Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 6,135 stories synthesized.
A critical bug in the Lean theorem prover allowed researchers to generate a false proof of Fermat's Last Theorem by exploiting a semantic mismatch between logical evaluation and compiled code.
Schneider Electric, Siemens, Aveva, and Rockwell Automation have released patches for critical and high-severity vulnerabilities affecting their industrial control system products.
A critical vulnerability in Alby Hub versions v1.7.0 through v1.7.2 allows attackers to take over internet-exposed Bitcoin wallets and transfer funds.
Microsoft has released security updates for CVE-2026-69485, an Important-rated RCE vulnerability in the Windows Remote Desktop Client, allowing attackers to execute code on affected servers.
A large-scale cybercrime operation, tracked as CL-CRI-1171, is leveraging YouTube gaming lures and SEO poisoning to distribute multi-payload malware through a pay-per-install marketplace, targeting both gamers and enterprise networks.
A novel phishing technique leverages trusted Microsoft services to host malicious pages directly within the victim's browser using blob URLs, bypassing traditional detection methods.
A new open standard, ORKS, aims to revolutionize API key security by enabling keys to self-destruct upon compromise, drastically reducing the window for attackers.
Australia is introducing new legislation that would allow users over 16 to opt out of algorithmic social media feeds and mandates protections for minors against harmful content.
A critical SQL injection vulnerability (CVE-2026-67401) in cPanel's EmailTrack functionality allows authenticated attackers to gain root-level control of servers, enabling arbitrary file creation and code execution.
A new evaluation ranks the top 10 application control and allowlisting tools, highlighting their critical role in combating ransomware and unknown malware by enforcing strict execution policies.
A comprehensive review highlights the top 10 patch management software solutions for 2026, emphasizing Automox, Tanium, and Action1, while cautioning buyers about the inherent risks of the tools themselves.
Over 3,500 internet-facing Redis servers have been compromised and repurposed by attackers to mine Monero cryptocurrency, exploiting weak authentication configurations.
The latest Risky Business podcast episode covers a massive IDScan data breach, potential US government plans for private military hacking, and accusations of China distilling US AI models.
Tencent's Zhuque Lab has launched AI-Infra-Guard, an open-source security scanner designed to identify vulnerabilities and risks within artificial intelligence systems.
Key findings • Two critical heap-based buffer overflow vulnerabilities in image decoders (CVE-2026-21095, CVE-2026-21096) allow remote code execution. • Multiple vulnerabilities across system…
A vulnerability in Oracle VirtualBox's VirtioSCSI implementation could allow local attackers to disclose sensitive information on a guest system.
A critical vulnerability in NI LabVIEW allows remote attackers to disclose sensitive information through a flaw in VI file parsing, requiring user interaction to exploit.
A denial-of-service vulnerability in Backblaze Personal Computer Backup allows local attackers with low-privileged code execution to overwrite arbitrary files and crash the service.
A critical vulnerability in Microsoft Azure Entra ID's OAuth Device Code Grant allows unauthenticated remote attackers to disclose sensitive organizational information.
A heap-based buffer overflow in Oracle Outside In Technology's PostScript file parsing enables remote code execution, with a CVSS score of 7.8.
A critical vulnerability in Progress Software's Kemp LoadMaster allows authenticated attackers to execute arbitrary code due to an uninitialized memory flaw.
Zero Day Initiative has disclosed a critical remote code execution vulnerability in GIMP, stemming from an integer overflow in its PSP file parsing component.
A critical remote code execution vulnerability (CVE-2026-70477) in the Flowise low-code LLM application builder allows unauthenticated attackers to execute arbitrary code.
A critical integer overflow vulnerability in Oracle Outside In Technology's PDF parsing component allows remote code execution, tracked as CVE-2026-60392.