Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,785 stories synthesized.
Russia's FSB alleges a foreign intelligence operation compromised senior officials' smartphones with malware, turning them into surveillance tools, though concrete evidence remains scarce.
Key findings • Five vulnerabilities in Progress Sitefinity disclosed on June 2nd, 2026. • Two critical vulnerabilities (CVSSv3 10.0 and 9.8) involve credential exposure and unauthorized acces…
Noma introduces Agent Access Control, a new tool designed to provide visibility and enforce access policies for the rapidly growing number of AI agents and MCP servers within enterprises.
Tuskira's new Quell capability aims to drastically reduce breachable exposure by identifying and mitigating zero-day risks before they can be exploited, even without available patches.
A security researcher claims Microsoft's Security Response Center (MSRC) wrongly dismissed a critical dependency confusion vulnerability in Azure Portal, which could have led to remote code execution.
Chinese state-sponsored group Mustang Panda is using a sophisticated, multi-stage attack chain involving a fake browser update and DLL sideloading to deploy the PlugX remote access trojan.
A sophisticated campaign dubbed TrapDoor has compromised npm, PyPI, and Crates.io with 34 malicious packages designed to steal cloud credentials, SSH keys, and cryptocurrency wallets, employing stealthy exfiltration techniques.
A new Python-based malware, SolyxImmortal, is actively stealing browser passwords, cookies, files, and keystrokes from Windows systems, with a notable focus on Turkish-speaking users.
Anthropic's AI assistant Claude experienced a widespread outage affecting web and code services globally, with users reporting slow, unstable, or unavailable responses.
The rise of AI is creating a new class of less-skilled but highly dangerous threat actors, accelerating attacks and pressuring traditional cybersecurity response timelines.
A critical stack-based buffer overflow vulnerability (CVE-2026-0826) in HP Poly VoIP phones enables remote code execution, potentially granting attackers a foothold in enterprise networks.
Kaspersky GReAT conducted a wardriving assessment across Mexico City, Guadalajara, and Monterrey, analyzing public Wi-Fi security to identify potential risks for visitors attending the 2026 FIFA World Cup.
The rapid weaponization of vulnerabilities, fueled by AI, is shrinking the window between disclosure and exploitation to mere hours, rendering traditional patching strategies insufficient.
CISA has alerted organizations to active exploitation of CVE-2024-21182, a critical Oracle WebLogic Server vulnerability patched nearly two years ago.
A command injection vulnerability (CVE-2026-5509) in TP-Link Archer BE450 and BE7200 routers allows authenticated attackers to execute arbitrary system commands via the web management interface.
Microsoft is reportedly pursuing legal action against an anonymous security researcher known for publishing significant Windows vulnerabilities, including a BitLocker bypass.
The Police Service of Northern Ireland (PSNI) is warning the public about scammers spoofing its official phone number to conduct fraudulent investigations, most recently attempting to trick a victim into purchasing gift cards.
A sophisticated spearphishing campaign, dubbed Operation Dragon Weave, by a China-linked threat actor is targeting government officials and researchers in Taiwan and the Czech Republic with a novel Rust-based loader and an Azure Blob Storage-based C2 agent.
Microsoft Entra rolls out phishing-resistant MFA for Linux desktops and introduces passkey support to bolster zero trust strategies and simplify identity management.
Sophos researchers have discovered a sophisticated threat actor leveraging AI to build a dedicated malware-testing framework aimed at evading endpoint detection and response (EDR) systems.
A malvertising campaign dubbed Operation FlutterBridge is distributing a novel backdoor, FlutterShell, specifically engineered for macOS and built using the Flutter framework.
API attacks saw a staggering 400% increase in 2025, with 81% of organizations admitting to incomplete API inventories, creating significant blind spots for attackers.
Mobile gamers are falling prey to deceptive ads within games that mimic system alerts, tricking them into downloading malware or signing up for costly subscriptions.
A sophisticated remote access trojan, PHANTOMPULSE, linked to DPRK-aligned threat groups, is actively compromising Windows systems in the cryptocurrency sector using advanced evasion techniques and a novel blockchain-based command-and-control mechanism.