Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,785 stories synthesized.
Broadcom has released security advisory VMSA-2026-0004 addressing three critical stored XSS vulnerabilities in VMware Cloud Foundation Operations and related products, allowing authenticated attackers to inject malicious scripts.
A critical vulnerability chain in Ubiquiti's UniFi OS Server allows unauthenticated remote code execution, granting attackers root access by exploiting authentication bypass and command injection flaws.
A critical post-authentication RCE vulnerability in Redis, dubbed DarkReplica (CVE-2026-23631), has been patched, allowing attackers to gain complete control of host servers.
Key findings • Four SQL injection vulnerabilities disclosed for Code Projects products on June 8, 2026. • Three High severity (CVSSv3 7.3) and one Medium severity (CVSSv3 6.3) vulnerabilities…
This week's security landscape featured a surge in sophisticated scams targeting cryptocurrency users, mobile gamers, and online accounts, alongside critical vulnerabilities in AI tools and consumer devices.
Visual Studio Code now delays automatic extension updates by two hours, introducing a crucial buffer to combat software supply chain attacks.
Three real-world cyber attack scenarios, including a Microsoft Teams scam, identity phishing, and an advanced threat campaign, reveal critical detection failures and lessons learned for limiting attack spread.
Key findings • Eight vulnerabilities disclosed on June 8, 2026, affecting two SourceCodester systems. • Six High-severity SQL injection flaws found in Class and Exam Timetabling System 1.0. …
Google has launched a Command-Line Interface for Colab, allowing AI agents and developers to leverage remote compute resources, including GPUs and TPUs, for executing code and retrieving artifacts.
Attackers are increasingly bypassing security tools by communicating directly with IP addresses, with over half of these threats going undetected by current intelligence feeds, according to Palo Alto Networks.
A sophisticated attack chain exploits a malicious npm package to hijack traffic from Anthropic's Claude Code, stealing valuable OAuth tokens and granting attackers persistent access to SaaS platforms.
Key findings • Two High-severity SQL injection vulnerabilities in Class and Exam Timetabling System 1.0. • One Low-severity XSS vulnerability in Hospitals Patient Records Management System 1.…
Trend Micro's Vision One platform now offers AI-aware visibility and detection for Anthropic's Claude Enterprise through two new collectors, addressing security gaps where inline controls are not feasible.
A new open-source tool, EDRChoker, exploits Windows' native Quality of Service engine to starve Endpoint Detection and Response agents of network bandwidth, rendering them ineffective.
A zero-day vulnerability in Cisco SD-WAN is actively being exploited, highlighting a busy week in cybersecurity that also saw significant developments in AI security and other critical vulnerabilities.
A critical logic bug in Instagram's web password reset flow briefly exposed unredacted user emails and phone numbers before Meta deployed an emergency hotfix.
OpenAI introduces ChatGPT Lockdown Mode, a new security feature designed to prevent sensitive data exfiltration stemming from prompt injection attacks by restricting outbound network access.
Consumer apps embedding an iOS SDK are transforming smart TVs and other devices into proxy servers for web scraping, routing traffic for AI data collection operations.
An AI agent has discovered 21 zero-day vulnerabilities in the widely-used FFmpeg media processing library, while Google's Chrome browser released an update addressing a record 429 security flaws.
Oxford University's CareerConnect platform, managed by Group GTI, experienced a data breach exposing student and alumni names and email addresses, alongside encrypted passwords for non-SSO users.
A critical vulnerability (CVE-2026-4372) in Hugging Face Transformers allows remote code execution via malicious model configuration files, impacting millions of users and AI pipelines.
Key findings • Twelve malicious packages were purged from PyPI in a single-minute coordinated takedown on June 6, 2026 • Affected packages include 'dynamo-release', 'ufish', 'executor-http', …
Key findings • A total of 32 malicious packages were simultaneously purged from PyPI on June 6, 2026, at 06:13 UTC. • The campaign heavily targeted AI, machine learning, and Model Context Pro…
Key findings • Four vulnerabilities disclosed for TP-Link Tapo C520WS v2 on June 5-6, 2026. • High-severity DoS vulnerability (CVE-2026-8714) affects the RTSP server. • Three medium-sever…