Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,758 stories synthesized.
Trend Micro researchers detail a cryptomining campaign exploiting CVE-2026-33017, an unauthenticated RCE vulnerability in the Langflow AI workflow tool, exposing the pivot from targeting traditional infrastructure to AI application endpoints.
Key findings • Eleven DoS vulnerabilities disclosed simultaneously for OpenLink Virtuoso-opensource 7.2.11. • All vulnerabilities are triggered by crafted SQL statements targeting various int…
Key findings • CISA added two actively exploited Ubiquiti Inc vulnerabilities to the KEV catalog on June 23, 2026. • CVE-2026-34908 and CVE-2026-34909 are confirmed under active in-the-wild e…
OpenAI released an updated GPT-5.5-Cyber vulnerability-finding model, expanded its Daybreak partner program, and launched Patch the Planet to help secure 30 open-source projects.
A global malware campaign is hijacking WhatsApp accounts to send malicious VBScript files disguised as business documents, ultimately installing remote access trojans via the legitimate ManageEngine Endpoint Central tool.
OpenAI announced the Daybreak Cyber Partner Program, enabling 30 cybersecurity vendors and service providers to integrate GPT-5.5 into customer-facing security products for the first time.
Unit 42 researchers disclosed a bucket hijacking technique that exploits globally unique bucket names across AWS, Azure, and Google Cloud to silently reroute data streams to attacker-controlled storage.
An attacker tricked the JaredFromSubway Ethereum MEV bot into approving $15 million in withdrawals by injecting fake trading opportunities that exploited the bot's automated arbitrage logic.
Key findings • Ten vulnerabilities disclosed in MessagePack C# on June 22, 2026. • Issues include denial-of-service via excessive memory allocation and CPU exhaustion. • Security bypasses…
Four vulnerabilities in the open-source AI platform Dify allow attackers to silently access and exfiltrate sensitive AI chat histories, researchers warn.
FFmpeg version 8.1.2 fixes CVE-2026-8461, a high-severity heap out-of-bounds write in the MagicYUV decoder that can enable remote code execution on Jellyfin servers and denial-of-service across dozens of media applications.
A typosquatted npm package mimicking a popular CSS tool delivers a full-featured Windows RAT that uses RC4-encrypted HTTP C2, registry persistence, and Chrome credential theft.
A phishing campaign targeting Indian users delivers Remcos RAT via a malicious GST debit note attachment, using in-memory execution and .NET Bitmap steganography to evade detection.
Cloudflare, Google Chrome, Microsoft Edge, and Mozilla Firefox are collaborating on Private Access Control Tokens (PACTs), a privacy-preserving protocol that lets websites issue anonymous tokens to distinguish legitimate traffic from abusive requests.
The Trump administration will sign executive actions Monday that push the federal civilian deadline for adopting quantum-resistant encryption forward to 2029 or 2030 and redirect CHIPS Act financing to boost the domestic quantum computing industry.
Key findings • Eight vulnerabilities disclosed on June 22, 2026, affecting IBM WebSphere Application Server and Liberty profile. • Vulnerabilities include Denial of Service, SSRF, HTTP Reques…
Microsoft outlines a defense-in-depth strategy to protect AI memory in Microsoft 365 Copilot from adversarial memory poisoning attacks that exploit asynchronous memory writes to trigger delayed tool execution.
Key findings • Four vulnerabilities in Dell Wyse Management Suite (WMS) disclosed on June 22, 2026. • Two SQL injection flaws (CVE-2026-44271, CVE-2026-44272) allow unauthorized remote access…
Cloudflare engineers spent six weeks tracking down a race condition in the Rust-based hyper HTTP library that caused silent truncation of large image transformations on the edge network.
Trail of Bits engineers paired with OpenAI's GPT-5.5-Cyber produced 64 pull requests and 51 issues across 19 essential open-source projects, with 37 patches already merged, in the first week of the new Patch the Planet initiative.
CrowdStrike's survey reveals 94% of organizations experienced a cloud breach in the past year, with 67% hit three or more times.
NetSPI researchers disclosed a technique that lets attackers bypass Microsoft Entra Conditional Access Policies by abusing Nested App Authentication to obtain Microsoft Graph tokens without MFA or device compliance checks.
Researchers disclosed four vulnerabilities in the open-source Dify platform, collectively named DifyTap, that allow unauthenticated attackers to read AI conversations across tenant applications.
Attackers are gaming GitHub, YouTube, and VirusTotal to build a fake trust profile for a cross-platform clipboard hijacker that replaces copied crypto wallet addresses to steal funds.