Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,561 stories synthesized.
The DFIR Report details a May 2024 intrusion by the Lunar Spider initial access group that began with a single click on a malicious JavaScript file masquerading as a tax form and persisted for nearly two months.
ESET research reveals DeceptiveDevelopment, a North Korea-aligned threat actor using fake job offers and AI-enhanced fake job offers and synthetic identities to target software developers in the cryptocurrency and Web3 sectors.
Trend Micro Research has identified LockBit 5.0 in the wild with Windows, Linux, and ESXi variants, featuring heavy obfuscation, cross-platform targeting, and improved evasion techniques.
GitLab released versions 18.4.1, 18.3.3, and 18.2.7 on September 25, 2025, fixing multiple security issues including a critical cross-site scripting vulnerability (CVE-2025-9642) and two denial-of-service flaws.
A critical vulnerability in Microsoft Entra ID (formerly Azure AD) allows attackers to obtain Global Admin privileges in any tenant via specially crafted Actor tokens, with no patch yet available.
A breach at Salesloft's AI chatbot provider Drift cascaded through the supply chain, exposing data from over 700 organizations including Palo Alto Networks, Cloudflare, and Zscaler.
Trend Micro Research has published a detailed analysis of how attackers can compromise LLMs through poisoned training data, malicious LoRA adapters, and trojan model files, highlighting the growing supply-chain risks in AI.
Trend Micro researchers found that Wondershare RepairIt hardcoded write-capable cloud credentials in its binary, exposing user photos, AI models, and signed executables to supply-chain attacks.
A malware campaign targeting Latin America, primarily Colombia, uses oversized SVG files impersonating the judicial system to deliver AsyncRAT via DLL sideloading.
Cybercriminals are exploiting AI-native development platforms like Vercel, Netlify, and Lovable to host fake CAPTCHA pages that trick users and evade security scanners, fueling a phishing campaign surge tracked by Trend Micro since January.
A sophisticated supply chain attack on the NPM registry has compromised hundreds of packages, deploying the self-replicating Shai-Hulud worm to steal cloud tokens and cryptocurrency.
PortSwigger Research has released WebSocket Turbo Intruder, a Burp Suite extension that enables high-speed fuzzing and automated testing of WebSocket connections, targeting a common blind spot in security testing.
Jenkins released Security Advisory 2025-09-17 addressing four vulnerabilities, including a high-severity HTTP/2 denial-of-service flaw in bundled Jetty.
The TeamPCP malware crew released the Shai-Hulud worm's source code on GitHub under MIT license, triggering an immediate wave of clones and copycat campaigns targeting npm developers — including the first reported clone-attack and subsequent npm package compromises.
Trend Micro has uncovered EvilAI, an ongoing campaign where attackers use AI-generated code to build trojanized apps that steal credentials and maintain persistent access across critical sectors worldwide.
GitLab released versions 18.3.2, 18.2.6, and 18.1.6 on September 10, 2025, patching multiple high-severity vulnerabilities including SSRF, DoS, and information disclosure flaws.
Trend Micro research details the tactics, techniques, and procedures of The Gentlemen ransomware group, which has targeted manufacturing, healthcare, and other critical sectors across 17 countries since August 2025.
The DFIR Report details an intrusion that connects three major ransomware operations—BlackCat/ALPHV, LockBit, and BlackSuit—through shared tooling and infrastructure.
PortSwigger Research discloses methods to bypass __Host and __Secure cookie prefix protections using Unicode whitespace and legacy parsing, affecting Django, ASP.NET, and Java-based servers.
Jenkins released a security advisory on September 3, 2025, disclosing four vulnerabilities in the Git client, global-build-stats, Jakarta Mail API, and OpenTelemetry plugins, urging administrators to update immediately.
GitLab released versions 18.3.1, 18.2.5, and 18.1.5 on August 27, 2025, fixing four medium-severity vulnerabilities including an unauthenticated GraphQL endpoint that exposes sensitive CI/CD variables.
PortSwigger Research has unveiled a novel CSS injection technique that uses inline style attributes and CSS conditionals to exfiltrate sensitive data from web pages without requiring external stylesheets.
PortSwigger Research publishes a detailed guide to help penetration testers and bug bounty hunters differentiate HTTP pipelining from genuine request smuggling vulnerabilities.