Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,764 stories synthesized.
The art-template npm package was backdoored in a supply-chain attack delivering the Coruna iOS exploit kit, turning any site using the compromised package into a watering hole for Apple device owners.
A Russian-speaking threat actor used a jailbroken Google Gemini LLM to orchestrate a year-long crypto fraud campaign targeting MAGA and QAnon communities, emptying at least one victim's wallets.
The INJ3CTOR3 hacker group is targeting over 3,000 FreePBX VoIP systems with a novel PHP webshell called JOMANGY that uses six self-healing persistence layers to maintain access for toll fraud.
A new banking trojan dubbed Banana RAT is targeting 16 major Brazilian financial institutions by disguising itself as legitimate electronic invoice files delivered through WhatsApp and phishing links.
Rapid7's latest Metasploit weekly wrap-up includes five new modules targeting critical vulnerabilities in Cisco Catalyst SD-WAN Controller, cPanel/WHM, HUSTOJ, and Barracuda ESG, alongside a post-exploitation module for Tenable Security Center.
A six-hour automated campaign dubbed Megalodon pushed malicious commits to over 5,500 GitHub repositories, hiding CI/CD credential-stealing code in the Tiledesk npm package.
Dutch financial crime investigators arrested two men and seized 800 servers belonging to a web hosting company that facilitated cyberattacks, interference operations, and disinformation campaigns.
Attackers compromised an outdated F5 BIG-IP load balancer, pivoted to an internal Linux host, exploited a vulnerable Confluence instance, and conducted relay attacks against Active Directory in a sophisticated multi-domain campaign.
Devolutions patched nine vulnerabilities in its Server product on May 22, 2026, including a high-severity MFA bypass (CVE-2026-9047) and an AD authentication relay flaw (CVE-2026-7325).
Dell published 13 security advisories in a four-day window, with the bulk of the flaws — eight medium-severity bugs — concentrated in PowerFlex Manager versions up to 4.6.2.
Concrete CMS shipped version 9.5.1 to patch 25 vulnerabilities, including 12 high-severity CSRF bugs, IDOR leaks of private messages, and a password-change bypass.
Check Point Research reveals that IRGC-affiliated threat actor Nimbus Manticore launched new campaigns during Operation Epic Fury, using AppDomain hijacking, SEO poisoning, and a novel AI-assisted backdoor named MiniFast.
This week's cybersecurity landscape features Interpol's Operation Ramz arrests, a new macOS infostealer variant, and two actively exploited Microsoft Defender zero-days.
A new campaign targets industrial routers with default credentials, CISA opens KEV nominations to the public, and gas station systems remain exposed to unpatched flaws.
Researchers demonstrated an AI-driven pipeline at Ekoparty Miami that discovered over 300 critical zero-day vulnerabilities in WordPress plugins at an average cost of $20 per bug, signaling a new economic reality for the security industry.
A CISA contractor left highly privileged AWS GovCloud credentials and internal system details exposed in a public GitHub repository until May 2026, in what experts call one of the most egregious government data leaks in recent history.
The 2026 Verizon DBIR finds social engineering attacks surged in healthcare, with AI-driven pretexting emerging as a top threat vector.
Iranian state-backed group Screening Serpens is conducting active espionage campaigns in 2026, using AppDomainManager hijacking and new RAT variants to breach technology and defense organizations.
Google has released Chrome 148.0.7778.178/179 to fix two critical vulnerabilities, including a WebRTC use-after-free bug that enables remote code execution on Linux.
Ubiquiti released security updates for three maximum-severity vulnerabilities in UniFi OS that allow unauthenticated remote attackers to compromise affected devices.
The automated 'Megalodon' campaign pushed 5,718 malicious commits to 5,561 GitHub repositories in six hours, injecting CI/CD workflows that exfiltrate cloud credentials and secrets to an attacker-controlled server.
New research reveals how attackers can interact with vulnerable Windows kernel-mode drivers from user mode even when the drivers require specific hardware, expanding the BYOVD attack surface for privilege escalation.
SEO poisoning campaigns are using fake websites impersonating Google Gemini and Anthropic Claude Code to distribute infostealer malware targeting enterprise credentials and crypto wallets.
Trail of Bits hardened zizmor, a static analyzer for GitHub Actions workflows, fixing four YAML anchor-handling bugs and other edge cases after attackers exploited a pull_request_target misconfiguration in trivy-action to backdoor LiteLLM.