Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 6,133 stories synthesized.
A vast network of nearly 119,000 cloned online stores, dubbed DoppelCart, has been identified by researchers, aiming to steal payment card information from unsuspecting shoppers.
A Russian-speaking threat actor deployed hundreds of AI agents to exploit PaperCut NG/MF vulnerabilities, compromising 440 servers globally with rapid RCE and domain admin access.
Researchers have identified a novel attack technique, 'workflow identity hijacking,' that exploits design flaws in enterprise AI pipelines to bypass security controls and access sensitive data.
Information stealer malware is now targeting and harvesting AI user session tokens, enabling attackers to replay them and bypass multi-factor authentication for illicit access.
Key findings • 25 CVEs disclosed for Snipe-IT on September 9, 2026, primarily concerning authorization and access control flaws. • High-severity vulnerabilities allow asset reassignment, audi…
Key findings • 18 denial-of-service and resource exhaustion vulnerabilities disclosed for PocketMine-MP on September 9, 2026. • Multiple vulnerabilities stem from improper handling of LoginPa…
A critical cross-site scripting vulnerability (CVE-2026-85061) in MapLibre GL JS versions prior to 6.4.1 could allow attackers to execute arbitrary JavaScript in users' browsers without interaction, potentially affecting 2.7 million users.
Microsoft is rolling out new age verification and parental control features within Windows Family Safety, leveraging Microsoft accounts to provide age-appropriate protections across apps, services, and AI experiences.
Akeyless introduces Agentic Runtime Authority, a new identity control layer designed to enforce real-time, intent-based access controls for AI agents operating in production environments.
Two critical vulnerabilities in ArangoDB versions prior to 3.12.11 allow attackers to bypass authentication and achieve remote code execution as root.
Google's September 2026 Android Security Bulletin addresses critical vulnerabilities, including multiple RCE flaws affecting Android versions up to Android 17.
A critical vulnerability in Microsoft Teams for Android, CVE-2026-65812, allows attackers to disclose sensitive user credentials with low complexity and user interaction.
New Android malware campaigns leverage Gigabud RAT and Vwork app cloner to hide fraudulent banking activities by cloning apps into concealed work profiles.
The FBI is sounding the alarm that artificial intelligence is significantly accelerating adversary capabilities, making attacks faster and more sophisticated, while stressing that fundamental cybersecurity practices remain the most critical defense.
Cloudflare has significantly updated its Workers runtime module registry to improve compatibility with Node.js applications, enabling larger and more complex deployments.
Tenable and OpenAI have introduced the CyberAgents Exchange AI Inspector, a new tool designed to rigorously vet open-source AI agents before they are listed on the CyberAgents Exchange registry.
Compromised non-human identities, including AI agents and service accounts, have surpassed phishing as the primary entry vector for cyberattacks targeting organizations.
Attackers are utilizing autonomous AI agents to execute credential theft campaigns with unprecedented speed, completing the entire process from planning to execution in under six hours.
US government agencies have issued a warning that China is systematically extracting advanced AI capabilities through a technique known as distillation, posing a significant threat to national security and technological leadership.
Key findings • Three GitPython vulnerabilities disclosed on September 9, 2026, including two High severity flaws. • CVE-2026-87817 allows arbitrary code execution by impersonating the git dir…
Key findings • Ten vulnerabilities disclosed for Siyuan Note, affecting versions before v3.8.2. • Critical code execution vulnerability (CVE-2026-86712) via crafted clipboard data. • Mult…
A new webinar aims to help security teams rapidly determine their exposure to newly disclosed vulnerabilities, especially in an era of AI-driven threat discovery.
A critical bug in the Lean theorem prover allowed researchers to generate a false proof of Fermat's Last Theorem by exploiting a semantic mismatch between logical evaluation and compiled code.
Schneider Electric, Siemens, Aveva, and Rockwell Automation have released patches for critical and high-severity vulnerabilities affecting their industrial control system products.