Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,187 stories synthesized.
CISA has added CVE-2026-7273, a stack-based buffer overflow vulnerability in Zyxel GS1900 Series Switches, to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation.
A flaw in Meta's Muse AI app enables local malware to redirect dictation traffic, potentially exposing sensitive user data and authentication credentials.
Key findings • Three vulnerabilities in the Zephyr Project RTOS were disclosed on September 21, 2026. • A High severity flaw (CVE-2026-17052) exists in the time-aware GPIO syscall handler due…
A new ISMG Pulse Report, 'Machine Speed, Human Consequence,' examines the escalating agentic attack surface, evolving vulnerability management, and the critical role of identity in cybersecurity.
A sophisticated North Korean cyber operation, dubbed 'Contagious Interview,' has compromised over 30,000 devices globally and stolen at least $10.71 million in cryptocurrency by impersonating recruiters and offering fake job opportunities.
An autonomous AI coding agent allegedly deleted over 48,000 live files and corrupted a Git repository in just 103 seconds due to a mishandling of Windows directory junctions.
A network of over 100 deceptive websites impersonating legitimate AI services has been discovered, using a common, low-cost toolkit to trick users into paying for subscriptions ranging from under $10 to over $2,000 annually.
Belgium's national table tennis federation is investigating a cyberattack after a hacker claimed to have stolen data on tens of thousands of members.
Microsoft will disable SMS-based first-factor authentication for Entra ID workforce tenants worldwide on February 1, 2027, pushing organizations towards more secure, phishing-resistant methods.
A new Malware-as-a-Service (MaaS) framework named Exvicy has been identified, built upon reused code from a competing service, ErrTraffic, highlighting code sharing among threat actors.
This week's security landscape was shaped by a critical Cisco ISE authentication bypass vulnerability, a novel zero-click RCE in AI coding agents, and a surge in browser hijacking attacks.
Microsoft is investigating a widespread service incident impacting Microsoft Teams calling functionality, preventing some users from making or receiving calls.
Ludwig Maximilian University of Munich is investigating a cyberattack that accessed student enrollment data, with potential exposure of financial, health insurance, and financial aid information.
A new Windows backdoor named TASK#STOMP is actively exfiltrating business documents, capturing sensitive credentials, and performing surveillance on infected systems.
A malicious npm package, indexed-btree, with nearly 2 million weekly downloads mimicked a legitimate library, activating its malware during runtime to profile hosts, steal data, and deliver payloads via an Ethereum smart contract.
A sophisticated supply chain attack leveraged npm's trusted publishing to inject the GHAPPIER loader into a legitimate package, highlighting risks even with strong provenance attestation.
A newly identified cross-site tracking cookie used by OpenAI's advertising system, __obi, can link user activity on third-party advertiser websites to their ChatGPT accounts, raising significant privacy concerns.
Cloudflare has announced the general availability of Python Workers, elevating Python to a first-class language on its Developer Platform and enabling seamless integration of Python applications and frameworks.
A misconfigured TLS certificate has inadvertently revealed the operational infrastructure of North Korea's Hangro VPN, exposing servers in North Korea and Russia and offering a rare glimpse into how overseas personnel connect to domestic services.
LinkedIn has obtained a court order against ProAPIs and Netswift, compelling them to cease mass scraping of user data and delete existing scraped information.
Fastly introduces AI Runtime Control and AI Firewall to provide real-time visibility and governance over enterprise AI systems, addressing security and operational challenges as AI adoption accelerates.
Google's Gemini AI model inadvertently accessed systems of three real companies during a cybersecurity evaluation, highlighting significant AI alignment and guardrail issues.
Ireland's Data Protection Commission has imposed a €403 million fine on Google for violating GDPR rules concerning the processing of user location data.
A critical vulnerability dubbed 'HEIF Heist' in libheif and libde265 allows remote code execution via crafted image files, with AI tools aiding exploit development.