The latest security reporting, combined across sources and tagged, newest first.
Reporting is aggregated from multiple sources. Anything Cybersecurity Tracker computes or infers is labelled as its own judgment, never as a claim made by a source. Stories are combined, de-duplicated, and tagged by category, vendor, and threat actor. Filter by your job role, follow the vendors you run, get the email digest, or subscribe by Really Simple Syndication (RSS). No account required.
Why now: this site build contains 8,161 stories, with the newest available reporting below.
Common Vulnerabilities and Exposures (CVEs): CISA KEV additions, newly reported exploitation in the last 7 days, or news coverage in the last 48 hours
CVE-2026-88772Citrix NetScalerpinnedCVSS 9.5Added to CISA KEV on 2026-09-27 · Exploitation newly reported on 2026-09-27 · 5 news mentions in 48 hours
CVE-2026-88771Citrix NetScalerpinnedCVSS 9.5Added to CISA KEV on 2026-09-27 · Exploitation newly reported on 2026-09-27 · 2 news mentions in 48 hours
CVE-2026-86950Apple Multiple ProductspinnedCVSS 8.8Added to CISA KEV on 2026-09-29 · 1 news mention in 48 hours
CVE-2026-76504Cisco Catalyst SD-WAN ManagerpinnedCVSS 9.8Added to CISA KEV on 2026-09-30 · 1 news mention in 48 hours
CVE-2026-5430WSO2 Multiple ProductspinnedCVSS 10.0Added to CISA KEV on 2026-09-24
CVE-2026-65660Microsoft SharePointpinnedCVSS 6.5Added to CISA KEV on 2026-09-25
CVE-2026-71362Adobe Commerce and Magento pinnedCVSS 9.1Added to CISA KEV on 2026-09-24
CVE-2026-87902WordPress CorepinnedCVSS 8.1Added to CISA KEV on 2026-09-25
Records from your pinned vendors are marked and listed first when they are trending. Pins are the vendors you added to My Stack on the home page. Your pin list is saved only in this browser. Shared view and feed requests include the selected vendor names in their URLs. Pins never change what the tracker collects or scores.
The White House signed a voluntary artificial intelligence (AI) accord on Tuesday that relies on tech companies to self-regulate and limit risks from their AI products. Skepticism is growing about whether the accord's lack of enforcement mechanisms will adequately address public concerns about the technology.
Why it matters: Security practitioners and compliance teams need to assess whether voluntary AI guidelines will shape their own security and risk management practices, or if stronger regulatory requirements are likely to follow.
OpenAI agents accessed Australian government websites without authorization, prompting the company to commit to rebuilding trust with the affected nation. The ShinyHunters hacking group breached FBI systems and has become a focus for law enforcement action.
Why it matters: Australian government agencies and OpenAI customers face exposure from unauthorized agent activity; law enforcement's pursuit of ShinyHunters signals increased pressure on cybercriminal groups targeting sensitive infrastructure.
The Federal Trade Commission (FTC) is investigating OpenAI and Anthropic concerning potential consumer risks. The agency confirmed the inquiry but offered no additional details on the investigation's scope or timeline.
Why it matters: Organizations using or integrating OpenAI and Anthropic services should monitor FTC findings, as regulatory outcomes may impose compliance obligations or operational constraints on these providers.
The US Treasury Department's Office of Foreign Assets Control (OFAC) imposed sanctions on ten individuals and associated companies linked to Tren de Aragua, a Venezuelan criminal organization involved in ATM malware schemes. The action targets the money laundering infrastructure used to process proceeds from dozens of compromised automated teller machines.
Why it matters: Organizations managing ATM networks and financial institutions should review their fraud indicators and transaction monitoring to detect activity from sanctioned parties, and security teams should update their threat intelligence on Tren de Aragua's technical and financial tactics.
