Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,768 stories synthesized.
Check Point Research's March-April 2026 AI Threat Landscape Digest reveals criminal operators using Claude Code and GPT-4.1 to compromise nine Mexican government agencies, alongside the weaponization of agentic config files as persistent jailbreak vectors.
Two former executives of a call tracking company admitted to selling phone infrastructure to Indian tech support scammers impersonating Microsoft and Apple.
Apple released the first beta of visionOS 26.6 to developers, promising security patches alongside new features for the Vision Pro headset.
Apple released the first beta of tvOS 26.6 to developers, including unspecified security patches alongside the usual testing cycle.
India's CERT-In has issued new guidelines requiring organizations to patch critical vulnerabilities in internet-exposed systems within 12 hours, citing the need to counter AI-assisted cyber threats.
Researchers at ESET have identified BTMOB, a new Android RAT sold as a malware-as-a-service platform that includes a no-code APK builder, enabling attackers to rapidly generate targeted phishing lures with minimal technical skill.
A new ransomware strain called Payload has been active since February 2026, targeting Windows systems globally with per-file encryption using ChaCha20 and Curve25519 ECDH.
PuTTY 0.84 fixes multiple low-severity vulnerabilities, including ECDSA and RSA key exchange crashes and a Telnet trust-sigil reset flaw that could trick users into revealing proxy passwords.
Microsoft has confirmed that the May 2026 security update KB5087537 causes domain controller locator failures on Windows Server 2016 systems with 15-character hostnames, disrupting authentication and administrative tools.
Nine medium-severity OS command injection vulnerabilities were disclosed for the Totolink CA750-PoE router, all in the same CGI handler with public exploits, but no firmware patch has been released.
Iran's Nimbus Manticore group is targeting US aviation organizations in a campaign combining phishing and SEO poisoning to deploy the AI-assisted MiniFast backdoor.
A critical heap buffer overflow vulnerability (CVE-2026-48095, CVSS 8.8) in 7-Zip version 26.00 allows attackers to execute arbitrary code by exploiting a defect in the NTFS archive handler.
Trend Micro researchers uncover ClearFake threat actors using immutable smart contracts on the BNB Smart Chain testnet to command and control malware, evading takedown.
Cloud Atlas APT group modifies termsrv.dll on Windows 10 to enable multiple concurrent RDP sessions, allowing attackers to operate undetected alongside legitimate users.
A batch of 24 vulnerabilities, including 16 stack-based buffer overflows and 6 OS command injection flaws, has been disclosed for the Edimax EW-7438RPn Wi-Fi range extender, with public exploit code available and no official patch from the vendor.
KELA researchers have uncovered a booming Mule-as-a-Service ecosystem on Telegram where criminals sell verified bank accounts, fintech wallets, and crypto exchange accounts, using AI-generated deepfakes and LLMs to bypass KYC checks.
Twenty-four critical-severity OS command injection vulnerabilities were disclosed in the Totolink A8000RU router's web management interface, all unauthenticated and with public exploit code, but no firmware patch has been released.
Attackers are abusing shared CDN infrastructure in a technique called 'Underminr' to bypass domain-reputation security controls, potentially affecting over 88 million domains.
A batch of ten vulnerabilities was disclosed on May 25, 2026, in the widely used Erlang HTTP client library Hackney, including CRLF injection, resource exhaustion, and SSRF flaws.
Check Point's latest threat intelligence bulletin covers a confirmed 7-Eleven breach, a GitHub source code theft via a weaponized VS Code extension, and the FBI warning about the Kali365 phishing-as-a-service kit.
SANS handler Didier Stevens updated his search-for-compression.py tool to detect and extract ZLIB-compressed VBA code from Microsoft Access database files, aiding forensic analysis of the undocumented binary format.
Dutch authorities arrested two co-owners of hosting firms MIRhosting and WorkTitans, seizing over 800 servers for allegedly providing infrastructure to EU-sanctioned Stark Industries Solutions, used by Russian intelligence for cyberattacks and disinformation.
Threat actors stole files containing names and protected health information from Radiology Associates of Richmond, affecting approximately 266,000 individuals.
Nine SQL injection and cross-site scripting vulnerabilities have been disclosed for Code Projects Employee Profile Management System 1.0, all with public exploits available and no patch from the vendor.