Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,184 stories synthesized.
Key findings • Six vulnerabilities in Xorg libraries disclosed on September 28, 2026, including one High and five Medium severity flaws. • Multiple vulnerabilities stem from out-of-bounds rea…
Key findings • 18 vulnerabilities disclosed for Apache Roller 6.1.5 on September 28, 2026. • Critical vulnerabilities include deserialization, configuration bypass, and authorization flaws. …
Sophisticated phishing attacks are increasingly bypassing traditional detection methods by leveraging AI, QR codes, and token theft, necessitating advanced containment strategies for businesses.
A new Python-based malware builder, dubbed Python MaaS Infostealer, allows attackers to easily create custom infostealer executables targeting credentials from 17 browsers and Firefox.
Key findings • 18 vulnerabilities disclosed for Mathurvishal CloudClassroom-PHP-Project between Sep 25-28, 2026. • Batch includes high-severity SQL injection and medium-severity XSS flaws. …
Hackers exploited a GlobalProtect authentication bypass to steal customer data and launch a large-scale invoice fraud campaign, sending over 2.4 million fraudulent messages primarily targeting Brazil.
A 2026 ranking of adaptive authentication tools highlights Microsoft Conditional Access, Okta, and Cisco Duo as leaders, emphasizing risk-based approaches and integration with phishing-resistant factors like passkeys.
This week's security news covers Kothamine malware's use of Tailscale, a ClickFix trap, an OpenAI agent's breach of an Australian government site, and a significant Google privacy fine.
A new ranking of biometric authentication solutions for 2026 prioritizes defenses against deepfakes and injection attacks, with iProov leading due to its 'genuine presence' technology.
A new ranking of Authentication-as-a-Service (AaaS) providers for 2026 highlights Auth0, Microsoft Entra External ID, and Firebase Auth as top performers, emphasizing developer experience, security, and cost-effectiveness.
A new evaluation of cloud directory services places Microsoft Entra ID at the top, citing its deep integration with Microsoft 365 and robust hybrid capabilities, while JumpCloud and Okta Universal Directory also secure top spots for their distinct strengths.
Key findings • Three critical vulnerabilities disclosed on September 28, 2026, affecting Netcore NBR200V2 and NBR100V2 devices. • All three vulnerabilities allow for remote exploitation, with…
A new report highlights that AI agents are storing sensitive data like API keys and credentials in plain text within their memory, creating a critical vulnerability.
Authorizer, a new open-source server, provides robust authentication and authorization for web and mobile applications, with a unique focus on enabling AI agents to securely access sensitive data.
New guidance from ETSI highlights potential security weaknesses in Quantum Random Number Generators (QRNGs) that could allow attackers to glean sensitive information.
Cloudflare's 16th-anniversary letter highlights a dramatic shift in internet traffic, with AI agents poised to surpass human activity and potentially reshape the digital economy.
A novel 'console named-pipe injection' method evades common EDR detection by delivering payloads via a child process's standard input and repurposing existing memory, bypassing the typical allocate-write-execute sequence.
Wireshark, the widely-used network protocol analyzer, has released version 4.6.9, addressing a significant number of vulnerabilities and bugs to enhance its security and stability.
Key findings • 25 WordPress plugin vulnerabilities disclosed together between Sept 26-27, 2026, ranging from Medium to Critical severity. • Critical flaws include arbitrary file uploads (CVE-…
Two unpatched zero-day remote code execution vulnerabilities in Citrix NetScaler are reportedly being actively exploited in the wild, prompting urgent warnings from security researchers.
Key findings • Three vulnerabilities in vm2, patched in 3.12.2, disclosed on September 27, 2026. • Critical CVE-2026-100721 allows authorization bypass via custom external module resolvers. …
Key findings • Two Citrix vulnerabilities, CVE-2026-88771 and CVE-2026-88772, added to CISA KEV. • Both flaws are confirmed to be under active exploitation by threat actors. • Immediate p…
Key findings • Eleven vulnerabilities disclosed together for Elastic's Elasticsearch and Kibana on September 26, 2026. • Multiple Uncontrolled Resource Consumption flaws leading to denial of …
Key findings • Four vulnerabilities in Elastic Kibana disclosed on September 26, 2026, including one High and three Medium severity flaws. • CVE-2026-94400: Uncontrolled Resource Consumption …