Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,687 stories synthesized.
CISA has issued an advisory detailing four critical memory corruption vulnerabilities in Rockwell Automation Arena software, versions prior to V17.00.01, which could allow attackers to execute arbitrary code.
A double-free vulnerability in Rockwell Automation's Flex 5000 Adapter could allow attackers to cause a denial-of-service condition, requiring a module power cycle for recovery.
CISA has issued an advisory for SALTO ProAccess Space versions prior to 6.13, detailing a privilege escalation vulnerability (CVE-2026-11889) that allows authenticated attackers to bypass partition restrictions.
CISA has issued an advisory detailing several critical vulnerabilities in AutomationDirect Productivity Suite, potentially allowing local attackers to cause memory corruption, information disclosure, or denial-of-service conditions.
CISA has issued an advisory detailing multiple critical vulnerabilities in Siemens SICAM 8 products, including CPCI85 and SICORE firmware, that could lead to denial of service, unauthorized code execution, and system compromise.
Microsoft outlines critical security considerations for AI agents, emphasizing the need for robust identity management and tightly scoped access controls to prevent misuse.
A new macOS information stealer, ClickLock Stealer, uses social engineering to trick users into pasting malicious commands into Terminal, leading to theft of sensitive data and system control.
A global phishing campaign is distributing a Lua loader disguised as a TrueType font file, enabling threat actors to bypass security controls and deploy various malware payloads.
Next.js is launching a new monthly security release program, with its inaugural update on July 20, 2026, addressing nine vulnerabilities in versions 16.2 and 15.5.
AI penetration testing is expanding to address new attack vectors like retrieval poisoning, memory manipulation, and sensor interference, moving beyond traditional infrastructure compromise.
Dutch authorities have disrupted a large-scale investment fraud network operating 20 call centers and employing 700 people, allegedly responsible for over €100 million in losses.
A critical flaw in n8n's Enterprise token exchange feature allowed attackers to log in as users from different identity providers by exploiting incorrect JWT issuer matching.
Cybersecurity researchers demonstrated that OpenAI's advanced GPT-5.5 model can execute a complete cyber-attack chain, including achieving domain-level access, using only a single prompt.
A new advanced persistent threat campaign, dubbed HelloNet, is leveraging the ViPNet update system to deploy sophisticated malware, targeting critical Russian organizations.
Tenable is organizing a collaborative build event at Black Hat 2026, dubbed 'Swarm,' to encourage the open-source development of AI security agents and combat predicted 'agent sprawl.'
A new modular malware named TELEPUZ is spreading via websites infected with ClickFix lures, designed to steal data and execute commands remotely.
A new macOS stealer named ClickLock employs a novel 'kill loop' to repeatedly terminate essential system processes, forcing users to enter their administrator password to regain control, which the malware then steals.
The GoSerpent backdoor, active since 2021, has been updated with sophisticated data collection and exfiltration capabilities, continuing to target government and diplomatic entities in Southeast Asia.
Over 20 Brazilian government websites were compromised and weaponized by the PhantomEnigma threat actor to distribute malware, leveraging trusted infrastructure to evade detection.
Two key members of the notorious Scattered Spider cybercrime group have been sentenced to over five years in prison for their role in the 2024 Transport for London (TfL) hack.
Scammers are using a social-engineering tactic called GhostPairing to hijack WhatsApp accounts by tricking users into approving a new linked device, bypassing the need for passwords or verification codes.
JetBrains has released patches for six vulnerabilities impacting its development tools, including critical flaws in IntelliJ IDEA and TeamCity.
Researchers have identified a novel attack vector, 'Agent Data Injection' (ADI), that manipulates AI agents by corrupting the data they implicitly trust, leading to unintended actions like unauthorized purchases or command execution.
Intruder's new AI Pentesting service automates web application security assessments, offering rapid, on-demand testing with audit-ready reports.