Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,561 stories synthesized.
A critical unauthenticated server-side request forgery vulnerability in the PublicCMS getXml method, disclosed as a 0-day by ZDI, allows remote attackers to disclose sensitive information with no patch forthcoming.
Microsoft has declined to patch a newly disclosed zero-day vulnerability in Windows library-ms file parsing that leaks NTLM responses to network-adjacent attackers, prompting ZDI to publish a public advisory.
North Korea-linked threat actor Void Dokkaebi is using fake job interviews to trick developers into downloading malware from compromised code repositories, creating a self-propagating supply chain attack.
Darktrace researchers have discovered ZionSiphon, a new malware strain designed to compromise water treatment and desalination OT systems, combining privilege escalation and USB propagation with attempts to modify chlorine dosing and pressure parameters.
Two active phishing campaigns are delivering the Formbook infostealer to Windows systems using DLL sideloading via RAR attachments and obfuscated JavaScript hidden in PDF files, targeting organizations across Europe and South America.
Check Point's weekly threat intelligence report details multiple high-profile breaches, including Booking.com, McGraw-Hill, and EssentialPlugin, alongside active exploits for Apache ActiveMQ and Splunk.
FortiGuard Labs has uncovered a campaign exploiting CVE-2024-3721 in TBK DVR systems to deploy Nexcorium, a multi-architecture Mirai-based botnet targeting ARM, MIPS, and x86-64 devices for DDoS attacks.
Check Point Research reveals that The Gentlemen ransomware-as-a-service operation has claimed over 320 victims, with affiliates deploying SystemBC proxy malware to establish covert tunnels in corporate networks.
Kaspersky researchers have uncovered over 20 phishing apps in the Apple App Store that masquerade as legitimate crypto wallets and use iOS provisioning profiles to install trojanized wallet versions that steal recovery phrases and private keys.
Attackers used a Lumma Stealer infection at Context.ai to compromise OAuth tokens and access Vercel's internal systems, exposing customer environment variables.
Unit 42 has identified Iranian threat group CL-STA-1128 (Cyber Av3ngers) actively targeting Rockwell Automation OT/ICS systems, with over 5,600 exposed IPs globally and a new CISA advisory issued.
The Metasploit Framework released seven new modules this week, including exploits for critical vulnerabilities in AVideo, openDCIM, Selenium Grid, and ChurchCRM, alongside three new Windows persistence techniques.
Forescout's Vedere Labs tested 50 AI models and found that in 2026 all can complete vulnerability research tasks, with half able to autonomously generate working exploits, including four zero-days discovered in OpenNDS.
A trojanized copy of the WowShipping Pro WordPress plugin contains a dropper that silently installs a full-featured remote access toolkit, with the vendor releasing a fix on March 22, 2026.
The FBI has dismantled the W3LL phishing platform and arrested its developer, while Ukraine's CERT-UA warns of the AgingFly malware campaign targeting government and healthcare, and attackers actively exploit a critical Nginx UI vulnerability (CVE-2026-33032) for full server takeover.
Trail of Bits researchers exploited memory safety and logic vulnerabilities in Google's Rust-based zero-knowledge proof code to forge a proof that falsely claims a quantum circuit can break elliptic curve cryptography in 9 minutes with zero Toffoli gates.
Palo Alto Networks' Unit 42 has analyzed active exploitation attempts targeting CVE-2023-33538, a command injection vulnerability in end-of-life TP-Link routers, finding that while current payloads are flawed, the underlying risk remains significant due to default credential reuse.
A critical missing authentication vulnerability in Nginx UI (CVE-2026-33032, CVSS 9.8) is being actively exploited in the wild, allowing unauthenticated attackers to take full control of managed Nginx servers.
Cisco Talos has disclosed a critical use-after-free vulnerability in Foxit Reader (CVE-2026-3779) and six heap-based buffer overflow and integer overflow flaws in the LibRaw library, all of which have been patched by the respective vendors.
Cisco Talos' Q1 2026 vulnerability pulse reveals networking gear accounts for 20% of Known Exploited Vulnerabilities, attackers are weaponizing the n8n AI workflow platform for malware delivery, and AI-relevant CVEs rose to 121.
Attackers are actively exploiting CVE-2026-0740, a critical arbitrary file upload vulnerability in the Ninja Forms – File Upload WordPress plugin, with over 118,600 blocked exploit attempts since April 6, 2026.
Wordfence's weekly vulnerability report reveals 157 flaws across 141 plugins and 23 themes, with 11 rated critical severity and 17 remaining unpatched as of April 12, 2026.
Cleafy researchers have identified APK malformation as a standard evasion technique in over 3,000 Android malware samples, including Teabot, TrickMo, Godfather, and SpyNote, allowing malicious apps to bypass static analysis tools while installing normally.
Cookeville Regional Medical Center in Tennessee has begun notifying 337,917 patients that their personal and medical data was stolen in a July 2025 ransomware attack carried out by the Rhysida group.