Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,753 stories synthesized.
A 17-year-old UK student discovered his school's Active Directory domain controller tools were accessible without authentication, with the domain admin password stored in plaintext in a description field.
Irregular's AI security lab launched FrontierCyber, a benchmark that uses novel, unpublished vulnerabilities to evaluate AI models' genuine offensive-cyber capabilities without relying on known exploits or public writeups.
Australia's domestic intelligence agency disclosed that nation-state actors compromised a critical infrastructure provider, stealing administrator credentials and maintaining persistent access for potential future sabotage.
Anthropic formally accused Alibaba of orchestrating the largest known adversarial distillation attack, using 25,000 fraudulent accounts to extract capabilities from its Claude AI model over six weeks.
A SANS ISC guest diary dissects the TerraBot IoT botnet, revealing how automated cybercrime campaigns succeed through volume despite technical flaws.
Key findings • 13 kernel networking CVEs disclosed together in the June 2026 Android Security Bulletin • Netfilter subsystem accounts for 5 of the 13 bugs, including OOB read and info leak …
Mandiant details STOCKSTAY, a .NET backdoor used by Russia-linked Turla since 2022 against Ukrainian government and Italian foreign policy entities.
Key findings • CISA added Cisco CVE-2026-20230 to the KEV catalog on June 25, 2026, confirming active exploitation. • Federal agencies must remediate by July 16, 2026, under BOD 22-01 require…
Key findings • Ten vulnerabilities in Quest NetVault Backup disclosed on June 24, 2026. • Multiple SQL injection and command injection flaws allow for remote code execution. • Cross-site …
Cisco disclosed two actively exploited vulnerabilities: an SSRF bug in Unified Communications Manager now used in the wild, and an SD-WAN zero-day exploited since early 2026, according to Mandiant.
Nathan Austad, known online as 'Snoopy,' was sentenced to 18 months in prison for his role in the November 2022 credential-stuffing attack that compromised 60,000 DraftKings accounts.
Key findings • Four vulnerabilities disclosed in Zephyr RTOS between June 22-24, 2026, affecting serial, Bluetooth, and file system components. • CVE-2026-10642: Unbounded loop in PL011 UART …
Key findings • Eight vulnerabilities in Siyuan Note prior to v3.7.0 disclosed on June 24, 2026. • Multiple Stored XSS vulnerabilities escalate to RCE in the Electron client. • Unauthentic…
Key findings • Twelve Rocket.Chat vulnerabilities disclosed on June 24, 2026, impact authentication, data handling, and SSO. • Multiple CVEs allow account takeover via NoSQL injection in OAut…
A sophisticated phishing campaign impersonates Microsoft Teams to deliver a signed remote monitoring and management installer, granting attackers full system control and credential theft capabilities.
A malicious document reader app on the Google Play Store, downloaded over 100,000 times, is distributing the Anatsa (TeaBot) Android banking trojan to steal credentials from 831 financial institutions worldwide.
Key findings • 18 vulnerabilities disclosed for Gogs between June 22-24, 2026, ranging from medium to critical severity. • Critical RCE vulnerabilities include path traversal (CVE-2026-52813)…
Zscaler ThreatLabz uncovers a campaign using a malicious Microsoft Edge extension named 'Edgecution' that abuses Chrome native messaging to execute code on victim systems, linked to an initial access broker for the Payouts King ransomware group.
Key findings • 18 CVEs fixed in Chrome 149.0.7827.196/197, including 4 Critical and 14 High • Two Critical WebGL UAF bugs (CVE-2026-13028, CVE-2026-13032) can escape the sandbox on Android …
Key findings • Nine vulnerabilities disclosed for Warp on June 24, 2026, affecting multiple components. • Multiple command injection flaws allow arbitrary code execution via branch names, env…
EvilTokens, a device-code phishing kit, evades static URL analysis by delivering an AES-GCM encrypted payload that only renders after browser-side JavaScript decryption, hiding the Microsoft-branded authentication page from traditional scanners.
CrowdStrike warns that AI agents inherit excessive permissions via APIs and service accounts, creating dangerous identity attack surfaces that attackers can exploit for lateral movement and data theft.
LayerX researchers demonstrated a prompt injection technique called BioShocking that tricks AI browsers like ChatGPT Atlas and Perplexity's Comet into bypassing guardrails and exfiltrating user credentials.
A coordinated law enforcement operation involving Europol, Bitdefender, Bitsight, ESET, and Microsoft has disrupted the malware-as-a-service infrastructure behind Amadey and StealC, recovering 27 million stolen credentials.