Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,187 stories synthesized.
A new malware campaign, dubbed Rapuncel, employs a Microsoft-signed kernel driver to disable over 145 security tools before stealing sensitive user data.
The Remus infostealer, active since March 2026, employs sophisticated techniques to bypass endpoint detection and response (EDR) systems before stealing credentials from browsers, cryptocurrency wallets, and increasingly, AI tools.
A new analysis from Trail of Bits argues that the foundational Security Assertion Markup Language (SAML) protocol is overly complex and insecure, advocating for its replacement with modern alternatives like OpenID Connect.
The TerminalFix campaign is using PNG steganography to embed malicious Windows executables and DLLs within image files, overwriting original content.
The Rust project is warning developers about a social engineering campaign using fake job offers and video calls to trick targets into installing malware or executing malicious code.
The ShinyHunters extortion group has seized control of the Cl0p ransomware gang's dark web leak site, demanding a significant payment and revealing internal details.
Multiple water utilities in Colorado have fallen victim to cyberattacks that specifically targeted their operational technology (OT) systems, disrupting critical functions.
The PAYLOAD ransomware group is weaponizing Active Directory Group Policy Objects (GPOs) to deliver ransom notes and disrupt operations without deploying traditional ransomware binaries.
Palo Alto Networks Unit 42 details AWS's automated defense against exposed IAM credentials, leveraging secret scanning and managed policies to revoke access.
Siemba introduces automated testing for Insecure Direct Object References (IDOR) in its API Security Testing suite, aiming to rapidly identify vulnerabilities that expose sensitive customer data.
Multiple threat actors are actively exploiting three critical vulnerabilities in the Linux kernel, posing risks of denial-of-service, memory disclosure, and memory modification.
A novel malware campaign dubbed EtherHiding utilizes blockchain technology on the Polygon network to host its command-and-control servers, making them highly resilient to takedowns and enabling the theft of bank logins and 2FA codes.
A new proof-of-concept tool, BigDiskBuster, targets Microsoft Defender Antivirus by exhausting disk space and locking files, preventing critical security updates.
Hackers are leveraging a critical authentication bypass vulnerability in cPanel and WHM (CVE-2026-41940) to deploy the Mirai botnet malware, turning compromised hosting servers into botnet nodes.
ESET research highlights how AI agents introduce new cybersecurity risks for SMBs, with adversaries leveraging AI to scale traditional threats and exploit a burgeoning ecosystem of malicious AI 'skills'.
A new remote access trojan, ChainScript, is being distributed via ClickFix lures and utilizes blockchain technology on the Polygon network to rotate its command and control infrastructure, making it difficult to track.
A 2026 evaluation of multi-factor authentication solutions places Microsoft Entra MFA at the top, emphasizing phishing resistance and bundled value, followed by Cisco Duo and Yubico.
A 2026 review of Single Sign-On (SSO) solutions emphasizes security controls over convenience, highlighting phishing-resistant features and robust identity protection.
A novel web cache poisoning method, cache key injection, allows attackers to manipulate web server caching mechanisms to serve restricted data or inject malicious content without user interaction.
A 2026 review of Identity and Access Management (IAM) solutions highlights Microsoft Entra ID, Okta, and Ping Identity as leaders, emphasizing the critical role of identity in modern cybersecurity.
A sophisticated multi-stage infection chain hides the XMRig cryptocurrency miner within the Windows Registry, PNG images, and WAV audio files, employing PowerShell and DNS TXT records for stealthy execution and command and control.
Exim 4.100.1 addresses four vulnerabilities, including high-severity heap corruption via Proxy Protocol handling and a medium-severity SMTP smuggling flaw.
This week's security news roundup includes new AI-driven Android malware, an actively exploited Google Pixel modem vulnerability, and concerns over data brokers selling personal information.
Key findings • 28 malicious npm packages were disclosed simultaneously on September 21, 2026. • All advisories were published within a single minute, indicating a highly coordinated attack. …