Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,187 stories synthesized.
Akamai reports that verified AI crawlers, including ChatGPT, are increasingly using POST requests on online stores and travel sites, mimicking user actions and expanding the attack surface.
Akamai's latest State of the Internet report reveals AI is significantly escalating cyber threats, driving a 300% increase in bot traffic and making APIs a primary attack surface.
Researchers have developed a 'context bomb' technique to disrupt autonomous AI agents, like Qwen3.8-27B, by embedding deceptive prompts in decoy cloud resources, potentially halting simulated cyberattacks.
Cisco Talos has identified CLOSEDQUORUM, a novel Windows implant that utilizes AI for autonomous command and control (C2), delegating decisions to a quorum of LLMs.
A new study reveals that nearly 20% of U.S. water and wastewater organizations have identity data exposed through infostealers, creating pathways for attackers to bypass MFA and access critical systems.
A Chinese-speaking threat actor leveraged two WordPress vulnerabilities to compromise 49 organizations, stealing 18,566 government records including plaintext passwords and PII.
A critical Windows privilege escalation vulnerability, CVE-2026-66804, allows local attackers to gain SYSTEM privileges by exploiting a dangling COM object registration.
A Gartner survey reveals a significant increase in deepfake incidents targeting employees via audio and video calls, prompting urgent calls for enhanced verification and incident response strategies.
A critical stack-based buffer overflow vulnerability (CVE-2026-86296) in D-Link DIR-822A routers, rated CVSS 10.0, allows unauthenticated remote attackers to execute code.
The Vidar information stealer has updated its obfuscation methods, employing a custom virtual machine and per-build stream ciphers to hinder static analysis and make detection more challenging.
A 2026 ranking of Identity Threat Detection and Response (ITDR) tools highlights Microsoft Defender for Identity as the top solution, with CrowdStrike and Silverfort also securing top positions for their distinct capabilities.
The Pakistan-linked SideCopy APT group has expanded its targeting to Indian academic institutions, employing sophisticated spear-phishing campaigns to deploy the ReverseRAT malware.
A 2026 ranking of passwordless authentication solutions highlights Microsoft's broad reach, Okta FastPass for SaaS integration, and Yubico for high assurance hardware keys, with a focus on passkeys and session security.
Four critical vulnerabilities in ZTE's SmartLife app, including a severe password reset flaw (CVE-2026-86553), allowed attackers to hijack user accounts.
A new tool called 5G-Shark can track 5G subscribers by luring their phones to a fake base station, despite 5G's privacy enhancements.
A critical vulnerability in WordPress core, dubbed 'Comment2Shell' (CVE-2026-93485), allowed unauthenticated users to execute arbitrary code on a server by tricking administrators into running malicious scripts.
A critical command injection vulnerability in Cisco ThousandEyes Virtual Appliance allows authenticated attackers to execute arbitrary code with root privileges.
Attackers are impersonating IT help desk staff on Microsoft Teams to trick employees into installing malware or granting remote access, ultimately stealing Windows passwords.
DavMail, a popular Java gateway for accessing Exchange/Office 365 via open protocols, has released version 7.0.0 with significant updates to its Microsoft Graph integration, improving compatibility for users migrating away from Outlook.
Check Point Research's latest threat intelligence report highlights a range of cyber incidents, from a significant data breach at Japan's Digital Agency to evolving threats in the AI landscape.
Genetics lab Ambry Genetics will pay $700,000 to settle a HIPAA investigation and implement enhanced security measures after a 2020 phishing attack exposed patient data.
Despite concerns that AI will accelerate exploit development, a security researcher found that fewer than 0.5% of vulnerabilities linked to Anthropic's Project Glasswing have been exploited in the wild.
Key findings • Ten malicious npm packages disclosed within a single minute on September 21, 2026. • Many packages share the @uh-platform/ npm scope, indicating a coordinated campaign. • P…
A third Chinese APT actor, UTA0565, has been observed exploiting chained zero-day vulnerabilities in Google Chrome and Microsoft Windows, using sophisticated fake websites to deliver the exploits.