTools SmarterMail that lets attackers hijack the system admin account, with evidence of in-the-wild exploitation after the patch was released.
A watering hole attack compromised the EmEditor download page, distributing a malicious installer that deploys multi-stage malware capable of credential theft, data exfiltration, and lateral movement.
Wiz researchers uncovered a critical cloud-stunt vulnerability in the AWS Console that, combined with a supply-chain issue in AWS CodeBuild, could have allowed attackers to gain control of any AWS customer's environment.
GitLab released versions 18.8.2, 18.7.2, and 18.6.4 on January 21, 2026, patching multiple vulnerabilities including an unauthenticated denial-of-service in Jira Connect and a 2FA bypass flaw.
A multi-stage campaign dubbed Evelyn Stealer is targeting software developers through malicious Visual Studio Code extensions, leveraging a sophisticated infection chain that hijacks browser sessions and exfiltrates cryptocurrency wallets and credentials.
Trend Micro's new ÆSIR platform uses AI automation with human oversight to discover zero-day vulnerabilities in AI infrastructure, uncovering 21 CVEs across NVIDIA, Tencent, and MLflow since mid-2025.
A critical unauthenticated privilege escalation vulnerability (CVE-2026-23800) in the Modular DS WordPress plugin is being actively exploited, allowing attackers to gain admin access on over 40,000 sites.
Trail of Bits researchers have identified architectural isolation flaws in multiple agentic browsers that enable attacks functionally identical to XSS and CSRF, resurrecting vulnerabilities the web security community spent years patching.
Trend Micro's analysis of the 2025 MITRE ATT&CK Evaluation reveals modern attack chains from SHADOW-AETHER-015 and Earth Preta, validated through TrendAI Vision One.
Trend Micro researchers detail a multi-stage AsyncRAT campaign exploiting Cloudflare's free-tier infrastructure and legitimate Python environments to evade detection.
A pre-authentication remote code execution vulnerability rated CVSS 10.0 has been disclosed in SmarterTools SmarterMail, silently patched in October 2025 but only publicly revealed in late December 2025.
GitLab released versions 18.7.1, 18.6.3, and 18.5.5 on January 7, 2026, fixing multiple vulnerabilities including two high-severity cross-site scripting flaws in Markdown placeholders and the Web IDE.
Trail of Bits has released go-panikint, a modified Go compiler that turns silent integer overflows into explicit panics, exposing a hidden class of vulnerabilities during fuzzing.
ESET researchers have analyzed CVE-2025-50165, a critical Windows Imaging Component RCE flaw, concluding that exploitation is more difficult than Microsoft's initial assessment suggested.
ESET researchers have discovered a previously undocumented China-aligned APT group, dubbed LongNosedGoblin, that has been conducting cyberespionage against governmental entities in Southeast Asia and Japan since at least September 2023, using Group Policy for lateral movement and cloud services for command and control.