Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,555 stories synthesized.
The DFIR Report dissects an intrusion where attackers exploited CVE-2025-55182 to deploy EtherRAT, evolved to the TukTuk framework, and ultimately deployed The Gentlemen ransomware.
Trend Micro researchers have uncovered GhostPenguin, a previously unknown Linux backdoor with extremely low detection rates, discovered through an AI-driven automated threat hunting pipeline.
A critical CVSS 10.0 vulnerability in React Server Components allows unauthenticated attackers to execute arbitrary code on servers via a single HTTP request, with active exploitation already observed.
Volexity reports that Russian threat actor UTA0355 is conducting targeted phishing campaigns abusing Microsoft 365 OAuth and Device Code authentication workflows, spoofing legitimate European security events.
A PureRAT campaign is targeting job seekers with email lures that weaponize Foxit PDF Reader for DLL side-loading, enabling credential theft and system compromise.
ESET researchers have uncovered a new MuddyWater campaign targeting Israeli organizations and one Egyptian entity, deploying previously undocumented tools including the Fooder loader and MuddyViper backdoor.
Trend Micro reveals Water Saci threat actors are using AI-driven code conversion to rapidly evolve malware delivery, shifting from PowerShell to Python scripts to spread banking trojans via WhatsApp in Brazil.
Trend Micro reveals Shai-hulud 2.0, a sophisticated malware campaign that steals cloud credentials and automatically backdoors NPM packages, creating a wormable supply-chain threat.
GitLab released versions 18.6.1, 18.5.3, and 18.4.5 on November 26, 2025, fixing seven vulnerabilities including a high-severity race condition in CI/CD cache and an unauthenticated authentication bypass.
WatchTowr Labs discovered over 80,000 saved JSON fragments on public online tools like JSONFormatter and CodeBeautify, leaking credentials and secrets from critical infrastructure organizations.
ESET researchers have uncovered PlushDaemon, a China-aligned threat actor active since 2018, that uses a previously undocumented network implant called EdgeStepper to hijack software updates via adversary-in-the-middle attacks.
Trend Micro researchers have documented five S3 ransomware variants that exploit misconfigured AWS buckets and stolen IAM credentials to encrypt, delete, or exfiltrate cloud-stored data.
A critical authentication bypass vulnerability in Fortinet FortiWeb, CVE-2025-64446, is being actively exploited, allowing unauthenticated attackers to add admin accounts and fully compromise devices.
Trend Micro reports that cybercriminals are increasingly using autonomous AI tools, including Anthropic's Claude Code, to automate attacks, urging enterprises to adopt agentic AI-driven defenses.
After a brief decline following the doxxing of its operators, Lumma Stealer has returned with adaptive browser fingerprinting techniques that enhance victim profiling and evade security controls.
Drupal has released security updates for all supported branches to fix CVE-2025-13083, a moderately critical information disclosure vulnerability in the core system module that can leak private files via CDN caching.
Drupal has released patches for a moderately critical defacement vulnerability (CVE-2025-13082) affecting core versions 8.0.0 through 11.2.7.
Drupal has released patches for a moderately critical gadget chain vulnerability in core that, when combined with a separate insecure deserialization flaw, could allow remote code execution.
Drupal has released security updates for a moderately critical cache poisoning vulnerability (CVE-2025-13080) affecting all supported branches, allowing attackers to poison cached responses.
WatchTowr Labs has disclosed two vulnerabilities in Citrix NetScaler appliances, including a reflected XSS (CVE-2025-12101) and a memory leak triggered by misconfiguration, highlighting ongoing fragility in memory management.
GitLab released versions 18.5.2, 18.4.4, and 18.3.6 on November 12, 2025, fixing seven security vulnerabilities including a high-severity stored cross-site scripting flaw in the Kubernetes proxy functionality.
ESET's latest APT activity report reveals China-aligned groups increasingly using adversary-in-the-middle techniques and targeting Latin America, while Iran's MuddyWater boosts internal spearphishing and North Korea expands operations to Uzbekistan.
A new SEO poisoning campaign on Bing targets users searching for ManageEngine OpManager, delivering Bumblebee malware that leads to Akira ransomware deployment within 44 hours.
Jenkins released a security advisory on October 29, 2025, addressing 10 vulnerabilities across multiple plugins, including high-severity SAML replay and XXE issues.