Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,561 stories synthesized.
A directory traversal vulnerability in MailEnable, assigned CVE-2026-114556, allows unauthenticated remote attackers to create arbitrary files on affected systems.
A use-after-free vulnerability in Ashlar-Vellum Cobalt XE, disclosed by Zero Day Initiative, allows remote attackers to execute arbitrary code.
A heap-based buffer overflow in Ashlar-Vellum Cobalt, disclosed by Zero Day Initiative, allows remote attackers to execute arbitrary code by tricking users into opening malicious files or visiting malicious websites.
A sophisticated campaign is exploiting compromised Microsoft Entra ID application credentials and Azure DevOps identities to gain unauthorized access to at least 27 organizations, including managed service providers and their downstream clients.
Anthropic has released FlashProve, an open-source prototype enabling cryptographic verification of AI model outputs, addressing trust and transparency concerns in hosted AI services.
This episode of Risky Business dissects a $6.3 billion Binance hot wallet incident, introduces Google's 'LLMjacking' threat, and covers breaches at Amadeus, Northflank, and DHS.
An unknown threat actor exfiltrated 69GB of sensitive data from the Philippine Overseas Employment Administration, potentially exposing personal information of migrant workers.
Yubico introduces YubiID, a new subscription service designed to integrate identity verification with credential enrollment and recovery, addressing a critical gap beyond phishing-resistant authentication.
Key findings • Apple's CVE-2024-27834 has been added to CISA's KEV catalog due to confirmed active exploitation. • The vulnerability poses a significant risk, requiring immediate attention fr…
Athenahealth's new feature allowing patients to link their EHR data to Anthropic's Claude AI raises significant HIPAA compliance questions, despite the vendor's claims of patient-directed use.
A sophisticated phishing campaign, active since May, is targeting customers of approximately 300 U.S. financial institutions and cryptocurrency exchanges, employing novel evasion techniques to thwart detection.
CISA has added CVE-2026-119977, a WordPress Core Time-of-check Time-of-use (TOCTOU) race condition vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation.
Defense contractor ILC has agreed to a $13 million settlement with U.S. agencies to resolve allegations of violating cybersecurity contract requirements between 2018 and 2024.
An Oklahoma man faces federal charges for allegedly mailing threatening letters and suspicious white substances to election officials across the United States, promoting election fraud conspiracies.
Apple has alerted numerous German lawmakers and foreign policy staff to potential spyware attacks, leading the German information security agency to advise recipients to assume their devices are compromised and replace them.
Blockchain infrastructure provider Chainstack has disclosed a breach of its production systems, attributed to an AI-powered attack campaign that also targeted WorkOS and Chainalysis, exposing customer data and password hashes.
Key findings • 40 malicious npm packages were disclosed on November 3, 2026. • All disclosures occurred within a 9-minute window, indicating a coordinated attack. • All packages were newl…
Microsoft details a fake download campaign using trojanized installers to distribute multiple monetization payloads, posing risks through silent installation of unwanted software.
OpenAI has developed and deployed Pando, a novel Git backend built with AI agents, to manage its massive monorepo, significantly improving performance and integrating continuous AI-driven security testing.
Microsoft has been recognized as a Leader in Gartner's first-ever Magic Quadrant for AI Agent Management Platforms, highlighting its Agent 365 solution.
CISA alerts users to two critical vulnerabilities in Subnet Solutions PowerSYSTEM Center, versions 2020, 2024, and 2026, potentially leading to unauthorized access and data breaches.
Password manager mSecure is advising users to change passwords, reset two-factor authentication, and remove passkeys due to suspicious activity detected by its maker, mSeven Software.
Barracuda has disclosed two critical vulnerabilities that can be chained together to allow attackers to bypass authorization and gain root access to affected devices.
A Texas school district's auction of approximately 700 computers resulted in a buyer discovering sensitive student and staff data on at least 11 devices, highlighting risks of inadequate data sanitization.