Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,960 stories synthesized.
Trend Micro reveals PeckBirdy, a JScript-based C2 framework used by China-aligned APT groups since 2023 to abuse legitimate system tools for stealthy attacks on gambling and government targets.
ESET Research has attributed a late-2025 cyberattack on Poland's power grid to the Russia-aligned Sandworm APT group, which deployed a new data-wiping malware named DynoWiper on the 10th anniversary of Sandworm's 2015 BlackEnergy attack on Ukraine.
A critical arbitrary file upload vulnerability (CVE-2025-67968) in the RealHomes CRM WordPress plugin allows any authenticated Subscriber+ user to upload arbitrary files, leading to full site takeover.
WatchTowr discloses an unauthenticated password reset bypass in SmarterTools SmarterMail that lets attackers hijack the system admin account, with evidence of in-the-wild exploitation after the patch was released.
A watering hole attack compromised the EmEditor download page, distributing a malicious installer that deploys multi-stage malware capable of credential theft, data exfiltration, and lateral movement.
Wiz researchers uncovered a critical cloud-stunt vulnerability in the AWS Console that, combined with a supply-chain issue in AWS CodeBuild, could have allowed attackers to gain control of any AWS customer's environment.
GitLab released versions 18.8.2, 18.7.2, and 18.6.4 on January 21, 2026, patching multiple vulnerabilities including an unauthenticated denial-of-service in Jira Connect and a 2FA bypass flaw.
A multi-stage campaign dubbed Evelyn Stealer is targeting software developers through malicious Visual Studio Code extensions, leveraging a sophisticated infection chain that hijacks browser sessions and exfiltrates cryptocurrency wallets and credentials.
Trend Micro's new ÆSIR platform uses AI automation with human oversight to discover zero-day vulnerabilities in AI infrastructure, uncovering 21 CVEs across NVIDIA, Tencent, and MLflow since mid-2025.
A critical unauthenticated privilege escalation vulnerability (CVE-2026-23800) in the Modular DS WordPress plugin is being actively exploited, allowing attackers to gain admin access on over 40,000 sites.
Trail of Bits researchers have identified architectural isolation flaws in multiple agentic browsers that enable attacks functionally identical to XSS and CSRF, resurrecting vulnerabilities the web security community spent years patching.
Trend Micro's analysis of the 2025 MITRE ATT&CK Evaluation reveals modern attack chains from SHADOW-AETHER-015 and Earth Preta, validated through TrendAI Vision One.
Trend Micro researchers detail a multi-stage AsyncRAT campaign exploiting Cloudflare's free-tier infrastructure and legitimate Python environments to evade detection.
A pre-authentication remote code execution vulnerability rated CVSS 10.0 has been disclosed in SmarterTools SmarterMail, silently patched in October 2025 but only publicly revealed in late December 2025.
GitLab released versions 18.7.1, 18.6.3, and 18.5.5 on January 7, 2026, fixing multiple vulnerabilities including two high-severity cross-site scripting flaws in Markdown placeholders and the Web IDE.
Trail of Bits has released go-panikint, a modified Go compiler that turns silent integer overflows into explicit panics, exposing a hidden class of vulnerabilities during fuzzing.
ESET researchers have analyzed CVE-2025-50165, a critical Windows Imaging Component RCE flaw, concluding that exploitation is more difficult than Microsoft's initial assessment suggested.
ESET researchers have discovered a previously undocumented China-aligned APT group, dubbed LongNosedGoblin, that has been conducting cyberespionage against governmental entities in Southeast Asia and Japan since at least September 2023, using Group Policy for lateral movement and cloud services for command and control.
The DFIR Report has published a detailed breakdown of a Lynx ransomware intrusion that began with a single RDP logon using compromised credentials, revealing the full attack chain and C2 infrastructure.
A critical arbitrary file upload vulnerability in the Motors WordPress theme, tracked as CVE-2025-64374, allows any authenticated user to install and activate arbitrary plugins, leading to full site takeover.
The final Risky Business show of 2025 covers Venezuela's state oil firm PDVSA blaming the US for a ransomware/wiper attack, ongoing React2Shell exploitation, and Microsoft finally disabling RC4 in Active Directory Kerberos.
ESET's H2 2025 Threat Report reveals the first known AI-driven ransomware, PromptLock, and a 40% projected rise in ransomware victims, while Lumma Stealer detections plummet 86% after global disruption.
Trend Micro researchers have identified a new threat actor, SHADOW-VOID-042, using spear-phishing campaigns with social engineering lures that closely resemble the tactics of the Russian-aligned Void Rabisu group.
A privilege escalation vulnerability (CVE-2025-64188) in the Soledad WordPress theme allows any logged-in user to take over a site by modifying global settings.