Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,783 stories synthesized.
A critical authentication bypass vulnerability discovered in phpBB forum software allows attackers to log in as any user, including administrators, with a single HTTP request.
A China-linked hacking group known as Velvet Ant compromised Linux PAM and OpenSSH components to maintain undetected access to a target network for nearly a decade.
A phishing campaign targeting Brazilian organizations uses legitimate NinjaOne RMM software to gain remote control of endpoints without deploying traditional malware, evading security tools.
A Ukrainian national extradited from Ireland has pleaded guilty in the U.S. to conspiracy charges for his role in the Conti ransomware operation.
Key findings • Two High-severity bugs: admin privilege escalation (CVE-2026-7387, CVSS 8.8) and arbitrary file write via federated file sync (CVE-2026-6961, CVSS 7.6) • Three privilege-role l…
A Missouri bankruptcy court administrator has approved a $46.8 million settlement fund for approximately 7 million 23andMe customers whose genetic and personal data was stolen in a 2023 breach.
Key findings • 11 medium-severity CVEs disclosed together on June 12, 2026 spanning XSS, SQLi, IDOR, file access, and schema enumeration • Stored XSS accounts for the largest subgroup: three …
Cyfirma uncovered 11 malicious npm packages, including moralis-sdk with 2.7M downloads, that steal SSH keys, API tokens, cloud credentials, and cryptocurrency wallet secrets via lifecycle hooks and blockchain-based C2.
The Metropolitan Police and Apple have partnered to combat iPhone theft using iOS 26.4's strengthened Stolen Device Protection and real-time identifier sharing, driving an 18% drop in London phone thefts.
Attackers hijacked over 400 orphaned Arch User Repository packages in the 'Atomic Arch' campaign, injecting malicious npm packages that deploy infostealers targeting browser credentials, SSH keys, and cryptocurrency wallets.
Key findings • Critical CI/CD workflow injection (CVE-2026-47172) allows attackers to push malicious releases • Four High-severity flaws bypass Discord's role hierarchy and permission system …
A firmware vulnerability in Microsoft Surface devices allows permanent bricking via a single packet when Secure Boot is disabled, discovered after Copilot AI generated a destructive script.
Europol dismantled the AudiA6 cryptocurrency laundering network that processed over $380 million for ransomware groups, while the FBI seized 13 Chinese espionage domains and the JDY botnet expanded to target U.S. military networks.
A new C# remote access trojan named SHEETCREEP uses Google Sheets as a hidden command-and-control channel, targeting diplomatic organizations via phishing emails.
Google has filed a lawsuit against a China-based cybercrime group called 'Outsider Enterprise,' alleging it used AI-powered phishing kits to send millions of scam SMS messages targeting Android users.
Microsoft has resolved a known issue causing Windows updates released since May 2025 to fail when installed via the Windows Update Standalone Installer (WUSA) from a network share.
Iran-linked threat actor Handala claimed to have hacked California Water Service, leaking 5 GB of data including customer PII and administrative credentials.
A new Darktrace report reveals that 84% of sports organizations were targeted by cyber-attacks in the last year, with over half hit multiple times, as the FIFA World Cup 2026 begins.
Researchers at Trail of Bits and the badkeys project have identified hundreds of weak RSA and DSA keys in the wild, where private key bits are heavily biased toward zero, enabling a novel polynomial-based factoring attack.
Zscaler ThreatLabz reports phishing activity declined ~20% in both 2024 and 2025, with attackers moving from mass campaigns to targeted phishing mimicking routine business communications.
Key findings • Seven CVEs disclosed together for Apache CXF on June 12, 2026 • Two high-severity RCE bugs: JNDI injection (CVE-2026-50633) and incomplete JMS fix (CVE-2026-50632) • Token …
Danish pharmaceutical giant Novo Nordisk disclosed a data breach that exposed pseudonymized patient data from clinical trials and personal information of healthcare professionals, though manufacturing remains unaffected.
A phishing campaign targeting Steam accounts uses fake FACEIT verification pages with lookalike domains and a blurry QR code to trick gamers into handing over credentials.
Google released Chrome 149, fixing 28 security vulnerabilities—including five critical bugs—while warning that a dozen use-after-free defects could enable sandbox escape and remote code execution.