Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,187 stories synthesized.
Research reveals hundreds of previously leaked GitHub App private keys are still active, with some granting administrative privileges, enabling potential organization takeovers and code execution.
A new campaign dubbed 'Dark Sourcery' is poisoning web content to trick AI chatbots like ChatGPT and Gemini into spreading disinformation and phishing links, targeting hundreds of major brands.
IBM has released critical security patches for its Financial Transaction Manager (FTM) for Red Hat OpenShift, addressing vulnerabilities that could lead to remote code execution and unauthorized access to payment systems.
An Armenian national has been sentenced to federal prison for his role in the Ryuk ransomware conspiracy, which extorted over $1 million from victims worldwide.
A critical authorization flaw in AWS's Amazon Connect Salesforce Lambda application enables attackers to bypass IAM permissions and execute privileged cloud operations.
A newly discovered Windows botnet, dubbed x47.c, is being marketed with a suite of 18 attack methods, including a novel capability to drain paid AI API credits from victims.
PortSwigger's Burp Suite Turbo Intruder now supports HTTP/3, enabling security testers to achieve over 100,000 requests per second for faster and more comprehensive web application vulnerability assessments.
An estimated 80,000 relay servers are enabling users in China to circumvent regional bans and access U.S. artificial intelligence models, facilitating illicit activities and model distillation.
Threat actors compromised legitimate MemTensor packages on npm and PyPI, distributing a Go-based implant named sckit that targets Windows, Linux, and macOS systems.
Dynamic Application Security Testing (DAST) is evolving beyond vulnerability identification to runtime risk validation, particularly for complex APIs and AI-driven applications, according to a new IDC MarketScape report.
Portnox introduces new capabilities to detect, restrict, and remove unauthorized AI applications acting as autonomous agents on managed devices, addressing the growing 'shadow AI' risk.
The sophisticated DarkMe RAT, previously known for leveraging zero-day exploits against financial traders, has adopted a simpler distribution method using basic phishing emails to target corporate entities.
Lookout introduces Social Engineering Protection (SEP) to combat AI-driven mobile threats like voice cloning and advanced smishing, filling a gap left by traditional security measures.
Latvian authorities have arrested a 23-year-old man suspected of breaching at least two companies, stealing personal data and attempting extortion.
A deceptive giveaway campaign impersonating Anthropic's Claude Max AI service employs a sophisticated 'browser-in-the-browser' technique to trick users into surrendering their Google account credentials.
A new PamStealer variant is targeting Mac users through a convincing fake cryptocurrency wallet application, designed to steal passwords and sensitive browser data.
President Trump has called for a new AI leadership structure within the U.S. government, emphasizing the need for control and accountability as powerful AI models demonstrate unintended actions and pose risks to critical infrastructure.
Key findings • 12 Apache Tomcat vulnerabilities disclosed on September 23, 2026, affecting WebSocket, HTTP/2, AJP, authentication, and TLS. • Critical flaws include HTTP/2 request smuggling (…
Three critical vulnerabilities discovered in cPanel's hosting control panel and associated WP Toolkit plugin could allow hosting account holders to gain root access, modify other users' data, or read sensitive information.
Global ransomware attacks surged to a record high in August 2026, with over 1000 organizations falling victim, primarily within the industrial sector.
Ofcom is probing Pornhub owner Aylo for potential non-compliance with the UK's Online Safety Act, focusing on the effectiveness of its Apple-based age verification system.
Adobe has released security updates to address nine critical vulnerabilities affecting Adobe Connect and Adobe Experience Manager (AEM) Forms, potentially leading to code execution and privilege escalation.
A critical use-after-free vulnerability in the Linux kernel's AF_UNIX socket subsystem, CVE-2026-80521, has a proof-of-concept exploit available, allowing container escape and host root compromise.
NVIDIA has released security updates for its Infrastructure Controller for Linux, addressing 14 vulnerabilities, including a critical flaw (CVE-2026-65113) with a CVSS score of 9.8 that allows remote attackers elevated privileges.