Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,187 stories synthesized.
Canadian telecom giant Telus is notifying customers of account breaches where threat actors used compromised credentials to access personal data and billing records.
Key findings • Five SQL injection vulnerabilities disclosed together for Itsourcecode Sales and Inventory System 1.0. • All vulnerabilities carry a Medium severity rating (CVSSv3 6.3) and all…
The UK government is expanding its use of passkeys for GOV.UK One Login, aiming to replace passwords for over 23 million users and enhance security.
GitHub has paid out a $100,000 bug bounty for CVE-2026-3854, a critical remote code execution vulnerability in its Git push pipeline that could have compromised repository integrity and supply chains.
A sophisticated banking Trojan named Casbaneiro is targeting users in Latin America through phishing campaigns, employing multi-stage evasion techniques to remain undetected until it initiates data exfiltration and command execution.
WhatsApp is developing a new 'Restricted Chat' feature for Android beta users, designed to prevent specific conversations from syncing to linked devices and enhance user privacy.
Debian 13.7 "trixie" has been released, integrating fixes for 92 security advisories and updating 106 packages, including critical Linux kernel patches.
A malicious browser extension for Twitch, 'Twitch Enhanced Viewer | JeetBot,' has been discovered leaking OAuth tokens for almost 31,000 users to servers operated by a Russian bot service.
Attackers are leveraging AutoIt scripts to inject the AsyncRAT remote-access trojan into legitimate, Microsoft-signed Windows processes like charmap.exe, evading detection by hiding malicious activity within trusted applications.
A busy week in cybersecurity saw actively exploited Chrome and Windows vulnerabilities, critical MikroTik router flaws, and potential eavesdropping risks in LG TVs.
A new defense agent for industrial control systems uses machine learning to analyze network traffic and automatically trigger system resets to thwart cyberattacks.
Permify introduces an open-source authorization service designed to manage complex access control rules separately from application code, drawing inspiration from Google's Zanzibar.
A use-after-free vulnerability in the Linux Kernel's Net Scheduler Clsact Qdisc allows local privilege escalation, requiring prior high-privileged code execution.
A race condition in the Linux Kernel's eMPIA USB device driver allows physically present attackers to execute arbitrary code with a CVSS score of 7.1.
A vulnerability in the Linux Kernel's NTFS3 driver allows local attackers to disclose sensitive information, requiring prior code execution.
A race condition in the Linux Kernel's nftables component, ZDI-26-686, allows local attackers to escalate privileges after gaining initial code execution.
A vulnerability in the Linux Kernel's IPv6 Neighbour Discovery component allows local attackers to disclose sensitive information, requiring high-privileged code execution to exploit.
A race condition in the Linux Kernel's FUSE subsystem, ZDI-26-681, enables local privilege escalation for attackers with low-privileged code execution.
A use-after-free vulnerability in the Linux Kernel's QFQ Plus scheduler, tracked as CVE-2026-22999, allows local attackers to escalate privileges.
A race condition in the Linux Kernel's ksmbd component, ZDI-26-693, allows authenticated remote attackers to execute arbitrary code.
A local privilege escalation vulnerability in the Linux Kernel's Netlink-based wireless configuration, ZDI-26-691, allows attackers to gain kernel-level code execution.
A use-after-free vulnerability in the Linux Kernel's crypto subsystem, CVE-2026-31719, allows local attackers to escalate privileges.
A vulnerability in the Linux Kernel's MCTP routing component allows local attackers to disclose sensitive information, requiring high-privileged code execution to exploit.
A local information disclosure vulnerability in the Linux Kernel's TLS protocol requires high-privileged code execution to exploit.