Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,734 stories synthesized.
A significant majority of cybersecurity professionals report critical false negatives from automated pentesting tools, leading to a sharp decline in confidence and adoption of fully autonomous approaches.
WatchTowr Labs has disclosed CVE-2026-8451, a pre-authentication memory overread vulnerability in Citrix NetScaler appliances, dubbed 'CitrixBleed To Infinity And Beyond,' stemming from insecure XML parsing.
Cybercriminals are employing sophisticated phishing campaigns against hospitality organizations in the EU and Asia, using malicious ZIP files and novel techniques like blockchain abuse to achieve persistence.
The RustDuck botnet, rewritten in Rust, is rapidly evolving to hijack routers, servers, and IoT devices for large-scale DDoS attacks.
A Reddit disclosure claims Anthropic's Claude Code CLI tool contains undisclosed, obfuscated code designed to detect users in China or those using Chinese AI lab proxies, raising significant trust concerns.
Huntress CEO confirms a threat hunter disclosed law enforcement contact to a ransomware operator, calling it 'poor judgment' amid insider threat allegations.
Reflectiz and Taboola will host a webinar discussing the escalating risks of unvetted third and fourth-party scripts on websites, amplified by AI.
Microsoft unveils a suite of security enhancements for June 2026, including an AI-powered vulnerability discovery system and new protections against prompt injection attacks targeting local AI agents.
Microsoft Security Blog outlines a new attack pattern where malicious instructions are injected into AI agent tool descriptions, enabling agents to perform unintended actions and exfiltrate data.
CISA has issued a critical alert for Delta Electronics DVP12SE PLCs, detailing two high-severity vulnerabilities that allow unauthenticated remote command execution and denial-of-service attacks.
CISA has issued an advisory for CVE-2025-31115, a race condition vulnerability in XZ Utils impacting several B&R Industrial Automation products, potentially leading to system crashes or memory corruption.
CISA has issued an alert for CVE-2026-13207, an authentication bypass vulnerability in Frangoteam FUXA SCADA/HMI versions 1.3.1 and prior, allowing unauthenticated remote attackers to enumerate user accounts and role assignments.
CISA has issued a critical alert for multiple vulnerabilities in StoneFly Storage Concentrator versions prior to 8.0.4.29, potentially allowing attackers to gain broad unauthorized access and execute arbitrary commands with root privileges.
CISA has issued an advisory for CVE-2026-8045, a medium-severity XML external entity injection vulnerability in Schneider Electric's EcoStruxure IT Data Center Expert software.
CISA alerts to critical flaws in Mitsubishi Electric's MELSOFT Update Manager, potentially allowing attackers to execute arbitrary code, tamper with data, or cause denial-of-service.
CISA has identified multiple critical vulnerabilities in OFFIS DCMTK Toolkit versions prior to 3.7.0, including path traversal and memory leaks, that could allow attackers to compromise sensitive medical data and disrupt operations.
CISA has issued an alert for two critical vulnerabilities in Schneider Electric's EasyLogic T150 and Saitel DP RTU devices, which could allow unauthenticated attackers to expose sensitive credentials.
A new cryptocurrency theft campaign, dubbed Silent Swap, is leveraging fake Google Notes browser extensions distributed via unsigned installers to replace user-copied wallet addresses with attacker-controlled ones.
Apple has issued critical security updates for iOS, iPadOS, macOS Tahoe, and Safari, addressing over two dozen vulnerabilities, many of which target the WebKit browser engine.
A new bypass technique called GuardFall leverages long-standing shell injection vulnerabilities to circumvent safety measures in popular open-source AI coding agents, posing a significant risk of arbitrary command execution.
Analysis of dark web forums shows Business Email Compromise (BEC) is a complex, multi-stage operation requiring significant infrastructure and planning beyond simple email scams.
A study of 444 iOS AI chatbot apps found that 282 of them leaked sensitive API keys or proxy access in their network traffic, leaving developers vulnerable to unauthorized usage and unexpected costs.
Jamf has launched AI Governance for Mac, a new feature enabling organizations to discover, manage, and control the use of AI tools on their macOS devices.
CISA's Binding Operational Directive 26-04 mandates federal agencies move from technical patch metrics to risk-based vulnerability prioritization and reporting, impacting federal contractors and influencing private sector standards.