Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,742 stories synthesized.
Synology released a critical update for MailPlus Server, fixing three vulnerabilities including flaws that could let remote attackers read/write arbitrary files and access internal services.
A critical authentication bypass in python.org's release management API could have let attackers redirect millions of users to malicious downloads, posing a severe supply-chain risk.
Key findings • 15 vulnerabilities in Cacti versions 1.2.30 and prior disclosed between June 24-26, 2026. • Flaws include SQL injection, command injection, RCE, XSS, path traversal, and open r…
Key findings • Ten vulnerabilities in WolfSSL disclosed on June 26, 2026, affecting certificate validation and crypto functions. • Issues include PKCS#7 decode path buffer overflows and PKCS#…
Black Kite's 2026 European Cyber Risk Report reveals a 55% increase in ransomware incidents, with third-party suppliers emerging as a major attack vector across 31 countries.
Decentralized prediction market Polymarket suffered a $3 million hack after attackers compromised a third-party vendor to inject a malicious script into the platform's frontend.
Researchers have tracked a Rust-based infostealer named KuinaExtractor that evolved across four development stages since December 2025, adding Telegram exfiltration, sandbox detection, and multiple UAC bypass techniques.
Fortra researchers have uncovered Mirage2FA, a phishing kit that combines HTML smuggling with obfuscated JavaScript to deliver fake Microsoft 365 login pages and steal credentials during MFA prompts.
A supply-chain attack campaign named Miasma has been discovered hiding malicious payloads in over 20 npm packages, using a binding.gyp file and the Bun runtime to steal developer credentials and cloud secrets.
A malware loader disguised as a fake Minecraft Fabric mod has compromised over 116,000 systems since January 2026, using Ethereum smart contracts and RSA signatures for resilient command-and-control.
ZeroTier released RC2 of its ZeroTier Quantum platform, the final testing milestone before general availability of its post-quantum secure networking solution.
A new open-source tool from Ohio State University, Burnyard, performs malware analysis entirely on the analyst's machine, preventing samples from being uploaded to public repositories where attackers can detect discovery.
Microsoft has extended the Windows 10 Extended Security Updates program for consumers by an additional year, now covering critical patches through October 12, 2027.
Key findings • 25 CVEs disclosed in a single batch on June 26, 2026 • Bluetooth RFCOMM and BNEP bugs allow remote out-of-bounds reads • Netfilter nft_fib leak can expose kernel stack data…
Key findings • Eight vulnerabilities disclosed for Vim on June 26, 2026, patched in version 9.2.0699. • Vulnerabilities affect spell checking, text properties, Python completion, file encrypt…
Qihoo 360 claims its AI bug-finder 'Tulongfeng' outperforms Anthropic's Mythos model, using a multi-agent swarm approach to discover long-dormant vulnerabilities.
Polish authorities arrested four members of an organized cybercrime group accused of SIM-swapping attacks that stole millions in cryptocurrency, with help from the FBI and HSI.
Microsoft warns of an active campaign since April 2026 targeting hospitality organizations in Europe and Asia with photo-themed ZIP archives delivering a Node.js implant via phishing emails abusing Calendly and Google redirects.
Unit 42 identifies a Chinese-speaking threat actor targeting government entities and critical infrastructure in Southeast Asia with a custom backdoor named TinyRCT.
Russia's FSB-linked Gamaredon group has upgraded its malware loading techniques and server obfuscation, making detection harder and requiring organizations to adopt new defenses.
CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-12569 in PTC Windchill and FlexPLM and CVE-2026-20230 in Cisco Unified Communications Manager, both actively exploited.
The FCC voted Thursday to mandate strong passwords, patching, and firewalls for the Emergency Alert System and Wireless Emergency Alerts, while simultaneously overhauling decades-old undersea cable regulations to tighten supply-chain security.
Threat actors are injecting fake purchase receipts into the popular Shopify order-tracking app Shop to launch callback phishing attacks, according to Gen Digital research.
Key findings • Thirteen vulnerabilities disclosed for pnpm on June 25, 2026, including ACE, info disclosure, and supply chain risks. • Multiple CVEs detail arbitrary code execution via path t…