Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,783 stories synthesized.
JFrog uncovered the Solana FakeFix campaign, deploying 25 malicious npm and PyPI packages targeting Solana developers to steal wallet keys, cloud credentials, and SSH keys.
Microsoft released fixes for three critical remote code execution vulnerabilities in Outlook and Word, stemming from memory-safety bugs in the Word rendering engine.
Palo Alto Networks has disclosed CVE-2026-0273, a command injection vulnerability in PAN-OS that lets authenticated administrators execute arbitrary commands as root via the CLI or web management interface.
Researchers analyzed over 1.5 million malicious domains flagged on VirusTotal between January and May 2026, revealing an assembly-line approach where domains are registered in industrial batches, weaponized within weeks, and concentrated among a small set of registrars and hosting providers.
CVE-2026-42835 is an Important-rated injection vulnerability in Microsoft Teams for Android that lets an authenticated attacker remotely read small portions of heap memory, potentially exposing authentication tokens and session data.
Key findings • CISA added Oracle CVE-2026-35273 to its KEV catalog on June 12, 2026, confirming active in-the-wild exploitation. • The vulnerability is flagged for use in ransomware campaigns…
Kyushu Electric Power Co. disclosed a physical security incident in which an unencrypted portable hard drive containing the personal data of 10.9 million customers was lost.
An attacker submitted fraudulent data breach notices to Maine's official breach portal, which were publicly posted before validation, forcing companies to deny non-existent incidents.
Key findings • Six high-severity CVEs disclosed together in Netty on June 11, 2026 • Three Redis codec bugs allow DoS via malformed payloads, nested arrays, or incomplete aggregates • HAP…
Key findings • 25 CVEs fixed in Chrome 149.0.7827.115 on June 11, 2026 • At least 13 CVEs are sandbox escape bugs, rated High to Critical • Three CVEs carry Chromium Critical severity: GP…
Key findings • 14 CVEs disclosed simultaneously for OpenClaw on June 11, 2026 • Seven CVEs rated High severity (CVSS 7.2–8.8), one Critical-adjacent at 8.8 • Bugs span authorization byp…
Key findings • CVE-2026-53782 is a high-severity SSRF in Summarize <0.17.0 via malicious podcast transcript links • CVE-2026-53781 allows disk exhaustion by bypassing media size limits throug…
CISA has added CVE-2026-10520, an Ivanti Sentry OS command injection vulnerability, to its Known Exploited Vulnerabilities catalog due to active exploitation.
Key findings • Seven CVEs disclosed together in macOS Sequoia 15.4 security update • Two high-severity bugs: sandbox escape (CVE-2025-24284, CVSS 8.8) and launch constraint bypass (CVE-2025-3…
A maximum-severity vulnerability in Ivanti Sentry is being actively exploited in the wild within 24 hours of disclosure, prompting CISA to add it to the Known Exploited Vulnerabilities catalog.
A roundup of the week's crypto security news includes a sentencing in a $97 million laundering case, a $32 million hack of Humanity Protocol, a Zcash vulnerability patch, and EU actions against crypto platforms linked to Russia.
Key findings • Nine CVEs disclosed together on June 11, 2026, covering prototype pollution, proxy-credential leaks, and security-control bypasses • CVE-2026-44494 (CVSS 8.7) shows how a proto…
Wordfence's weekly vulnerability report for June 1-7, 2026, discloses 159 flaws across 140 plugins and 2 themes, including a critical unauthenticated authentication bypass in the UpdraftPlus backup plugin.
A new Go-based malware loader called GoFlateLoader has infected over 33,000 users globally by inflating its file size to 700–950 MB, bypassing VirusTotal's 650 MB upload limit and delivering infostealers entirely in memory.
A critical path-traversal vulnerability in Langflow, CVE-2026-5027, is being actively exploited to achieve remote code execution on exposed instances.
New analysis reveals The Gentlemen ransomware operation has hit 478 victims, evolving from a RaaS affiliate into a self-replicating worm-like threat.
A security researcher known as brutecat used an AI-powered fuzzing pipeline to uncover over $500,000 in vulnerabilities across Google's internal APIs in under three months, exposing critical access-control flaws.
CISA issued Binding Operational Directive 26-04, requiring federal civilian agencies to adopt a risk-based vulnerability management framework that prioritizes actual exploit risk over CVSS scores.
CISA disclosed four vulnerabilities in the Naxclow IoT platform, including a critical 9.8-rated hard-coded key flaw, affecting doorbells and cameras with no patches available.