Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,771 stories synthesized.
A less critical cache poisoning and open redirect vulnerability in Drupal core's rebuild.php front controller could allow attackers to poison caches or redirect users to malicious domains.
Drupal disclosed a moderately critical gadget chain vulnerability (CVE-2026-55804) in core that can enable remote code execution or SQL injection when combined with an insecure deserialization flaw.
Drupal has disclosed a critical PHP object injection flaw (CVE-2026-55803) in core that attackers could exploit via JSON:API write operations, urging updates within 24 hours.
Key findings • Nine CVEs disclosed in a 24-hour window across nearly every Deno subsystem • Five bugs directly bypass Deno's permission model (filesystem, network, env) • CVE-2026-49402 a…
Key findings • Three improper-access-control CVEs in Devolutions Server affect versions 2026.2.5 and 2026.1.21; no patch yet • CVE-2026-12161 (CVSS 8.8) lets authenticated RDM users execute a…
Key findings • Seven of the ten CVEs are rated high severity, with token-scope enforcement gaps dominating the batch • CVE-2026-28699 and CVE-2026-28744 show OAuth2 scopes are bypassed depend…
Key findings • 16 CVEs disclosed in a single 4-hour window on June 17, 2026 • Multiple IDOR and BOLA flaws allow cross-user file and note access • SSRF bypasses in Playwright and OAuth UR…
Key findings • Two broken-access-control CVEs allow authenticated users to exfiltrate session data from other profiles • CVE-2026-55196 lets unauthenticated attackers register arbitrary passk…
Over 17 million exploit attempts have been blocked targeting CVE-2026-4020, a sensitive information exposure flaw in the Gravity SMTP WordPress plugin that leaks API keys and OAuth tokens.
Key findings • CVE-2026-53805 in SIL GEN3C is an unauthenticated RCE via pickle deserialization (CVSS 9.8) • Two NeMo Framework flaws (CVE-2026-24228, CVE-2026-24155) both rated High (CVSS 7.…
SpyCloud's 2026 Phishing Pulse Report reveals that phishing attacks exposed employee data at 86% of Fortune 100 companies over the past year, with 84% of organizations reporting AI-generated phishing is harder to defend against.
A 27-year-old flaw in OpenBSD's sppp(4) subsystem lets attackers bypass PAP authentication entirely, impersonate PPPoE servers, and intercept traffic.
A ClickFix social-engineering campaign in May 2026 led to a full hands-on-keyboard intrusion, with attackers deploying the Potemkin loader and EtherRAT backdoor across 11+ hosts.
Key findings • CVE-2026-20262 in Catalyst SD-WAN Manager is actively exploited and added to CISA KEV • CVE-2026-20181 in Cisco ISE is a critical RCE with CVSS 9.1, requiring admin credentials…
North Korean state-backed group Sapphire Sleet is running a social engineering campaign that uses fake software update prompts to trick macOS users into handing over passwords and cryptocurrency wallet data.
A guest diary reveals a critical blind spot in Cloud Access Security Broker (CASB) enforcement: QUIC (HTTP/3) runs over UDP, which most CASBs cannot inspect, allowing Chrome to circumvent block policies undetected.
A French-speaking attacker compromised a small automotive business using a keylogger, then installed Tailscale and OpenSSH to maintain persistent access even after his Havoc C2 server went offline.
Key findings • 11 CVEs disclosed for Dell PowerFlex Manager on June 17, 2026 • CVE-2026-35065 is a missing-authentication bug that can lead to code execution • CVE-2024-47477 enables man-…
Researchers at Nisos infiltrated a North Korean IT-worker fraud operation that uses AI-generated interview responses and a network of US-based laptop farms to bypass remote hiring checks and steal jobs at American tech firms.
Medical technology firm iRhythm Holdings disclosed a cyberattack on June 8, 2026, that compromised third-party-hosted business applications, leading to the theft of patient protected health information and proprietary data.
Key findings • Two SSRF bugs (CVE-2026-53931, CVE-2026-53927) were reachable without authentication • CVE-2026-53931 bypasses URL allowlist via query-string tricks like ?.csv • CVE-2026-5…
A Russian-speaking threat actor has compromised over 30,000 Fortinet firewalls and VPN gateways across 194 countries in an automated credential-harvesting campaign that feeds stolen passwords back into the attack chain.
Key findings • Critical auth bypass (CVE-2026-48746) lets unauthenticated attackers call the OpenAI API without an API key • High-severity code execution (CVE-2026-41523) via assert bypass wh…
A new phishing kit named GitBait leverages GitHub Pages and the SheetBest API to steal credentials from Mexican banking customers, evading detection by abusing legitimate cloud services.