Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,785 stories synthesized.
A new fork of HexStrike AI, version 6.0, merges 127 security tools with the BOAZ evasion engine, enabling AI agents to autonomously conduct advanced penetration testing and enterprise evasion.
Key findings • A coordinated sweep on June 5, 2026, removed 40 malicious npm packages at the exact same instant • The campaign targeted established packages, including 'ai-sdk-ollama' which h…
Key findings • 25 low-severity vulnerabilities disclosed for Google Chrome on June 5th, 2026. • All issues patched in Chrome version 149.0.7827.53. • Multiple 'use after free' bugs found …
Key findings • 25 low-severity vulnerabilities disclosed for Google Chrome on June 4-5, 2026. • All issues patched in Chrome version 149.0.7827.53. • Vulnerabilities span multiple compone…
Key findings • Ten vulnerabilities disclosed for Google Chrome for iOS between June 4-5, 2026. • Includes four high or critical severity 'use after free' vulnerabilities. • Critical flaws…
Key findings • 25 vulnerabilities in Chromium disclosed together on June 4-5, 2026. • All disclosed issues are fixed in Google Chrome version 149.0.7827.53. • Vulnerabilities span multipl…
Mandiant reports on UNC3753, a threat actor using voice phishing and social engineering to steal sensitive data from US law firms, often completing intrusions within a single business day.
A sweeping Executive Order signed June 2, 2026, requires federal agencies to rapidly implement AI-enabled cyber defenses and establish a new AI cybersecurity clearinghouse within 30 days.
Key findings • Seven vulnerabilities disclosed by Microsoft on June 4th, 2026, within a four-hour window. • Three critical vulnerabilities with CVSS scores up to 10.0 affect Azure, Exchange O…
Key findings • 25 low-severity vulnerabilities in Google Chrome disclosed simultaneously on June 4, 2026. • Vulnerabilities affect diverse components including Media, Web Bluetooth, and Exten…
Key findings • 25 low-severity vulnerabilities in Google Chrome disclosed simultaneously on June 4, 2026. • Vulnerabilities affect diverse components including Web Bluetooth, Extensions, and …
Key findings • Six vulnerabilities in Google Chrome's ANGLE graphics engine disclosed on June 4, 2026. • Vulnerabilities range in severity from Medium to High. • Potential impacts include…
Key findings • Two critical ANGLE vulnerabilities (CVE-2026-10881, CVE-2026-11088) allow sandbox escapes. • A medium-severity flaw (CVE-2026-11090) enables cross-origin data leakage. • Al…
The Pink extortion group is using voice phishing and fake IT helpdesk calls to steal credentials, bypass MFA, and exfiltrate data from cloud storage, threatening victims with public data leaks.
The Windows version of the Hola Browser has been compromised through a supply chain attack, distributing an undeclared cryptocurrency miner to unsuspecting users.
Wordfence's Q1 2026 Threat Intelligence Report indicates a dramatic surge in WordPress vulnerabilities, with a nearly 100% increase in critical flaws and billions of attacks blocked.
A new Magecart campaign is leveraging Stripe's API infrastructure to host malicious JavaScript payloads and exfiltrate stolen credit card data, making detection more difficult.
Volexity details how the VerdantBamboo (WARP PANDA) threat actor maintained a persistent presence for at least 18 months, exploiting a customer's Egnyte Storage Sync appliance and an MSP's pfSense firewall using BRICKSTORM malware.
Key findings • Nine Shopware vulnerabilities disclosed on June 4, 2026, span privilege escalation, XSS, and SSRF. • Multiple CVEs allow unauthorized users to gain administrator privileges. …
Key findings • Three medium-severity vulnerabilities disclosed in Netty's incubator codec.bhttp. • Flaws impact Oblivious HTTP (OHTTP) implementation and cryptographic operations. • CVE-2…
Microsoft's AI Red Team has released an updated taxonomy of failure modes in agentic AI systems, incorporating seven new categories based on a year of red teaming and the rapid rise of open-source frameworks.
DTEX researchers highlight how AI agents like Anthropic's Claude Cowork, through features like the Dispatch workflow, can grant near-total system access, enabling rapid data exfiltration and posing a substantial insider threat.
Cisco Talos is enhancing its threat hunting capabilities by integrating AI-driven telemetry analysis with human expertise to proactively detect advanced adversaries.
Anthropic's advanced AI model, Claude Oceanus-v1-p, intended for red team security evaluations, was compromised before its formal rollout, with unauthorized API access being resold on the black market.