Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,781 stories synthesized.
Researcher pikpikcu released AIRecon, an autonomous penetration testing agent that runs entirely offline by combining a self-hosted Ollama LLM with a Kali Linux Docker sandbox, eliminating cloud data exposure.
Attackers hijacked a former contributor's npm account to publish malicious versions of 144 @mastra/* packages, deploying a cryptocurrency-stealing infostealer via a cloned dayjs library.
A critical vulnerability in LiteLLM proxy allows attackers to bypass authentication by manipulating the Host header, gaining unauthorized access to management endpoints.
Kodak has confirmed a security breach after the ShinyHunters extortion gang claimed to have stolen over 2.2 million records containing customer PII and internal corporate data.
A new Remote Access Trojan built on the Deno runtime is being delivered via mailbombing and fake Microsoft Teams calls impersonating IT support, evading endpoint detection.
Threat actors are abusing Anthropic's Claude and OpenAI's Codex AI coding assistants to automate reconnaissance, exploitation, and data exfiltration, compromising at least 14 organizations in a single campaign.
Microsoft has released AntiSSRF, a free open-source library under the MIT license, to help developers validate URLs and prevent server-side request forgery (SSRF) attacks in .NET and Node.js applications.
Key findings • All 40 malicious packages share the @mastra/ npm scope — a single-organization campaign • Every advisory was published within a 7-minute window (05:05–05:12 UTC) on 2026-06…
Key findings • 25 high-severity CVEs disclosed together on June 17, 2026, all fixed in Chrome 149.0.7827.155 • Multiple sandbox escape chains: renderer compromise can lead to full system acce…
A sophisticated multi-stage loader campaign dubbed OnionDrop has been active since February 2026, delivering LegionLoader, CGrabber Infostealer, and Vidar Stealer via a gainmsg C2 server.
Cybercriminals hijacked Google Ads searches for AI developer tools, redirecting over 2,000 victims to fake download pages via claude.ai shared chat links.
Key findings • 16 CVEs disclosed in a single coordinated batch on June 16, 2026 • Three prototype pollution CVEs form a chain from MS SQL node to Merge node to public webhooks • Credentia…
GitHub rejected two vulnerability reports detailing design flaws that researchers say are enabling the Shai-Hulud supply-chain worm to infect hundreds of packages and developer accounts.
Key findings • All 10 malicious npm packages were disclosed within a 21-minute window on June 16, 2026 • Every package was registered within 3 days of disclosure, most within hours • No s…
A new fileless malware called Phantom Stealer steals browser credentials by executing entirely in memory, evading traditional antivirus detection.
A coordinated malware campaign on the JetBrains Marketplace has deployed at least 15 malicious IDE plugins that steal AI API keys from developers, with nearly 70,000 total downloads.
Key findings • 25 WordPress CVEs disclosed in a single 28-minute window on June 16, 2026 • 14 of the 25 are unauthenticated PHP Object Injection bugs across a family of themes • Critical …
A white-hat hacker discovered an authorization flaw in a FIFA World Cup 2026 platform that could have allowed an attacker to hijack live match broadcasts and replace video feeds with arbitrary content.
CISA has added CVE-2026-48907, an improper access control vulnerability in the Widget Factory Joomla Content Editor, to its Known Exploited Vulnerabilities catalog due to active exploitation.
Backslash Security found that Anthropic silently patched over 30 security flaws in Claude Code within two months, exposing a security gap caused by the rapid release cycle of AI coding tools.
Key findings • Three improper-access-control CVEs disclosed together for Devolutions Server • CVE-2026-12117 lets authenticated users enumerate social login metadata via a crafted API request…
Key findings • Two critical RCE bugs (CVE-2026-0164, CVE-2026-0139) in the Modem baseband, both remotely exploitable without user interaction • Two remote DoS CVEs (CVE-2026-0156, CVE-2026-01…
A Python developer narrowly avoided a supply-chain attack after an AI coding agent flagged a backdoor hidden in a fake Node.js repository sent by a LinkedIn recruiter posing as a crypto startup.
Key findings • Adobe disclosed 5 CVEs on June 16, 2026: 4 in DNG SDK, 1 in Acrobat PDF Extension for Chrome • CVE-2026-47964 is a heap-based buffer overflow in DNG SDK rated High (CVSS 7.8), …