Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,184 stories synthesized.
A vulnerability in Microsoft Entra ID's Self-Service Password Reset portal allows unauthenticated users to discover account existence and MFA methods, aiding attackers in targeted attacks.
Malwarebytes research reveals a network of deceptive websites, masquerading as shipping rebate services, that secretly enroll users in costly auto-renewing subscriptions.
A critical Cross-Site Request Forgery (CSRF) vulnerability in the Elementor Website Builder plugin, affecting versions 4.3.0 and 4.3.1, enables unauthenticated attackers to create new administrator accounts on over two million WordPress sites.
A critical vulnerability in Sudo, CVE-2026-96512, allows local attackers to bypass time-based access controls by manipulating the TZ environment variable, enabling unauthorized command execution.
EfficientIP researchers have developed a novel method to identify and flag AliExpress phishing domains before they are officially registered, enabling earlier mitigation of malicious campaigns.
The MacSync information stealer has adopted a sophisticated delivery chain using malicious disk-image files disguised as applications, targeting cryptocurrency and developer tools for credential theft.
Docker launches Cloud Sandboxes, extending its secure isolation technology to the cloud for scalable, persistent AI agent execution.
Attackers are distributing fake desktop applications for popular US payroll and HR platforms, leading to the deployment of ScreenConnect for unauthorized system access and potential payroll theft.
SentinelOne's Wayfinder Threat Hunting now covers AWS, Azure, and Google Cloud, integrating AI telemetry with human expertise to protect cloud workloads and identities.
Dataiku's new Agent Management tool aims to provide visibility and control over the rapidly growing landscape of AI agents within organizations.
Crypto casino Duelbits has confirmed a $7 million hot wallet hack, forcing the platform offline for investigation and server rebuilding.
Coralogix CEO Ariel Assaraf argues that effective AI agent security requires enforcement at the execution layer, moving beyond simple system prompts to manage context, tune risk, and monitor actions.
Attackers exploited Payy Network's Ethereum bridge contract, draining its full balance and forcing the platform to suspend all network and wallet functions.
Ping Identity introduces Enterprise Personal Agent Access, a new solution designed to secure personal AI agents with discovery, secretless privileged access, and runtime control.
Cryptocurrency exchange Bitget has confirmed a major security breach, with attackers siphoning approximately $351.6 million in digital assets from its hot and warm wallets.
Key findings • Eleven malicious npm packages were disclosed within a single minute on September 25, 2026. • Multiple packages impersonated n8n-nodes utilities, indicating a targeted campaign.…
Key findings • CVE-2026-65660, a Microsoft vulnerability, is confirmed under active exploitation. • CISA added this flaw to its KEV catalog on September 25, 2026. • Immediate patching of …
Key findings • CISA added WordPress CVE-2026-87902 to its KEV catalog due to active exploitation. • The vulnerability poses a significant risk to affected WordPress installations. • Organ…
The threat group UNC6240, also known as ShinyHunters, has escalated its exploitation of Oracle PeopleSoft, developing new techniques to bypass web application firewall rules and broaden its targeting across multiple sectors.
A threat actor leveraged three open-source AI agents to conduct automated attacks, compromising over 27 organizations and stealing more than 600,000 credit card records.
Key findings • 25 vulnerabilities disclosed across Apache projects, with a heavy focus on Apache Tomcat. • Critical flaws in Tomcat include authentication bypasses (CVE-2026-86248, CVE-2026-7…
CISA and its Five Eyes partners are set to release new guidance aimed at helping operational technology owners and operators recover from cyberattacks.
The shift to post-quantum cryptography (PQC) will require significant hardware upgrades, impacting routers, firewalls, and applications due to increased processing demands and larger key sizes.
Bipartisan legislation introduced in the House and Senate aims to integrate the biotechnology sector into CISA's critical infrastructure protection framework, addressing growing concerns over cyber threats to sensitive biological data and infrastructure.