Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,191 stories synthesized.
Medical device manufacturer Boston Scientific disclosed that a cyberattack on August 25th caused a nearly two-week pause in production and shipping, materially impacting its third-quarter and full-year 2026 financial results.
A bipartisan group of US lawmakers has called on the Treasury Department to sanction three India-based hack-for-hire groups accused of extensive espionage and censorship campaigns against American citizens and companies.
The U.S. government has dismantled the Xinbi Guarantee marketplace, a major Telegram-based platform facilitating billions in illicit transactions for cyber scams and other criminal activities.
Increased scanning activity has been observed targeting Proxmox VE servers, specifically exploiting an advisory for a vulnerability in an unsupported version.
Attackers are impersonating IT helpdesks to trick users into compromising their cloud identities through sophisticated social engineering tactics, leading to widespread data access.
Multiple Chinese threat actors are exploiting a sophisticated chain of zero-day vulnerabilities in Google Chrome and Windows to achieve code execution and deploy backdoors and credential stealers.
A prolific zero-day researcher has released a proof-of-concept exploit for a new Microsoft Defender vulnerability, 'ShieldCrash,' which bypasses a previous patch and allows SYSTEM-level file access.
Key findings • Nine Linux kernel vulnerabilities were disclosed on September 9, 2026, affecting the Android SDK. • Flaws span networking, KVM, HID, PCI, and Bluetooth subsystems. • Fixes …
Key findings • Twelve Linux kernel vulnerabilities disclosed together on September 9, 2026. • Flaws affect diverse subsystems including networking, crypto, HID, PCI, KVM, and Bluetooth. •…
A new exploit kit dubbed 'BlueMoon' is chaining zero-day vulnerabilities in Google Chrome and Microsoft Windows, enabling espionage groups to deploy backdoors and surveillance tools against high-value targets.
Google's Threat Analysis Group (TAG) reports that adversaries are increasingly using AI to automate and scale attacks, granting previously nation-state-exclusive capabilities to less resourced actors.
Electronic health record company Veradigm has reported a data breach where hackers accessed a vendor's interface, stealing patient Social Security numbers and other personal data.
At least four Chinese state-aligned cyber-espionage groups are leveraging the same novel exploit kit, 'BlueMoon,' to target organizations with a zero-day vulnerability in Google Chrome.
A new phishing kit named N0va is targeting organizations in North America and the EU, leveraging legitimate authentication flows and token capture to bypass MFA and gain persistent SSO access.
Nvidia, AMD, and Arm have released security advisories detailing patches for recently discovered vulnerabilities across their product lines.
Key findings • 25 vulnerabilities disclosed in Dell Secure Connect Gateway 5.0 on September 9, 2026. • High-severity flaws (CVSSv3 7.5) due to hard-coded credentials in CVE-2026-79950, CVE-20…
Cisco Talos is tracking active exploitation of two critical vulnerabilities in Cisco Secure Firewall Management Center (FMC) software, enabling root access and credential theft.
Rapid7's new credentialed pre-port discovery feature allows scan engines to query hosts directly for open ports, bypassing firewall limitations and improving scan accuracy.
A vast network of nearly 119,000 cloned online stores, dubbed DoppelCart, has been identified by researchers, aiming to steal payment card information from unsuspecting shoppers.
A Russian-speaking threat actor deployed hundreds of AI agents to exploit PaperCut NG/MF vulnerabilities, compromising 440 servers globally with rapid RCE and domain admin access.
Researchers have identified a novel attack technique, 'workflow identity hijacking,' that exploits design flaws in enterprise AI pipelines to bypass security controls and access sensitive data.
Information stealer malware is now targeting and harvesting AI user session tokens, enabling attackers to replay them and bypass multi-factor authentication for illicit access.
Key findings • 25 CVEs disclosed for Snipe-IT on September 9, 2026, primarily concerning authorization and access control flaws. • High-severity vulnerabilities allow asset reassignment, audi…
Key findings • 18 denial-of-service and resource exhaustion vulnerabilities disclosed for PocketMine-MP on September 9, 2026. • Multiple vulnerabilities stem from improper handling of LoginPa…