Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,785 stories synthesized.
A recent audit revealed that many third-party OAuth applications on Google Workspace and GitHub marketplaces retain broad access to sensitive company data even after their publishers disappear, posing significant security risks.
The UK's National Cyber Security Centre (NCSC) has issued a stark warning about the escalating threat of software supply chain attacks, urging organizations to meticulously review their dependencies.
Chinese military intelligence is leveraging platforms like LinkedIn, Indeed, and Upwork in a sophisticated, five-step scheme to recruit individuals with security clearances and other sensitive access.
A Chinese-speaking cybercrime group, TA4922, is exhibiting an unprecedented operational tempo, expanding its global reach and employing sophisticated social engineering tactics for financial gain.
Cybercriminals are increasingly targeting travelers with sophisticated scams, including fake booking websites and phishing campaigns impersonating popular platforms like Booking.com, leading to a significant rise in reported incidents.
Two former RAC employees in the UK have been ordered to repay over £118,000 for illegally selling personal data of nearly 30,000 car crash victims, following a conviction under the Computer Misuse Act and Data Protection Act.
A critical zero-day vulnerability in Comodo Internet Security's Inspect.sys driver, dubbed ComoDoS, enables remote attackers to crash Windows systems via a malformed IPv6 packet.
Key findings • Seven medium-severity vulnerabilities in Samsung's rlottie library disclosed on June 4, 2026. • Flaws include out-of-bounds writes, integer overflows, and uncontrolled recursio…
Key findings • Five Acer vulnerabilities disclosed on June 4, 2026, including critical flaws. • Critical command injection vulnerabilities found in FieldX MDM and M3WebServer. • High-seve…
A critical Server-Side Request Forgery (SSRF) vulnerability in Cisco Unified Communications Manager (Unified CM) and SME, tracked as CVE-2026-20230, carries a CVSS score of 8.6 and allows for root privilege escalation.
Researchers demonstrate a computer worm built using a publicly available, open-weight AI model that adapts to exploit known vulnerabilities and spread laterally.
The U.S. Department of Justice's 'Disruption Week' operation targeted transnational cyber-enabled and cryptocurrency fraud networks, leading to the seizure of $3.8 million in assets and millions of compromised accounts.
A new framework offers a structured approach to assessing and managing critical vulnerabilities within sensitive Operational Technology (OT) and Industrial Control Systems (ICS) environments, moving beyond standard IT patching practices.
A GitGuardian analysis reveals an average of 150 secrets, including private keys and cloud credentials, on developer endpoints, highlighting a significant blind spot in traditional security controls.
A universal cross-site scripting vulnerability in Microsoft Edge's navigation handling, CVE-2026-45494, allows remote attackers to execute arbitrary cross-origin script.
A firm's decision to store service account passwords in Active Directory description fields created a massive attack surface, leading to a ransomware incident that crippled operations for months.
A security flaw in Microsoft Edge, CVE-2026-45492, enables attackers to bypass origin validation checks, potentially leading to code execution.
A local privilege escalation vulnerability, CVE-2026-7480, affects ASUS Business Manager, allowing attackers with low-privileged code execution to gain higher privileges.
A directory traversal vulnerability in Microsoft Edge's feedback log file handling, tracked as CVE-2026-45495, enables remote code execution with user interaction.
Key findings • Critical RCE vulnerability (CVE-2026-41283) in OpenStack Mistral through 22.0.0. • Three medium-severity vulnerabilities disclosed in OpenStack Ironic, patched in 35.0.2. •…
Automated bots now account for 57.5% of global web traffic, a milestone driven by AI scrapers and LLM training, with significant implications for cybersecurity.
Commvault warns that AI-driven cyberattacks are evolving beyond data encryption to complete destruction of virtual machine environments and hypervisors, leaving organizations in a 'dark, dead' state.
A Chinese-speaking cybercrime group, TA4922, has shifted its focus from East Asia to European targets, deploying novel malware including the Atlas RAT backdoor.
Key findings • Four Drupal core security advisories were disclosed on June 3, 2026. • The advisories are CVE-2026-10768, CVE-2026-49977, CVE-2026-10769, and CVE-2026-10770. • Specific vul…