Cybersecurity intelligence, threat analysis, and national security reporting.
The Grav CMS flaw, tracked as CVE-2026-42608, was exploited by ShinyHunters to breach the Clop gang's leak site, and the vulnerability has since been patched in Grav's 2.0 and 1.7 branches. Grav confirmed the legitimacy of the flaw and the threat actor's description, and has implemented a fix to prevent further attacks.
Criminals trying to scam people into giving up their Google account info got caught out by their own careless mistake - a recruitment ad that included a script to read out loud, despite claiming no script reading was required. The blunder was exposed in a Telegram post seeking voice callers for a fake Google Security Team phishing operation.
ShinyHunters hacked FBI systems to clear their name, not for financial gain, claiming the breach was a bold move to set the record straight and protect their business reputation. By exposing agent data, the group aimed to counter misinformation spread by the FBI and others.
A critical vulnerability in the popular Elementor WordPress Plugin has put up to 2 million sites at risk of admin account takeovers, with a single click on a malicious link potentially allowing hackers to gain control. This alarming exploit highlights the importance of updating to secure versions and exercising caution when clicking on links.
North Korean hackers pulled off a brazen $387.5 million crypto heist by infiltrating a key backend system of Bitget, a leading crypto exchange, and exploiting it to siphon off digital assets. The attack, bearing all the hallmarks of a sophisticated North Korean operation, left Bitget's cold wallets and customer balances remarkably unscathed.
Don't wait until it's too late - with nearly 1,000 customers across critical sectors like banking, government, and telecommunications at risk, organizations can't afford to delay action against widespread exploitation of SharePoint and Adobe Commerce flaws. A critical authentication-bypass vulnerability, CVE-2026-5430, is already being exploited, putting multiple WSO2 products at risk.
Cybercriminals are using fake HR apps to trick employees into installing ScreenConnect, granting hackers persistent remote access to their machines. This sneaky tactic targets HR and payroll staff, putting sensitive company data at risk.
Meet the latest variant of PamStealer malware, which has evolved with a sneaky new trick: it can only be decrypted through a live command-and-control session, making it even harder to track and stop. This fresh threat uses a fake cryptocurrency wallet site, wavel.app, to lure victims into downloading a malicious disk image file.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Malware linked to the Mini Shai-Hulud campaign suddenly roared back to life on September 16, 2026, when two compromised GitHub Actions repositories were mysteriously re-enabled. This alarming revival happened despite previous efforts to take the repositories offline following a security breach in May 2026.
Get ready to supercharge your coding with Claude Code's cloud sessions, now available to Pro and Max subscribers, and claim up to $250 in free cloud-session credits for a limited time. This game-changing feature lets you keep coding remotely, without interrupting your workflow, even when your computer is turned off.
Join a private dinner discussion in New York on October 27th, where data leaders will gather to tackle the costly problem of file governance gaps - and share their own hard-won insights, off the record. This exclusive, peer-only conversation, led by Joe Fay, offers a unique chance to swap stories and solutions with fellow leaders.
Meet the Lunex Malware Platform, a tool used by a Russian-speaking threat actor to launch a financially motivated infostealer campaign targeting Ukraine, and get the inside scoop on its alleged origins and four-stage attack chain. This malware-as-a-service platform is sold to cybercriminal customers, posing a significant threat to cyber defence.
As AI agents increasingly infiltrate enterprise systems, the authenticity of SOC 2 compliance comes under scrutiny - can a certificate that verifies controls at a single point in time truly guarantee security in a rapidly changing environment? Token Security argues that SOC 2 may be more about appearances than actual protection.
Get ready to supercharge your productivity with ChatGPT Pro Max, a powerhouse new subscription that promises lightning-fast performance, massive memory, and cutting-edge features - all for just $500 per month. This premium plan boasts the fastest Codex capabilities, 100 GB of file storage, and early access to new features.
Security researchers just uncovered a set of zero-click flaws in Salesforce Agentforce that let attackers silently siphon off sensitive CRM data without even needing to log in. This clever exploit, dubbed "SalesBleed," could put AI agent data at risk - and it's a wake-up call for companies to take action.
Cybercriminals are now leveraging AI to supercharge their attacks, using it to discover vulnerabilities, develop exploits, and automate tasks - putting pressure on security teams to respond faster than ever. In fact, by late 2025, AI-powered malware and illicit AI tools were already emerging on the dark web, changing the game for threat actors.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
With democracy on the back foot for two decades, the world is bracing for a potentially catastrophic war - and experts warn that a Chinese move on Taiwan could be the spark that sets it off. The clock is ticking: can democracies unite to form a global alliance and deter China before it's too late?
The CISA Election Infrastructure Security Plan is a powerful shield against evolving threats, leveraging partnerships, cyber defenses, and threat intelligence to safeguard the integrity of US elections. By working together, stakeholders can ensure the security and public trust that's fundamental to a healthy democracy.
In a rapidly evolving world, Australia is on a mission to join forces with like-minded nations to secure access to cutting-edge AI technology, recognizing that being left behind could have serious consequences. By banding together, middle powers can ensure they have a seat at the table and aren't left on the menu.
The US military's healthcare system is seeing its biggest wins with the modernization of electronic health records, particularly with the rollout of MHS GENESIS and parallel VA efforts. These unified platforms are revolutionizing the way healthcare is delivered, setting the stage for future innovations in cloud architecture and AI integration.
Microsoft is sunsetting Windows Deployment Services, ending active development and planning for its complete removal in a future Windows Server version. This change affects the inbox WDS server role and associated functionality.
In a major cybercrime crackdown, Ardit Kutleshi, a 28-year-old Kosovar national, has pleaded guilty to running Rydox, an illicit online marketplace that sold stolen personal info, including Social Security numbers, credit card details, and login credentials, of thousands of US citizens. The guilty plea comes after a massive investigation into over 7,600 sales of sensitive data on the platform.
In a shocking security breach, North Korean hackers made off with a whopping $351.6 million from cryptocurrency exchange Bitget, compromising a limited number of hot wallets. Fortunately, customer account balances remain intact and trading operations are still running smoothly, with withdrawals temporarily paused while the company conducts a thorough security review.
A critical Roundcube Webmail vulnerability, CVE-2026-48842, is under active exploitation, allowing unauthenticated attackers to inject malicious SQL code and potentially expose sensitive mail account credentials and messages. This flaw affects versions 1.6.x and 1.7.x of Roundcube Webmail, and has been patched in versions 1.6.16 and 1.7.1.