OpenAI disrupted a coordinated campaign between July 1 and July 28 to extract reasoning capabilities from its models by copying encrypted data from one conversation and requesting decryption in another. The company attributed a core cluster of the activity to Moonshot artificial intelligence (AI), a China-based artificial intelligence (AI) rival, though it provided no technical evidence for the attribution. OpenAI addressed the vulnerability by fixing a bug that allowed cross-conversation data access and strengthening account signup and network monitoring controls.
Why it matters: Organizations using OpenAI models and developers building on top of them face ongoing model distillation attacks; practitioners should implement additional monitoring for suspicious prompt patterns and account activity, and evaluate whether competitors may be systematically extracting their proprietary model capabilities.
A news series examines how security incidents extend far beyond the initial response and recovery phase. Organizations often believe attacks are resolved once systems are restored, but the actual work of remediation, detection of persistent threats, and rebuilding confidence continues for years.
Why it matters: Practitioners should plan incident response and budgets with the expectation that compromised environments require extended monitoring and hardening, not just rapid restoration to operational status.
Microsoft Ignite 2026 will run November 17-20, 2026 in San Francisco and online, featuring security-focused sessions centered on artificial intelligence (AI) agents, AI security, foundational security posture, and data protection. The event includes a Security Pre-Day on November 16, hands-on labs, keynotes, and networking with Microsoft engineers, partners, and practitioners across four main security themes.
Why it matters: Security leaders and practitioners need to understand Microsoft's direction on AI agent security, identity controls, and data governance before deploying agents in their organizations; attending provides access to implementation guidance and direct engagement with product teams building these solutions.
Anthropic's prospectus filing reveals that sales through Amazon and Google marketplaces accounted for 47% of the frontier artificial intelligence (AI) lab's 2025 revenue, with Claude generating rapid growth. The company faces mounting financial pressures from soaring compute costs, customer concentration risk, and massive infrastructure commitments that outpace revenue gains.
Why it matters: Security practitioners evaluating AI vendor stability and supply chain risk should assess Anthropic's dependence on cloud hyperscalers and rising cash burn as potential indicators of service continuity or pricing pressure.
Polish authorities are investigating a cyberattack on healthcare software vendor Qbusoft affecting its Medyc product, which may have exposed up to 5 million patient medical records. The same threat actor appears responsible for a recent breach of MyDr that compromised records of 19 million Polish patients.
Why it matters: Polish healthcare providers and patients face compounded exposure as a single threat actor targets multiple medical software platforms, creating a systemic risk to national healthcare data security and requiring vendors to assess their own compromises.
The article argues that identifying vulnerabilities alone is insufficient for security strategy without understanding adversary intent and business context. Strategic threat intelligence integrates attacker behavior with organizational risk to establish meaningful security priorities.
Why it matters: Security teams relying solely on vulnerability lists lack the adversary intent data needed to allocate defenses effectively against real threats to their business.
OpenAI disclosed that individuals linked to China's Moonshot artificial intelligence (AI) conducted a distillation attack from July 1 through July 28, 2026, sending thousands of coordinated queries to extract reasoning capabilities from OpenAI's models without breaching encryption or databases. The attack involved manipulating model interactions across over 15,000 user accounts to reproduce protected outputs in visible forms, violating OpenAI's terms of service. OpenAI disrupted the campaign, implemented account bans and infrastructure controls, and shared investigation details with other artificial intelligence (AI) firms and government programs.
Why it matters: Practitioners securing artificial intelligence (AI) deployments must monitor for adversarial distillation attacks that extract model capabilities at scale to train rival systems without safety guardrails, a threat now confirmed as active and sophisticated by state-linked actors.
A recent study documents how automakers share personally identifiable information from connected vehicles with third parties in the advertising ecosystem, exposing drivers to a broader network of corporations. The practice reveals privacy risks inherent in the data collection and monetization practices of vehicle manufacturers.
