Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,456 stories synthesized.
Key findings • 12 malicious npm packages were disclosed on July 13, 2026. • All advisories were published within a tight 23-minute window. • A cluster of packages impersonated 'markable-t…
Discount supermarket chain Lidl has disclosed a data breach affecting its online shops in Germany, Belgium, and the Netherlands, resulting from a hack at a service provider.
Varonis Threat Labs has released a free, hands-on Capture the Flag event designed to teach cybersecurity professionals how attackers exploit Microsoft Entra ID and its growing non-human identities.
Tenable emphasizes that cloud security is no longer just an IT compliance issue for federal agencies but a critical mission requirement for national security and operational readiness.
A new 'MemGhost' attack allows adversaries to subtly alter AI agent memories with a single email, potentially steering future responses and actions without user detection.
British authorities have charged five individuals in connection with Russian Coms, a sophisticated platform used to facilitate over 1.8 million fraudulent calls worldwide.
Check Point Research's latest threat intelligence report covers a wide array of cyber incidents, including a massive data breach at AssuranceAmerica, ransomware attacks, supply chain compromises, and novel AI-powered threats.
Cloudflare launches Precursor, a new bot management engine that analyzes user behavior within browsers in real-time to detect sophisticated automated traffic.
Researchers propose a theoretical 'Intelligent Worm' that uses AI to dynamically regenerate exploits and adapt to defenses in real-time, posing a significant evolution beyond traditional self-spreading malware.
Threat actors are exploiting a gap in Microsoft Entra ID's logging by spoofing OAuth client IDs, allowing them to perform account enumeration without generating successful sign-in events.
The Argentine Football Association (AFA) may have been compromised by attackers who exploited an infostealer infection dating back to September 2025, leading to stolen credentials and administrative access.
A critical vulnerability in RabbitMQ enables unauthenticated attackers to steal the broker's OAuth client secret, granting them full control over the message broker.
A digital forensics investigation leveraging Belkasoft X and AweClone software has led to the conviction of Jason Cunningham for defrauding landlords and investors of over £113,000.
Scammers are crafting increasingly convincing fake cryptocurrency gift card websites, designed to trick users into irreversible crypto payments with promises of discounts and ease of use.
Trail of Bits has published a new chapter for its Testing Handbook, offering in-depth guidance on security testing Rust applications, tools, and techniques.
A critical authentication bypass vulnerability (CVE-2026-57807) in the miniOrange WordPress OAuth SSO plugin allows unauthenticated attackers to gain full control of websites.
Researchers have developed VEXAIoT, an AI multi-agent framework that automates the identification and exploitation of vulnerabilities in Internet of Things (IoT) environments.
UK's NCSC and international partners issue alert on Russian state-backed actors targeting critical infrastructure via vulnerable routers.
FastNetMon introduces Netomics, a self-hosted platform offering comprehensive BGP routing visibility, integrating live data, RPKI validation, and AI-assisted querying without third-party dependencies.
The rapid adoption of AI-generated code is outpacing traditional security practices, creating a significant governance challenge and accelerating the accumulation of security debt.
APT-C-60's latest SpyGlace campaign leverages legitimate developer platforms like GitHub and GitLab, combined with a chain of trusted Windows tools, to deliver malware and evade network defenses.
A sophisticated phishing campaign, dubbed Operation Capsule Vault, is weaponizing genuine academic event materials to lure researchers into downloading a variant of the RokRAT malware.
Healthcare diagnostics provider Centers Laboratory has reported a data breach affecting over 540,000 individuals, with sensitive personal and health information exfiltrated by the WorldLeaks extortion group.
A forgotten Python HTTP server inadvertently exposed the operational materials for three active adversary-in-the-middle (AiTM) phishing campaigns, offering a rare glimpse into attacker methodologies.