Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,736 stories synthesized.
A supply-chain attack leveraging compromised legacy credentials at market intelligence firm Klue has resulted in a significant data breach affecting hundreds of companies, including prominent security firms and password manager LastPass.
A sophisticated attack chain beginning with Bing SEO poisoning, leveraging Bumblebee malware and AdaptixC2 for command and control, culminates in the deployment of Akira ransomware.
Microsoft has extended the availability of hotpatching for Windows Server 2022 Datacenter: Azure Edition until 2027, offering a reprieve from mandatory reboots for security updates.
Malicious skills targeting the ClawHub marketplace for OpenClaw AI agents have led to remote code execution, data theft, and significant financial losses, highlighting the growing security risks in the AI agent ecosystem.
A novel technique allows attackers to inject malicious code into other processes by exploiting a legitimate Windows kernel callback, bypassing traditional security detection methods.
Rapid7's policy paper argues that AI-driven vulnerability discovery is outpacing current standards like CVE and CVSS, necessitating urgent reforms.
Penetration testers can automate host discovery by hashing favicon.ico files and querying Shodan, revealing previously unknown targets.
As quantum computing advances, current encryption methods like RSA and ECC will become vulnerable, necessitating a shift to post-quantum cryptography to protect long-term data confidentiality, starting with credentials.
Researchers have demonstrated how large language models can generate functional, unique red-team agents for the Mythic framework in approximately two hours, enabling 'disposable tooling' that evades traditional signature-based detection.
The National Association of Insurance Commissioners (NAIC) confirmed a data breach resulting from exploitation of a zero-day vulnerability in Oracle PeopleSoft, exposing credit rating data.
The Millenium RAT, now rewritten in C++ and sold as Malware-as-a-Service by the Y2K Operators, has compromised more than 62,000 devices worldwide, stealing credentials and encrypting files.
The UNC1151 (Ghostwriter) threat group has been identified conducting a sophisticated phishing campaign against a Belarusian politician, employing techniques to bypass multi-factor authentication.
Experts are increasingly pointing to Russian state-sponsored actors behind a destructive cyberattack on Jaguar Land Rover, characterized by novel ransomware and a lack of ransom demand, potentially aimed at economic sabotage.
Microsoft has removed 119 malicious Edge extensions from its add-ons store, a campaign dubbed StegoAd, which used steganography to conceal malware within image and font files, stealing credentials and engaging in ad fraud.
This week's security landscape was shaped by malware targeting browser sessions, a significant data breach affecting millions of Texans, and the widespread compromise of D-Link routers by the AryStinger botnet.
Compromised npm and Go packages are distributing a Python infostealer across Windows, Linux, and macOS by abusing VS Code tasks, potentially bypassing security measures.
The new open-source DarkMoon platform leverages AI agents to autonomously plan and execute penetration tests, aiming to reduce the time and cost of security assessments.
A new report from Cobalt highlights that AI and LLM features in products introduce high-risk vulnerabilities that are resolved at a significantly slower pace than other security issues.
China's open-weight GLM-5.2 AI model matches Anthropic's Claude Mythos in detecting specific software vulnerabilities at a fraction of the cost, raising concerns about US export controls.
A new Remote Access Trojan, TONResolver, is targeting Japan's hotel sector by impersonating Booking.com in phishing attacks, uniquely leveraging the TON blockchain for resilient command-and-control communications.
Key findings • Three high-severity vulnerabilities in Google Chrome patched on June 28, 2026. • Vulnerabilities include two use-after-free flaws and one integer overflow. • Exploitation v…
The YARA-X pattern-matching tool has been updated with two new releases, adding a CPU-limit option and multiple bugfixes for malware analysts.
Mozilla researchers demonstrate a technique where a clean-looking GitHub repository tricks AI coding agents into executing hidden malware via a three-step indirection chain.
OpenAI released GPT-5.6 Sol, Terra, and Luna as a limited preview with restricted access and enhanced cybersecurity safeguards, in coordination with the U.S. government.