Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,768 stories synthesized.
GreyNoise detected 597,000 scanning sessions targeting SonicWall SonicOS management APIs on May 12, 2026—a 46-fold increase—mirroring patterns seen before the disclosure of CVE-2026-0400.
Iran-linked threat actor Screening Serpens is using two new RAT families—MiniUpdate and MiniJunk V2—in spear-phishing campaigns targeting tech professionals in the US, Israel, and UAE.
Legal case management platform DocketWise is notifying over 143,000 people that their personal, financial, and medical information was compromised in a breach involving cloned third-party repositories.
New research from Fox-IT reveals RemotePE, a cross-platform memory-only RAT used by North Korea's Lazarus Group to stealthily target financial and cryptocurrency organizations.
Mysk researchers discovered WhatsApp stores chat histories unencrypted in a shared app group container on iOS and macOS, exposing plaintext messages to other Meta apps like Facebook and Instagram.
A batch of 12 vulnerabilities, including 7 buffer overflows and 5 command injection flaws, has been disclosed for the Edimax BR-6675nD router, with public exploit code available and no official patch.
Five high-severity stack-based buffer overflow vulnerabilities were disclosed across two Tenda router models in a 16-hour window, with public exploits already available for all five CVEs.
Dutch security firm Hadrian has released OpenHack, an MIT-licensed project that packages AI-powered vulnerability research into a file-based workspace compatible with coding harnesses like Claude Code, Codex, and Cursor.
Researcher H-mmer has open-sourced Pentest Agent Suite, a fully autonomous bug-bounty framework integrating 50 specialized security agents across seven AI coding platforms including Claude Code, OpenAI Codex, and Cursor.
A sophisticated supply chain campaign dubbed TrapDoor has compromised 34 packages across npm, PyPI, and Crates.io, targeting crypto, DeFi, Solana, and AI developers with credential-stealing malware.
Mandiant reveals a booming Chinese-language PhaaS ecosystem with real-time MFA bypass, AI-generated phishing pages, and digital wallet tokenization.
Mandiant reports active exploitation of a critical ViewState deserialization vulnerability in KnowledgeDeliver, a Japanese LMS, allowing unauthenticated remote code execution via hardcoded ASP.NET machine keys.
Wireshark 4.6.6 fixes one security vulnerability and 11 bugs, and updates Npcap to version 1.88 for Windows users.
A critical SQL injection vulnerability in Ghost CMS is being actively exploited in a large-scale campaign to inject malicious JavaScript and redirect users to fake CAPTCHA pages that deliver malware.
TeamPCP breached GitHub's internal codebase by poisoning a VS Code extension, while a critical NGINX vulnerability was actively exploited in the wild.
Hexastrike released PyrsistenceSniper, an open-source Python tool that detects 117 persistence mechanisms across Windows, Linux, and macOS by scanning offline disk images and forensic collections.
GitHub has made staged publishing generally available on npm, requiring maintainers to pass a 2FA challenge before a package version becomes publicly installable, alongside new install source flags.
A coordinated supply chain attack on Packagist infected eight Composer packages with malicious code that executes a Linux binary hosted on GitHub Releases, targeting JavaScript projects alongside PHP dependencies.
Italian police dismantled the CINEMAGOAL piracy app, which bypassed Netflix, Disney+, and Spotify by stealing authentication codes every three minutes, causing an estimated €300 million in lost revenue.
Four medium-severity memory corruption vulnerabilities were disclosed in the Free5GC Access and Mobility Management Function, all affecting NGAP message handlers with public exploits available.
A critical heap buffer overflow in NGINX's rewrite module, dubbed nginx-poolslip, allows unauthenticated remote attackers to cause denial of service or potentially execute code.
A maximum-severity vulnerability in the LiteSpeed User-End cPanel Plugin is being actively exploited, allowing any cPanel user to execute arbitrary scripts with root privileges.
Attackers compromised multiple Laravel-Lang PHP packages on Packagist, publishing over 700 malicious tags that deploy a sophisticated credential stealer targeting cloud tokens, crypto wallets, and browser data across Windows, Linux, and macOS.
Anthropic's Project Glasswing has discovered over 10,000 high- or critical-severity vulnerabilities in widely used software using its Claude Mythos AI model, marking a major leap in automated vulnerability research.