Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,184 stories synthesized.
Cloudflare's new open-source EmDash 1.0 CMS enforces granular plugin security by running each extension in an isolated sandbox that requires explicit administrator approval for any access to site resources.
WatchGuard has released firmware version 3.4.8 to address two critical OS command injection and improper access control flaws, CVE-2026-86102 and CVE-2026-101891, allowing unauthenticated remote command execution on AP devices.
A new remote access trojan, BotHelper RAT, utilizes encrypted payloads and live screen surveillance to spy on Windows users, bypassing security measures through in-memory decryption and AMSI patching.
A critical vulnerability in the official MCP Python SDK (versions prior to 1.30.0 and 2.2.0) allows malicious servers to intercept and steal sensitive OAuth credentials, enabling session hijacking.
A monthly roundup highlights innovative open-source tools for secrets scanning, AI security, authorization, and more, emphasizing community-driven security solutions.
A campaign involving 31 Russian-language Chrome extensions, posing as VPNs, has been discovered to hijack user browser traffic, routing it through remote proxy servers controlled by operators.
Key findings • Twelve vulnerabilities disclosed in Flatpak between Sep 27-29, 2026, impacting deployment, file handling, and OCI processing. • Path traversal flaws allow malicious Flatpak app…
A Pentagon Defense Manpower Data Center (DMDC) system breach exposed sensitive PII of over 3 million individuals, including unencrypted names and Social Security numbers, due to a file-sharing vulnerability.
Key findings • Twelve vulnerabilities disclosed for Netcore devices between September 28-29, 2026, with a focus on critical command injection and auth bypass flaws. • Multiple Netcore models …
Key findings • Six vulnerabilities in Zephyr RTOS disclosed between September 28-29, 2026, ranging from Medium to High severity. • Two High severity flaws (CVE-2026-16513, CVE-2026-18414) wit…
Key findings • CVE-2026-86950, an Apple vulnerability, is now in CISA's KEV Catalog. • The flaw is confirmed to be under active exploitation by threat actors. • Immediate patching of all …
Nvidia and over 100 organizations are collaborating to develop layered security controls for AI agents, aiming to mitigate risks as these systems gain access to sensitive enterprise resources.
The threat actor Storm-3168, linked to the agentic ransomware JadePuffer, has been observed hijacking Azure service principals to conduct destructive attacks and steal credentials within cloud environments.
Apple has released urgent security updates for older iOS, iPadOS, and macOS versions to address CVE-2026-86950, a CoreGraphics vulnerability potentially exploited in targeted attacks.
Key findings • Five vulnerabilities disclosed by Google on September 28, 2026, affecting Chrome and Cloud Application Integration. • Two critical vulnerabilities in Google Cloud Application I…
Key findings • Thirteen Joomla extension vulnerabilities disclosed between September 26-28, 2026, including critical RCE and SQLi flaws. • Extensions from ordasoft.com, regularlabs.com, svenb…
GitHub Security Lab's open-source AI agent, Taskflow Agent, has successfully identified 24 vulnerabilities in Android applications, including a critical flaw in the OsmAnd navigation app.
Key findings • Seven unique malicious npm packages were disclosed on September 28, 2026. • A total of 14 advisories were published within a 29-minute window, indicating a coordinated effort. …
Cryptocurrency exchange Bitget reported a $388 million theft due to a vulnerability in a third-party security product, which allowed attackers to steal high-level internal credentials.
Key findings • Three vulnerabilities disclosed in Perl's DBI and XS::Parse::Infix modules on September 28, 2026. • DBI vulnerabilities (CVE-2026-88816, CVE-2026-88815) stem from improper nume…
A malicious Chrome extension, 'Poper Blocker,' disguised as an ad-blocker, was found on Google's official store, secretly stealing sensitive user data from millions of downloads.
Florida's Attorney General is pursuing an emergency injunction to impose strict safety regulations on OpenAI and its ChatGPT service, citing concerns over child data privacy and AI safety.
Key findings • Dell disclosed four vulnerabilities on September 28, 2026, affecting BOSS and Live Optics Collector. • Three BOSS vulnerabilities stem from improper access control in the SMCU,…
Microsoft details NeedyMantis, a modular post-compromise malware family used by China-linked threat actors since October 2025 to maintain long-term access in targeted sectors.