Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,507 stories synthesized.
FortiGuard Labs has uncovered a campaign exploiting CVE-2024-3721 in TBK DVR systems to deploy Nexcorium, a multi-architecture Mirai-based botnet targeting ARM, MIPS, and x86-64 devices for DDoS attacks.
Check Point Research reveals that The Gentlemen ransomware-as-a-service operation has claimed over 320 victims, with affiliates deploying SystemBC proxy malware to establish covert tunnels in corporate networks.
Kaspersky researchers have uncovered over 20 phishing apps in the Apple App Store that masquerade as legitimate crypto wallets and use iOS provisioning profiles to install trojanized wallet versions that steal recovery phrases and private keys.
Attackers used a Lumma Stealer infection at Context.ai to compromise OAuth tokens and access Vercel's internal systems, exposing customer environment variables.
Unit 42 has identified Iranian threat group CL-STA-1128 (Cyber Av3ngers) actively targeting Rockwell Automation OT/ICS systems, with over 5,600 exposed IPs globally and a new CISA advisory issued.
The Metasploit Framework released seven new modules this week, including exploits for critical vulnerabilities in AVideo, openDCIM, Selenium Grid, and ChurchCRM, alongside three new Windows persistence techniques.
Forescout's Vedere Labs tested 50 AI models and found that in 2026 all can complete vulnerability research tasks, with half able to autonomously generate working exploits, including four zero-days discovered in OpenNDS.
A trojanized copy of the WowShipping Pro WordPress plugin contains a dropper that silently installs a full-featured remote access toolkit, with the vendor releasing a fix on March 22, 2026.
The FBI has dismantled the W3LL phishing platform and arrested its developer, while Ukraine's CERT-UA warns of the AgingFly malware campaign targeting government and healthcare, and attackers actively exploit a critical Nginx UI vulnerability (CVE-2026-33032) for full server takeover.
Trail of Bits researchers exploited memory safety and logic vulnerabilities in Google's Rust-based zero-knowledge proof code to forge a proof that falsely claims a quantum circuit can break elliptic curve cryptography in 9 minutes with zero Toffoli gates.
Palo Alto Networks' Unit 42 has analyzed active exploitation attempts targeting CVE-2023-33538, a command injection vulnerability in end-of-life TP-Link routers, finding that while current payloads are flawed, the underlying risk remains significant due to default credential reuse.
A critical missing authentication vulnerability in Nginx UI (CVE-2026-33032, CVSS 9.8) is being actively exploited in the wild, allowing unauthenticated attackers to take full control of managed Nginx servers.
Cisco Talos has disclosed a critical use-after-free vulnerability in Foxit Reader (CVE-2026-3779) and six heap-based buffer overflow and integer overflow flaws in the LibRaw library, all of which have been patched by the respective vendors.
Cisco Talos' Q1 2026 vulnerability pulse reveals networking gear accounts for 20% of Known Exploited Vulnerabilities, attackers are weaponizing the n8n AI workflow platform for malware delivery, and AI-relevant CVEs rose to 121.
Attackers are actively exploiting CVE-2026-0740, a critical arbitrary file upload vulnerability in the Ninja Forms – File Upload WordPress plugin, with over 118,600 blocked exploit attempts since April 6, 2026.
Wordfence's weekly vulnerability report reveals 157 flaws across 141 plugins and 23 themes, with 11 rated critical severity and 17 remaining unpatched as of April 12, 2026.
Cleafy researchers have identified APK malformation as a standard evasion technique in over 3,000 Android malware samples, including Teabot, TrickMo, Godfather, and SpyNote, allowing malicious apps to bypass static analysis tools while installing normally.
Cookeville Regional Medical Center in Tennessee has begun notifying 337,917 patients that their personal and medical data was stolen in a July 2025 ransomware attack carried out by the Rhysida group.
Rapid7 has uncovered a ClickFix phishing campaign that uses a fake installer for the AI tool Claude to deliver a multi-stage payload targeting organizations in the EU and US.
Cisco Talos has uncovered PowMix, a previously undocumented botnet targeting Czech organizations since December 2025, using randomized C2 beaconing and AMSI-bypassing PowerShell loaders.
Apple has released Xcode 26.4.1 (17E202), a security-focused update for its integrated development environment, addressing vulnerabilities that could impact developers and the applications they build.
A systemic vulnerability in Anthropic's Model Context Protocol allows arbitrary command execution via the STDIO interface, potentially affecting over 150 million downloads and 200,000 instances.
Drupal has released version 11.3.7 to fix a moderately critical stored cross-site scripting vulnerability in CKEditor 5's entity suggestion feature, tracked as CVE-2026-6367.
Drupal has released security updates to fix a gadget chain vulnerability, CVE-2026-6366, that could enable remote code execution or SQL injection when combined with an insecure deserialization flaw.