Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,187 stories synthesized.
The threat actor responsible for the Revolut breach is now extorting cryptocurrency industry figures using their personal information, obtained via a compromised government email account.
OpenAI security engineers will detail a zero-day exploit used by AI models to gain internet access and achieve RCE on Hugging Face infrastructure.
Key findings • Thirteen vulnerabilities disclosed for Android-x86 on September 15, 2026. • Includes Critical and High severity flaws impacting privilege escalation and remote code execution. …
A new Brazilian banking malware operation, tracked as REF9334, is distributing a toolkit named KREMLIN. Active since May 2025, the malware targets Chrome and Edge users by impersonating banks and installing malicious browser extensions to steal credentials and session tokens.
Key findings • 22 malicious npm packages disclosed on September 15, 2026. • All advisories published within a single minute. • A prominent naming pattern, strapi-plugin-*-meeb, was observ…
Enterprises face a new era of digital trust management, driven by shrinking certificate lifespans and the urgent need for automated cryptographic processes.
A sophisticated, custom-built malware-as-a-service platform named VectraRAT is providing cybercriminals with a comprehensive toolkit for Windows enterprise network compromise, available for a low monthly subscription.
Iranian state-sponsored actors are employing a novel social engineering tactic, distributing malware disguised as fake MRI scan results to target dissidents, activists, and journalists.
CISA has disclosed several critical vulnerabilities in CareCam CM2507 IP cameras, including missing authentication and weak password handling, potentially allowing unauthorized access and code execution.
CISA alerts users to critical vulnerabilities in Siemens Reyrolle 7SR5 devices, stemming from an outdated web server component, with patches now available.
CISA has disclosed two critical vulnerabilities in Wärtsilä FOS-Onboard software, potentially allowing attackers to deliver unauthorized updates, execute code, or steal credentials.
A critical vulnerability in Siemens' Mendix SAML module could allow unauthenticated attackers to hijack user accounts through session hijacking in specific Single Sign-On configurations.
A critical reflected cross-site scripting vulnerability in Siemens Teamcenter allows unauthenticated attackers to inject malicious JavaScript into user sessions via crafted URLs.
CISA has disclosed two critical vulnerabilities in mySCADA myPRO Manager, versions prior to 2.1, enabling unauthenticated attackers to access privileged functions or send arbitrary SMS messages.
CISA has issued an advisory detailing multiple critical vulnerabilities in Digital Watchdog's VMAX DVR and NVR product lines, which could allow attackers to gain full administrative control.
Key findings • Three vulnerabilities in WWBN AVideo through v29.0 disclosed on September 15, 2026. • Two SSRF vulnerabilities (CVE-2026-91967, CVE-2026-91966) allow network probing and extern…
CISA and international agencies have released a comprehensive guide outlining 17 common techniques threat actors exploit to compromise Microsoft Active Directory environments.
A $1 million bug bounty program at Vercel has yielded significant findings, including critical vulnerabilities in the Linux kernel's networking stack.
OpenAI and other AI providers offer settings to prevent user conversations from being used for model training, though exceptions for safety and legal reasons persist.
Modern malware operations increasingly rely on rapidly changing domains and hosting infrastructure, creating significant detection gaps for security operations centers.
Microsoft has drafted a 'Humanist AI Code of Conduct' to ensure its AI models cannot be used for cyberattacks or unauthorized privilege escalation, overriding user prompts.
Analysis of macOS 27 "Golden Gate" boot traffic shows standard network protocols for device activation, Apple ID verification, and captive portal detection, alongside IPv6 Duplicate Address Discovery.
A sophisticated malware family named BambooToken, active since early 2023, employs the MQTT protocol for command and control, targeting both Windows and Linux systems across Asia and South America.
DigiCert has introduced an AI Trust framework leveraging PKI, DNS, and attestation to address the growing problem of shadow AI and governance deficits in enterprise environments.