Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,782 stories synthesized.
Poland warns that the Belarus-linked GhostWriter group is now targeting personal Gmail accounts of senior public figures and their relatives in an expanded phishing campaign.
Socket's Threat Research Team uncovered 152 Chrome extensions that secretly log user data and forge Google organic-search attribution to inflate ad revenue.
Key findings • Four CVEs disclosed across CodeAstro Student Attendance and HR Management systems • Two SQL injection flaws (CVE-2026-12175, CVE-2026-12131) in admin input fields • Two XSS…
BugHunter, an open-source toolkit built on Claude Code, now supports free AI providers including Ollama and Groq, automating vulnerability discovery and report generation for bug bounty hunters.
Key findings • 25 CVEs disclosed across WordPress plugins and themes in a 48-hour window • Three critical-severity flaws: Amasty Order Attributes (9.8), Hippoo WooCommerce (9.8), JoomSport SQ…
Key findings • Ten malicious npm packages disclosed within a 28-minute window on 2026-06-13 • The houzidawang807 and houzidawang808 pair were registered just 20 hours before disclosure • …
Anthropic disabled its two most advanced AI models globally after a U.S. government directive ordered blocking access for all foreign nationals, citing a potential jailbreak technique.
Rapid7's latest Metasploit update introduces KerberosTicketTrace and CertificateTrace debugging options, plus multiple new exploit and auxiliary modules for penetration testers.
Key findings • Ten CVEs disclosed together by Gen Digital on June 12, 2026 • Five High-severity heap buffer bugs (CVSS 7.8) can lead to local code execution • Flaws triggered by scanning …
NanoClaw, a secure AI agent framework, has partnered with JFrog to let agents fetch tools from vetted registries, reducing exposure to malicious packages.
Key findings • 12 CVEs in one batch: 4 High, 8 Medium severity • Mass assignment bugs (CVE-2026-54361, CVE-2026-54360) allow overwriting server-controlled fields • Authorization gaps let …
Key findings • 25 CVEs disclosed across June 11-12, 2026 — largest security update in OpenClaw history • One Critical-severity flaw (CVE-2026-53838, CVSS 9.8) — node pairing reconnection …
Key findings • Two critical CVEs: prototype pollution (9.1) and sanitize-html bypass (9.3) • Four high-severity bugs include stored XSS, SSRF, and host-header injection • Password reset f…
Key findings • 13 CVEs disclosed together for Nezha Monitoring, including two Critical-severity flaws (CVSS 9.1 and 9.9) • CVE-2026-46716 (CVSS 9.9) lets any RoleMember push arbitrary command…
Unit 42 researchers have discovered a new macOS forensic artifact in Tahoe 26 that logs every menu selection a user makes, providing unprecedented insight into digital intent for incident responders.
Key findings • Six CVEs across five IBM product lines disclosed in a single 48-hour window • Most severe: CVE-2026-7870 (CVSS 8.8) — unqualified library call in IBM i 7.3–7.6 • Langfl…
Key findings • 11 CVEs disclosed together on June 12, 2026 across Discourse core and plugins • One High-severity bug (CVE-2026-44786, CVSS 7.5) in Chat MessageBus scoping • Chat plugin ac…
WatchTowr Labs discloses CVE-2026-20253, a pre-authentication remote code execution vulnerability in the PostgreSQL Sidecar Service that ships enabled by default in Splunk Enterprise on AWS.
Key findings • CISA disclosed 8 CVEs across Naxclow IoT Platform and Brickcom cameras in a single 22-hour window • CVE-2026-28742 is a critical 9.8-rated hard-coded salt that lets attackers f…
Google has filed a lawsuit against a Chinese phishing-as-a-service provider accused of using its Gemini AI to generate over 1.59 million scam URLs, victimizing more than 100,000 people.
Russia's APT28 has shifted to hijacking consumer routers and abusing cloud storage APIs to create a stealthy, disposable attack infrastructure that blends into normal internet traffic.
Ezekiel Dean Potter, a former IT support worker at Iowa's Saydel Community School District, was sentenced to 21 months in prison for a 20-month sabotage campaign using over 300 stolen credentials.
U.S., French, and Italian authorities seized CFAKE.com and SOCFAKE.com, arresting a French administrator and recovering 300,000 images and 7,000 videos of nonconsensual deepfake pornography.
A critical authentication bypass vulnerability discovered in phpBB forum software allows attackers to log in as any user, including administrators, with a single HTTP request.