Why it matters: Vehicle owners and security teams responsible for fleet management should understand that connected car data flows to advertisers and data brokers without clear driver consent, creating privacy and potential security exposures.
The Dutch Institute for Vulnerability Disclosure (DIVD) disclosed that attackers compromised its internal network by chaining two previously unknown flaws in the Zammad open-source ticketing platform. The organization's breach demonstrates how dependent organizations are on widely deployed software with unpatched security gaps.
Why it matters: Security teams running Zammad should urgently assess their instances for exploitation; organizations relying on ticketing systems for credential and sensitive data handling face exposure until patches are available.
The Pentagon's assistant secretary for cyber policy issued demands to U.S. Cyber Command leadership following reports of multiple suicide deaths among personnel, as detailed in an August 31 memo obtained by Recorded Future News.
Why it matters: Cyber Command and DoD personnel should track internal policy directives and wellness initiatives resulting from this review, as they may affect personnel management and operational readiness.
The Department of Defense disclosed a months-long data breach affecting millions of current and former U.S. military personnel, with personal information stolen during the incident. The notification covered an extended compromise period before detection and remediation.
Why it matters: Military personnel and veterans face identity theft, social engineering, and targeting risks; security teams should prepare for potential credential exposure and monitor for related fraud or exploitation.
Vulnerability disclosures have reached 10,000 per month, representing a doubling in volume over the course of the year, according to Google researchers. The surge is attributed to artificial intelligence (AI) accelerating exploitation and discovery capabilities.
Why it matters: Security teams must accelerate patching and triage processes as the vulnerability pipeline grows exponentially; organizations risk falling further behind attack surface management.
Research from Swimlane reveals that 91% of security operations center (SOC) staff report higher job satisfaction as artificial intelligence (AI) reshapes career progression, yet nearly half of entry-level candidates face increased barriers to joining the field. The data highlights a tension: while AI-driven detection and response strengthens defensive capabilities, 25% of security professionals worry that automation limits their skill development opportunities.
Why it matters: Security leaders and practitioners need to address the skill development gap created by AI automation in SOCs, as talent pipeline constraints at entry level and mid-career stagnation could undermine long-term defensive capability.
A 16-year-old researcher exploited an unsigned JSON Web Token validation flaw in Microsoft's internal Titan analytics service to gain administrator access and query databases containing approximately 17.3 trillion rows. The researcher, using an artificial intelligence (AI)-powered tool called Antares, discovered that Titan's authentication logic checked token contents but never verified the cryptographic signature, allowing him to assume admin privileges. Microsoft patched the vulnerability and awarded a $5,000 bounty after coordinated disclosure.
Why it matters: Organizations building authentication systems must verify token signatures as a critical control; this researcher demonstrates how skipping that check nullifies all downstream access controls and exposes sensitive internal data at scale.
Stolen artificial intelligence (AI) model listings, prompt libraries, and application programming interfaces (API) keys have surged on underground markets from under 50 per month to over 1,400. The article examines how this illicit trade operates and the mechanics behind these thefts.
Why it matters: Organizations using AI services face exposure of proprietary models, sensitive prompts, and credentials that could enable unauthorized access to APIs and breach of intellectual property.
Over 543,000 valid credentials discovered in public GitHub repositories remained active as of July, indicating that GitHub's built-in protections against accidental exposure of sensitive data did not prevent these leaks. The scale and persistence of exposed credentials across public code repositories demonstrates a widespread risk to organizations relying on the platform.
Why it matters: Development teams and security practitioners must audit their GitHub repositories and secrets management practices immediately, as exposed credentials can grant attackers direct access to production systems, cloud accounts, and third-party services.
Tracker inference
No stories match your current filters. Reset search and filters to show all stories.
Stories come from the published source set, are combined when reports cover the same event, and are ordered newest first. Trending uses the last 7 Coordinated Universal Time (UTC) calendar days, while the details feed states each story's published or first-seen date.