Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,302 stories synthesized.
Key findings • 25 WordPress plugins disclosed with vulnerabilities between Oct 7-8, 2026, including critical and high-severity flaws. • Key vulnerabilities include PHP Object Injection, SQL I…
Key findings • CISA added Apache Struts 2 RCE vulnerability CVE-2016-3081 to its KEV catalog. • The flaw is actively exploited, posing a significant risk to unpatched systems. • CVE-2016-…
Key findings • Thirteen vulnerabilities in AsyncHttpClient disclosed on October 7, 2026, ranging from Low to Critical severity. • Issues span authentication bypasses, insecure proxy handling,…
Threat actors are increasingly integrating Web3 technologies and exploiting open-source software supply chains to breach enterprise cloud environments, according to Unit 42.
Key findings • Splunk Enterprise: 22 vulnerabilities disclosed on October 7, 2026, ranging from Medium to Critical severity. • Vulnerabilities include RCE via Patroni API (CVE-2026-76268) and…
The U.S. State Department has announced a $10 million reward for information leading to the arrest of Zhang Yu, a Chinese national allegedly involved in the widespread Hafnium hacking campaign.
Federal contractors handling sensitive unclassified information will soon face stricter cybersecurity mandates, including mandatory 72-hour breach reporting and adherence to NIST standards.
Cisco Talos has disclosed several vulnerabilities affecting Adobe Photoshop, Apple macOS, Foxit Reader, and Microsoft Windows, with vendors having already released patches.
AWS introduces Strands Box, an open-source AI agent sandbox that uses OS-level isolation and temporal awareness to prevent autonomous agents from executing unintended or harmful actions.
A breach at Discord security bot provider Double Counter exposed millions of Discord IDs, usernames, IP addresses, and email addresses due to an attacker exploiting an old server running Metabase.
Four US states are suing networking giant TP-Link, alleging deceptive marketing practices regarding router security and undisclosed ties to China, citing national security risks.
US Security Operations Centers are struggling with overwhelming alert volumes, fragmented toolsets, and sophisticated phishing, leading to significant operational bottlenecks.
Key findings • Cisco Systems disclosed 25 vulnerabilities on October 7, 2026, impacting products like NX-OS, APIC, and License On-Prem. • Multiple Critical-severity vulnerabilities (CVSSv3 9.…
Key findings • 25 vulnerabilities disclosed for Backstage across multiple plugins between October 6-7, 2026. • Critical and High severity flaws found in scaffolder and techdocs plugins, impac…
Law enforcement agencies in the US and France have seized two websites used to distribute child sexual exploitation material, including AI-generated deepfakes, leading to an arrest.
Cloudflare introduces an advanced AI agent harness designed to automate and enhance the analysis of security alerts, addressing the 'alert paradox' faced by human analysts.
Key findings • Five vulnerabilities in MISP disclosed between October 6-7, 2026, impacting various core functions. • High severity flaw (CVE-2026-107180) allows bypass of mandatory TOTP enrol…
Microsoft's FORGE Lab has discovered 140 Windows CVEs and 155 reports across 23 open-source projects, highlighting the critical need to scale vulnerability validation and remediation alongside AI-driven discovery.
A critical vulnerability in LMCache's multiprocess mode, affecting LLM acceleration servers like vLLM, enables unauthenticated attackers to execute arbitrary code remotely.
A sophisticated malware campaign dubbed PoeLLM has compromised over 3,400 servers by ingeniously using a poem posted on GitHub as a dynamic lookup table to generate command-and-control server addresses.
Atlassian products are affected by CVE-2026-21589, an arbitrary file access vulnerability that allows attackers to read sensitive files by exploiting a unique directory traversal mechanism.
A sophisticated initial access broker known as CyberXero is employing AI tools like Claude Code and PentAGI alongside Cobalt Strike to conduct extensive cyberattacks targeting WordPress, e-commerce sites, and Ukrainian energy infrastructure.
Southern Company disclosed a data breach affecting Georgia Power and Alabama Power customers, with hackers accessing utility account information for approximately 400,000 accounts.
Two major South Korean churches have suffered significant data breaches, compromising the personal and financial information of over one million congregants.