Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,562 stories synthesized.
Cookeville Regional Medical Center in Tennessee has begun notifying 337,917 patients that their personal and medical data was stolen in a July 2025 ransomware attack carried out by the Rhysida group.
Rapid7 has uncovered a ClickFix phishing campaign that uses a fake installer for the AI tool Claude to deliver a multi-stage payload targeting organizations in the EU and US.
Cisco Talos has uncovered PowMix, a previously undocumented botnet targeting Czech organizations since December 2025, using randomized C2 beaconing and AMSI-bypassing PowerShell loaders.
Apple has released Xcode 26.4.1 (17E202), a security-focused update for its integrated development environment, addressing vulnerabilities that could impact developers and the applications they build.
A systemic vulnerability in Anthropic's Model Context Protocol allows arbitrary command execution via the STDIO interface, potentially affecting over 150 million downloads and 200,000 instances.
Drupal has released version 11.3.7 to fix a moderately critical stored cross-site scripting vulnerability in CKEditor 5's entity suggestion feature, tracked as CVE-2026-6367.
Drupal has released security updates to fix a gadget chain vulnerability, CVE-2026-6366, that could enable remote code execution or SQL injection when combined with an insecure deserialization flaw.
Drupal has released emergency security updates to fix a critical cross-site scripting vulnerability (CVE-2026-6365) in core's AJAX modal dialog jQuery integration, affecting versions 8.0.0 through 11.3.6.
A signed adware campaign linked to Dragon Boss Solutions LLC has disabled antivirus on over 23,000 hosts globally, using a legitimate code-signing certificate and a PowerShell script to kill security tools from Malwarebytes, Kaspersky, McAfee, and ESET.
A critical authentication bypass in nginx-ui, tracked as CVE-2026-33032 with a CVSS score of 9.8, is being actively exploited, allowing unauthenticated attackers to fully compromise nginx servers via a single API request.
Cisco Talos has uncovered a widespread campaign where threat actors abuse the n8n AI workflow automation platform to deliver malware and fingerprint devices via automated emails, with a 686% surge in malicious n8n webhook URLs observed by March 2026.
Researchers at Barracuda report a sharp rise in brute-force attacks targeting SonicWall and Fortinet edge devices, with 88% of attempts originating from Middle Eastern IPs amid heightened US-Israeli hostilities with Iran.
Microsoft's April 2026 Patch Tuesday addresses two zero-day vulnerabilities, including one actively exploited in SharePoint, and a critical RCE in Windows IKE service.
A supply-chain compromise has compromised over 20 WordPress plugins by EssentialPlugin after the vendor was sold to a malicious buyer on Flippa, who planted a PHP object-injection backdoor that remained dormant for seven months before triggering it on April 5, 2026.
Fortinet disclosed an out-of-bounds write vulnerability in the FortiWeb CGI daemon that could allow a remote privileged attacker to execute arbitrary code or commands via crafted HTTP requests.
A stack-based buffer overflow in HP DeskJet 2855e printers, disclosed by ZDI and demonstrated at Pwn2Own, lets unauthenticated network-adjacent attackers execute arbitrary code as root.
A critical memory corruption vulnerability in NI LabVIEW's LVLIB file parsing, tracked as CVE-2026-32860, allows remote code execution via a malicious file or webpage.
A critical out-of-bounds write vulnerability in Fortinet FortiWeb, tracked as CVE-2026-40688, allows authenticated remote attackers to execute arbitrary code with root privileges.
A critical stack-based buffer overflow vulnerability in GStreamer's qtdemux parser, tracked as CVE-2026-5056, allows remote attackers to execute arbitrary code via specially crafted media files.
A critical unauthenticated remote code execution vulnerability in QNAP TS-453E devices running the QVRPro Plugin allows network-adjacent attackers to execute arbitrary code as the postgres user.
Microsoft has released a security update for CVE-2026-32073, a CVSS 7.8 race condition in the afd.sys driver that lets low-privileged attackers gain kernel-level code execution on Windows.
A newly disclosed vulnerability in Adobe ColdFusion, tracked as CVE-2026-34619, allows authenticated remote attackers to delete arbitrary files through a directory traversal flaw in the deleteVersion method.
A 0-day privilege escalation vulnerability in Docker Desktop has been publicly disclosed after Docker rejected the report, allowing attackers with container escape access to execute arbitrary code on the host system.
ATEN has released a security update for a critical missing-authentication vulnerability in its Unizon management platform that allows unauthenticated remote attackers to trigger a denial-of-service condition.