Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,342 stories synthesized.
The Russia-aligned threat actor Earth Sirrush (UAC-0099) is escalating its espionage campaigns against Ukrainian organizations by hiding malware within PNG images and malicious Notepad++ plugins.
Japanese chip testing giant Advantest has confirmed a data breach, revealing that personal information was stolen during a ransomware attack initially disclosed in February 2026.
Rockstar Games has been the target of several sophisticated cyberattacks, resulting in the theft of source code, a massive dataset of business records, and a playable build of Grand Theft Auto VI.
Attackers gained control of the .gh, .sl, and .as country-code top-level domains, enabling them to issue fraudulent HTTPS certificates for Google domains and other major organizations.
Apple introduces a new system to verify iPhone photos without compromising photographer anonymity or linking images to specific devices.
The BlueKit phishing-as-a-service (PhaaS) toolkit empowers cybercriminals to launch sophisticated account-hijacking campaigns within minutes, utilizing a vast template library and minimal technical expertise.
A critical command injection vulnerability (CVE-2026-91140) in Progress DataDirect's Autonomous REST Connector AI Model Generator agents allows attackers to execute arbitrary OS commands by submitting specially crafted OpenAPI or Swagger files.
SonicWall has released patches for four vulnerabilities affecting its SMA 1000 series appliances, including a critical pre-authentication Server-Side Request Forgery (SSRF) flaw.
Security researcher Oliver Fish claims to have discovered a vulnerability in OpenAI's sandbox environment that could permit unauthenticated access to paid AI models.
As Cybersecurity Awareness Month 2026 kicks off, a surge in AI-driven scams and sophisticated social engineering tactics underscores the critical need for continuous user vigilance.
The era of AI agents executing cyber attacks is here, moving beyond simple penetration tests to sophisticated, adaptive red team operations.
Ethical hackers at Pwn2Own Ireland 2026 discovered 32 zero-day vulnerabilities across a range of devices and AI tools, winning over $368,000 in prizes on the competition's first day.
A sophisticated phishing campaign impersonates legitimate brands to lure YouTube creators into fake collaboration platforms, ultimately stealing their Google account credentials.
WordPress 7.1.3 addresses seven security issues, including stored XSS, SQL injection, and data disclosure flaws, urging immediate updates.
OpenSSH 10.6, released October 6, 2026, addresses three critical vulnerabilities that could lead to plaintext recovery, arbitrary file writes, and shell injection.
Pwn2Own Ireland 2026 saw researchers exploit 32 unique zero-day vulnerabilities in devices from Samsung, OpenAI, and various smart home products, netting over $388,000 in prizes.
A supply chain compromise allowed unauthorized access to Denmark's Central Register of Persons (CPR), exposing sensitive data for nearly all Danish citizens.
Google Chrome version 155.0.8059.39/.40 addresses 247 vulnerabilities, including four critical use-after-free flaws.
Veeam Backup & Replication 12.3.2 P4 addresses four vulnerabilities, including a critical RCE flaw via insecure deserialization and an XSS vulnerability in Enterprise Manager.
A new ranking of the top 10 Dynamic Application Security Testing (DAST) tools for 2026 highlights the evolution of black-box testing, with PortSwigger's Burp Suite taking the top spot.
Attackers maintained a two-year presence within a medical organization by hiding the Vasilek backdoor inside legitimate VMware Tools installations, evading detection and exfiltrating data.
Threat actors are leveraging over 100 compromised websites to distribute the LunexStealer information-stealing malware by tricking users with fake Cloudflare verification pages.
Google's October 2026 security updates address 25 vulnerabilities across Android's Framework and System components, with one critical flaw in the System component allowing for privilege escalation.
Tuskira releases AI Agent Gateway, an open-source tool designed to prevent sensitive credentials and API keys from being embedded directly into AI agent configurations.