Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,180 stories synthesized.
A new ranking of container image scanning tools for 2026 emphasizes context and prioritization over raw CVE detection, with Aqua's Trivy leading as the best free option.
A critical vulnerability in the GoBalance tool allows attackers to recover the private key controlling a .onion address, enabling the hijacking of dark web sites.
Anthropic introduces OSS Scanner, a free AI-powered tool designed to automatically identify and report security vulnerabilities in critical open-source software repositories.
Let's Encrypt is significantly reducing its default TLS certificate validity period from 90 to 64 days starting February 10, 2027, to bolster web security.
A new ranking of the top 10 Infrastructure as Code (IaC) security tools for 2026 highlights Wiz for its cloud-contextualized risk ranking, followed by Snyk and Palo Alto's Checkov, emphasizing practical fix quality and pipeline integration.
Researchers successfully demonstrated remote exploits against fully patched Google Pixel 10 devices at Pwn2Own Ireland, with one team securing the contest's top prize.
Anthropic introduces OSS Scanner for AI-driven vulnerability reporting in open-source projects and the Critical Infrastructure Defense Program to bolster OT security.
Key findings • Six vulnerabilities disclosed in Zephyr Project RTOS between Oct 7-9, 2026. • Flaws include buffer overflows, memory allocation issues, and system call validation errors. •…
VirusTotal now scans the entire public IPv4 address space daily, providing security researchers with new tools to discover command-and-control servers and map malware infrastructure.
Leaked chat logs allegedly reveal the Silent Ransom Group, also known as Luna Moth, extorted over $200 million from 27 organizations in six months by threatening to release stolen data rather than encrypting it.
Microsoft's October 2026 Patch Tuesday is anticipated to continue the trend of high vulnerability disclosures, while ongoing issues with Office 2016/2019 support and Apple's recent zero-day patch highlight broader ecosystem challenges.
A malicious Android PDF reader app, installed over 10,000 times on Google Play, has been identified as a dropper for the Anatsa banking trojan, targeting user financial credentials.
Key findings • 16 MongoDB vulnerabilities disclosed between Oct 8-9, 2026, impacting drivers, libmongocrypt, and Ops Manager. • Multiple BSON handling flaws across Python, PHP, Go, and C/C++ …
A critical denial-of-service vulnerability (CVE-2026-23870) in React Server Components can freeze Next.js servers with a single crafted POST request.
Researchers have discovered over 8,500 internet-accessible systems controlling wind and solar parks across Europe, many with critical functions like turbine stop buttons, creating significant cybersecurity vulnerabilities.
Key findings • Three medium-severity vulnerabilities in Keycloak disclosed on October 9, 2026. • CVE-2026-107889 allows stored XSS via login theme injection. • CVE-2026-107604 exposes con…
The PCI Security Standards Council (PCI SSC) has released new guidance to help organizations secure AI systems handling cardholder data and defend against AI-powered attacks.
The FBI and U.S. Justice Department have dismantled a significant cyber operation by seizing seven domains linked to Microscan and FishHub, tools allegedly used by China-based Integrity Technology Group and associated with the Flax Typhoon hacking group.
Citrix has issued an urgent warning about a critical remote code execution (RCE) vulnerability, CVE-2026-107406, affecting NetScaler ADC and Gateway appliances configured with specific SAML settings.
Key findings • Microsoft disclosed seven vulnerabilities on October 8, 2026, including five critical and two high-severity flaws. • Vulnerabilities affect a range of Microsoft products includ…
Key findings • 25 vulnerabilities in IBM Guardium Data Protection disclosed on October 8, 2026, ranging from Low to Critical severity. • Multiple critical vulnerabilities allow for remote cod…
Prasan Nepal, the leader of the child sextortion group 764, has pleaded guilty to conspiracy to commit sexual exploitation of a child and faces a potential 30-year prison sentence.
Anthropic is leveraging its AI models and engineering expertise, in partnership with cybersecurity firms, to proactively identify and remediate vulnerabilities in critical infrastructure and open-source projects.
Key findings • 22 vulnerabilities disclosed simultaneously for IBM Security Verify Access and IBM Verify Identity Access. • Multiple critical vulnerabilities allow remote, unauthenticated cod…