Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,782 stories synthesized.
Key findings • 25 CVEs patched in Chrome 148.0.7778.216 across all platforms • At least 8 use-after-free bugs, several enabling sandbox escape • Multiple code-execution and sandbox-escape…
Key findings • Twelve Chromium vulnerabilities disclosed simultaneously on May 28, 2026. • Three critical vulnerabilities (CVSS 9.6) allow for sandbox escapes. • Multiple use-after-free b…
Key findings • 10 ANGLE CVEs disclosed in a single Chrome 148 security update on May 28, 2026 • 5 of the 10 bugs enable sandbox escape after renderer compromise • CVE-2026-9882 rated Crit…
Attackers used compromised provider credentials to breach Connecticut's Medicaid web portal, exposing payment and personal data of about 22,500 patients and attempting to reroute hospital reimbursements.
Six vulnerabilities spanning OpenStack Neutron, Keystone, and Swift were disclosed in a two-day window, including an RBAC bypass, a token-expiry flaw, and a Swift infinite-loop DoS rated High.
Portainer Community Edition disclosed and patched nine security vulnerabilities on May 28, 2026, including two critical flaws that allow authenticated users to bypass endpoint restrictions and escape containers to the host.
A weekly roundup covers multiple incidents including the tracking of active-duty US troops via cell phone data, a new tool bypassing MFA, and CISA warnings on active LiteSpeed exploitation.
The Pentagon has confirmed that foreign adversaries are exploiting commercial geolocation data from smartphones to track and surveil US troops in Middle East war zones, prompting lawmakers to demand immediate security reforms.
Elastic published a coordinated batch of 10 security advisories for Kibana on May 28, 2026, spanning SSRF bypasses, resource-exhaustion denial-of-service flaws, and privilege escalation, with one high-severity bug scoring 7.7.
Five vulnerabilities, including code execution via XHTML attachments and authorization bypass for private bugnotes, were disclosed in MantisBT on May 28, 2026, all fixed in versions 2.28.2 and 2.28.0.
A critical vulnerability in the WP Maps Pro WordPress plugin allows unauthenticated attackers to create administrator accounts, leading to complete site takeover.
A Dutch law enforcement raid on THE.Hosting, a Russian bulletproof hosting provider, seized 800 servers but failed to disrupt its core IP infrastructure, leaving malicious scanning activity largely intact.
WithSecure researchers have identified GreyVibe, a Russia-linked threat actor, extensively using AI tools like ChatGPT and Gemini to enhance phishing, malware development, and reconnaissance operations targeting Ukrainian entities.
Three vulnerabilities, including a critical RCE via malicious bookmark imports and a weak-crypto flaw that leaks synced credentials, were disclosed in the open-source terminal client Electerm on May 28, 2026.
Michele Spagnuolo, a Google security engineer, was charged with insider trading after allegedly using nonpublic Year in Search data to place bets on Polymarket, netting over $1.2 million.
Sysdig captured the first known AI-agent-driven intrusion, where an LLM agent exploited CVE-2026-39987 in marimo to pivot from RCE to full database exfiltration in under an hour.
Researchers disclose VaultJacking, a phishing technique that exploits Google's cross-device sync to exfiltrate every saved password and passkey using a single captured 6-digit GPM PIN.
A malicious npm package named 'mouse5212-super-formatter' was discovered acting as an infostealer, targeting developers by exfiltrating files to a remote GitHub repository, with the attacker's hardcoded private token exposed.
Five vulnerabilities spanning four OpenTelemetry language SDKs were disclosed in a 48-hour window, including a high-severity crash bug in the JS Prometheus exporter and a medium-severity TLS validation gap in the Instana exporter.
Nine vulnerabilities, including a critical SAML authentication bypass (CVE-2026-9090, CVSS 9.1), were disclosed in Casdoor 2.362.0 and earlier, with no patch yet available.
Four medium-severity vulnerabilities in the Hono web framework were disclosed together on May 28, 2026, spanning path normalization bypass, cookie injection, IP-restriction evasion, and JWT scheme validation gaps.
Schneider Electric has released version 1.10.0 of EcoStruxure Machine Expert HVAC to fix a cleartext storage vulnerability that could expose protected source code to authorized attackers.
CISA has issued an advisory detailing five vulnerabilities in the Danelec MacGregor Voyage Data Recorder G4e, including default and hard-coded credentials, that could allow attackers to gain full administrator access to maritime transportation systems.
A critical vulnerability (CVE-2026-5386) in KMW CCTV security cameras allows remote attackers to reset the administrator password without authentication, gaining full access to feeds and settings.