Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,559 stories synthesized.
A critical integer overflow in Canon imageCLASS MF654Cdw printers, discovered at Pwn2Own, lets unauthenticated attackers execute arbitrary code by sending a crafted TrueType font.
A critical unauthenticated remote code execution vulnerability (CVE-2026-4149) in Sonos Era 300 speakers allows attackers to execute arbitrary code at the kernel level via a flaw in SMB response handling.
A hard-coded credentials vulnerability in the QNAP TS-453E Hyper Data Protector Plugin, discovered at Pwn2Own, lets network-adjacent attackers bypass authentication without any credentials.
A use-after-free vulnerability in the Linux kernel's nf_tables subsystem, discovered at Pwn2Own and tracked as CVE-2022-32250, lets local attackers escalate privileges to root.
A SQL injection vulnerability in the QNAP TS-453E Hyper Data Protector Plugin, discovered at Pwn2Own, lets authenticated attackers bypass authentication and execute arbitrary code as root.
A critical code injection vulnerability in the malware_remover.cgi endpoint of QNAP TS-453E devices, disclosed at Pwn2Own, allows unauthenticated network-adjacent attackers to execute arbitrary Python code with root privileges.
Trend Micro reveals a sophisticated Warlock attack chain exploiting SharePoint vulnerabilities, using BYOVD and legitimate tools like TightVNC and Velociraptor for persistence and lateral movement.
International law enforcement has taken down SocksEscort, a malicious proxy service that compromised over 360,000 routers and IoT devices worldwide since 2020 to facilitate cybercrime.
Check Point Research has published a detailed analysis of the Handala Hack persona, revealing the evolving tactics of the Iranian MOIS-affiliated threat actor Void Manticore, including the use of NetBird tunneling and AI-assisted PowerShell wipers.
Zimperium researchers have uncovered PixRevolution, an Android banking trojan that uses live screen streaming and accessibility permissions to hijack Brazil's PIX instant payment transfers in seconds.
Two critical vulnerabilities in n8n, including a zero-click unauthenticated RCE bug (CVE-2026-27493), allow attackers to fully compromise servers and decrypt stored credentials.
CISA has issued Emergency Directive 26-03 over active exploitation of CVE-2026-20127, a critical authentication bypass in Cisco Catalyst SD-WAN that gives unauthenticated attackers administrative access to federal networks.
Pro-Iranian hacking group Handala has claimed a devastating wiper attack on medical technology firm Stryker, wiping over 200,000 systems and exfiltrating 50TB of data, forcing offices in 79 countries to shut down.
Iran-linked hacktivist group Handala claims to have wiped data from over 200,000 systems at medical technology firm Stryker, forcing the company to send home 5,000 workers in Ireland and disrupting hospital supply chains.
Tenable Research has disclosed nine cross-tenant vulnerabilities in Google Looker Studio, collectively named LeakyLooker, that could allow attackers to run arbitrary SQL queries and access sensitive cloud data across tenants.
Rapid7 warns that a global campaign has compromised over 250 legitimate WordPress sites since December 2025 to deliver infostealer malware via fake Cloudflare Captcha pages and ClickFix social engineering.
Aryaka Threat Research Lab has uncovered a persistent malware campaign targeting HR and recruiting staff with phishing emails disguised as job applications, deploying the BlackSanta EDR-killer module to disable endpoint defenses.
Apple released iOS 16.7.15 (build 20H380) on March 11, 2026, addressing security vulnerabilities in the iOS 16 operating system.
Apple released iPadOS 16.7.15 (build 20H380) on March 11, 2026, delivering security fixes for iPad models that cannot upgrade to newer iPadOS versions.
Apple has released iPadOS 15.8.7 (build 19H411) as a security update for older iPad models, addressing unspecified vulnerabilities.
Apple has released iOS 15.8.7 (build 19H411) as a security update for older iPhone and iPad models, addressing unspecified vulnerabilities in the operating system.
Palo Alto Networks' Unit 42 has developed AdvJudge-Zero, an automated fuzzer that exploits LLM-based 'AI Judge' guardrails to authorize policy-violating outputs with a 99% success rate across multiple model architectures.
Trail of Bits has identified six common vulnerability patterns in ERC-4337 smart accounts after auditing dozens of implementations, warning that a single bug can be as catastrophic as leaking a private key.
Microsoft's March 2026 Patch Tuesday addresses 79 vulnerabilities, including two publicly disclosed zero-days: an SQL Server elevation of privilege bug and a .NET denial-of-service flaw.