Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,781 stories synthesized.
Attackers are artificially inflating npm download counts by publishing hundreds of benign package versions, using automated bot traffic to trick developers into trusting and installing malicious payloads.
ESET's latest APT Activity Report reveals state-sponsored campaigns by Chinese, North Korean, Russian, and Iranian groups targeting oil shipments, drone manufacturers, and a poisoned code library.
ESET's latest APT Activity Report reveals Lazarus compromised the axios npm library, Sandworm deployed new wipers against a Polish energy firm, and China-aligned groups shifted targets amid geopolitical upheaval.
Veeam has patched a high-severity local privilege escalation vulnerability in Backup & Replication that could let attackers with limited access gain administrative control over enterprise backup systems.
Microsoft warned that six zero-day vulnerabilities—including RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma—were publicly disclosed without coordinated vulnerability disclosure, exposing users to exploitation before patches were ready.
Two critical arbitrary code execution flaws in Notepad++ let attackers run malicious programs by injecting commands into configuration files, patched in version 8.9.6.1.
A new threat actor tracked as JINX-0164 is targeting cryptocurrency firms with fake recruiter lures and custom macOS malware to steal digital assets and compromise CI/CD pipelines.
A cybercrime gang has been distributing a cryptocurrency miner through fake video player plugin updates on pirated movie and TV show streaming sites since at least 2022, affecting sites with up to 27.4 million monthly visitors.
State Bank of India has issued an urgent fraud alert warning customers of a social engineering campaign that uses fake SMS, WhatsApp, and email messages claiming the YONO app will be deactivated unless victims update their Aadhaar number via a malicious link or APK file.
Key findings • Twelve vulnerabilities disclosed for Keycloak between May 27-28, 2026. • One high-severity vulnerability (CVE-2026-9796) allows privilege escalation via scope mapping. • Se…
Help Net Security highlights notable open-source cybersecurity tools for May 2026, including Pipelock, an AI agent firewall that restricts shell access and network calls to prevent credential exfiltration.
A high-severity origin validation vulnerability in TrendAI Vision One Security Agent lets local attackers with low privileges escalate to SYSTEM rights on affected systems.
A high-severity origin validation vulnerability in TrendAI Vision One Security Agent lets local attackers with low privileges escalate to SYSTEM rights on affected systems.
A high-severity TOCTOU vulnerability in TrendAI's Apex One NT RealTime Scan service lets low-privileged attackers escalate to SYSTEM rights on affected systems.
Attackers are exploiting CVE-2026-35616 in FortiClient EMS to deploy a previously undocumented credential stealer, EKZ Infostealer, targeting enterprise endpoints.
Key findings • A coordinated drop of 40 malicious npm packages was simultaneously disclosed and removed on May 28, 2026. • The campaign targeted two specific scopes: '@cloudplatform-single-sp…
Key findings • A total of 40 malicious packages were simultaneously removed from the npm registry on May 28, 2026. • The attack targeted three distinct enterprise-themed scopes: @cloudplatfor…
Google Threat Intelligence Group warns that Chinese-language phishing-as-a-service platforms are using AI, encrypted messaging, and real-time OTP interception to bypass MFA and provision stolen payment cards into attacker-controlled digital wallets worldwide.
Six vulnerabilities, including two rated High severity, were disclosed on May 27, 2026, in Microsoft's open-source UFO intelligent automation framework, spanning session hijacking, privilege escalation, path traversal, and OS command injection.
Fifteen vulnerabilities spanning command injection, authentication bypass, symlink attacks, and data races were disclosed on May 27, 2026, in Mcdope's Pam Usb Linux authentication module, with fixes available in version 0.9.1.
A SANS diary demonstrates how defenders can reconstruct an Akira ransomware intrusion from initial access to encryption using only SSLVPN syslog and Windows EVTX logs, without EDR or memory captures.
Group-IB uncovered a Chinese-speaking threat actor operating over 300 fake FIFA domains with a custom React phishing kit, targeting 2026 World Cup fans.
The long-running Grandoreiro banking trojan has resurfaced with sophisticated campaigns targeting Portuguese banks and companies across Spain, Mexico, and Latin America using DLL side-loading and cloud platform abuse.
Elastic Security Labs reveals how the Tycoon 2FA Phishing-as-a-Service kit defeats multi-factor authentication on Microsoft Entra ID and Google Workspace by stealing session tokens via reverse proxy.