Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,771 stories synthesized.
Attackers are luring PlayStation Vita and retro gaming enthusiasts with fake GitHub repositories that deliver Lumma Stealer and other malware disguised as legitimate homebrew plugins.
A campaign using AI-generated phishing pages and a fake Blue Screen of Death tricks Brazilian bank customers into running PowerShell commands that deliver the SmartRAT trojan.
NetSPI researchers document a real-world Evilginx adversary-in-the-middle attack that intercepted Microsoft logins, stealing credentials, MFA tokens, and session cookies from a corporate executive team.
A malware developer is embedding fake policy-triggering text about nuclear and biological weapons in JavaScript comments to confuse LLM-based analysis tools.
Splunk patched a critical OS command injection in its AI Toolkit, while Atlassian fixed dozens of vulnerabilities across its products from third-party dependency updates.
Cisco has patched a critical command execution vulnerability in Identity Services Engine (ISE) that could allow authenticated attackers to gain root-level access and disrupt network operations.
Microsoft has resolved a known issue causing the June 2026 security updates to fail on Windows Server 2016 systems that were not fully up to date.
Cisco Talos demonstrates a technique to make the VB6 disassembler vbdec AI-accessible by exposing its internal COM object model, enabling local agentic reverse engineering without modifying the tool.
Attackers are distributing malicious LNK files disguised as resumes to deliver the Xctdoor backdoor, using PowerShell, VBScript, and BAT files in a multi-stage infection chain.
F5 released out-of-band patches for multiple critical and high-severity NGINX vulnerabilities, including two CVSS 9.2 flaws that could allow unauthenticated remote code execution.
Microsoft's June 2026 Patch Tuesday update KB5095051 for Windows 11 is causing Word, Excel, and PowerPoint to fail when opened through third-party applications, disrupting enterprise workflows.
The UK's National Cyber Security Centre warns that three-quarters of cyberattacks on the country's critical national infrastructure originate from hostile state actors.
The Gentlemen ransomware-as-a-service gang has developed a custom tool called GentleKiller that disables over 400 security processes across 48 endpoint detection and response products, a leaked internal chat reveals.
Splunk disclosed CVE-2026-20266, a critical OS command injection vulnerability in its AI Toolkit (CVSS 9.1) that allows authenticated admins to execute arbitrary commands remotely.
42Crunch released an API Security Testing Plugin for GitHub Copilot that enables developers to audit, test, and fix API vulnerabilities directly within AI-assisted coding workflows.
A newly hired database administrator at a major US cellular carrier discovered that the company stored customer PII, including full credit card numbers and CVVs, in plaintext on a production database.
A new analysis from the University of Oxford and SaferAI identifies critical security risks in AI coding agents that write, edit, and run software with minimal human oversight inside frontier AI labs.
A SANS ISC guest diary analyzing over 20 million SSH brute-force attempts from February to May 2026 reveals coordinated probing spikes correlated with CISA advisories and geopolitical events.
Microsoft warns of a Windows-based cryptocurrency clipper active since February 2026 that uses Tor and worm-like propagation for persistence.
AWS announced Continuum, a suite of autonomous security agents that automatically discover, prioritize, and fix vulnerabilities across cloud environments.
Attackers are targeting Roblox developers with fake job offers on Discord, tricking them into installing a Python infostealer called 'robase' that steals authenticated browser sessions and hands over control of games, groups, and Robux balances.
Acronis analysis reveals INC ransomware has claimed over 800 victims since 2023 by focusing on proven intrusion methods and aggressive victim selection, filling the void left by LockBit and ALPHV/BlackCat.
A moderately critical improper validation vulnerability in Drupal core's JSON:API and REST modules could allow attackers to upload non-image files, potentially leading to cross-site scripting attacks.
A moderately critical server-side request forgery vulnerability in Drupal core's Media module oEmbed URL discovery could allow attackers to trick Drupal into making unauthorized server-side requests.