Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,561 stories synthesized.
Let's Encrypt is significantly reducing its default TLS certificate validity period from 90 to 64 days starting February 10, 2027, to bolster web security.
A new ranking of the top 10 Infrastructure as Code (IaC) security tools for 2026 highlights Wiz for its cloud-contextualized risk ranking, followed by Snyk and Palo Alto's Checkov, emphasizing practical fix quality and pipeline integration.
Researchers successfully demonstrated remote exploits against fully patched Google Pixel 10 devices at Pwn2Own Ireland, with one team securing the contest's top prize.
Anthropic introduces OSS Scanner for AI-driven vulnerability reporting in open-source projects and the Critical Infrastructure Defense Program to bolster OT security.
Key findings • Six vulnerabilities disclosed in Zephyr Project RTOS between Oct 7-9, 2026. • Flaws include buffer overflows, memory allocation issues, and system call validation errors. •…
VirusTotal now scans the entire public IPv4 address space daily, providing security researchers with new tools to discover command-and-control servers and map malware infrastructure.
Leaked chat logs allegedly reveal the Silent Ransom Group, also known as Luna Moth, extorted over $200 million from 27 organizations in six months by threatening to release stolen data rather than encrypting it.
Microsoft's October 2026 Patch Tuesday is anticipated to continue the trend of high vulnerability disclosures, while ongoing issues with Office 2016/2019 support and Apple's recent zero-day patch highlight broader ecosystem challenges.
A malicious Android PDF reader app, installed over 10,000 times on Google Play, has been identified as a dropper for the Anatsa banking trojan, targeting user financial credentials.
Key findings • 16 MongoDB vulnerabilities disclosed between Oct 8-9, 2026, impacting drivers, libmongocrypt, and Ops Manager. • Multiple BSON handling flaws across Python, PHP, Go, and C/C++ …
A critical denial-of-service vulnerability (CVE-2026-23870) in React Server Components can freeze Next.js servers with a single crafted POST request.
Researchers have discovered over 8,500 internet-accessible systems controlling wind and solar parks across Europe, many with critical functions like turbine stop buttons, creating significant cybersecurity vulnerabilities.
Key findings • Three medium-severity vulnerabilities in Keycloak disclosed on October 9, 2026. • CVE-2026-107889 allows stored XSS via login theme injection. • CVE-2026-107604 exposes con…
The PCI Security Standards Council (PCI SSC) has released new guidance to help organizations secure AI systems handling cardholder data and defend against AI-powered attacks.
The FBI and U.S. Justice Department have dismantled a significant cyber operation by seizing seven domains linked to Microscan and FishHub, tools allegedly used by China-based Integrity Technology Group and associated with the Flax Typhoon hacking group.
Citrix has issued an urgent warning about a critical remote code execution (RCE) vulnerability, CVE-2026-107406, affecting NetScaler ADC and Gateway appliances configured with specific SAML settings.
Key findings • Microsoft disclosed seven vulnerabilities on October 8, 2026, including five critical and two high-severity flaws. • Vulnerabilities affect a range of Microsoft products includ…
Key findings • 25 vulnerabilities in IBM Guardium Data Protection disclosed on October 8, 2026, ranging from Low to Critical severity. • Multiple critical vulnerabilities allow for remote cod…
Prasan Nepal, the leader of the child sextortion group 764, has pleaded guilty to conspiracy to commit sexual exploitation of a child and faces a potential 30-year prison sentence.
Anthropic is leveraging its AI models and engineering expertise, in partnership with cybersecurity firms, to proactively identify and remediate vulnerabilities in critical infrastructure and open-source projects.
Key findings • 22 vulnerabilities disclosed simultaneously for IBM Security Verify Access and IBM Verify Identity Access. • Multiple critical vulnerabilities allow remote, unauthenticated cod…
OpenAI's release of over 700 mathematical proofs could rapidly accelerate AI's ability to solve complex problems, potentially rendering current public key cryptography vulnerable and necessitating a swift transition to post-quantum solutions.
Microsoft's security blog emphasizes the critical need for organizations to begin testing their certificate ecosystems for post-quantum cryptography (PQC) readiness, highlighting authentication as a distinct challenge from data confidentiality.
A critical vulnerability in AWS Bedrock AgentCore, now patched, allowed attackers to compromise entire AWS environments with a single malicious prompt.