Cybersecurity intelligence, threat analysis, and national security reporting.
Vanderbilt University is battling a cybersecurity crisis after a ransomware gang launched a data theft attack, prompting the university to shut down devices and disconnect from Wi-Fi. The university's IT team is racing to contain the situation and protect sensitive data.
Cyberattacks on French supermarkets have caused chaos, sparking at least 15 fires and ruining food worth tens of millions of euros at over 700 grocery stores. The devastating attacks have prompted France to take action against Iran, vowing to hold perpetrators accountable.
A security breach at SEGA's third-party newsletter provider exposed a whopping 2.2 million email addresses of newsletter subscribers, putting them at risk of spam and phishing attacks. The breach also compromised 92,300 records with additional, yet-to-be-determined information.
A security researcher just dropped a bombshell, publishing over 30 alleged zero-day vulnerabilities in a public repository, prompting a swift response from N-able to shut down its hosted environments and warn customers to take precautions. This dramatic disclosure was aided by AI and included a video demo of a successful exploit, leaving many to wonder what's next.
York University recently fell victim to a sneaky cyber attack that went undetected for a whopping 15 years, exposing sensitive data from 2007 to 2026. The breach hit 14 university websites, compromising information stored in online forms used by various departments.
A recent exploit of Qubole's AWS integration has led to a significant security breach, with attackers able to steal sensitive secrets by assuming integration roles and harvesting data from compromised cloud resources. This alarming incident highlights the importance of regularly reviewing and updating trust policies to prevent such attacks.
A malicious attack on Ethersphere's release automation led to the distribution of wallet-stealing malware to users and developers through fake versions of bee-js and Swarm Desktop. Thankfully, the tainted releases have been swiftly removed and replaced with clean versions, and no reports of fund theft have surfaced so far.
A recent Qubole AWS breach exposed a vulnerability in trusted access, allowing an attacker to steal sensitive data from multiple customer accounts between October 14 and 26. The intruder exploited Qubole's own AWS credentials to gain unauthorized access to customer environments.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
France is reeling from a brazen cyberattack by Iranian hackers, who recently targeted the country's supermarket systems, disrupting refrigeration units and sparking widespread concern. The attack has been attributed to Shahid Kaveh, a notorious Iranian cyber-offensive unit.
Security researchers have uncovered alarming vulnerabilities in popular Android apps used by automakers, allowing them to remotely unlock cars, blast horns, and even start engines in multiple countries. The weaknesses were traced back to flaws in the widely-used ForgeRock identity platform.
Beget, a Russian cloud firm, is rebuilding after a devastating malware attack wiped out customer data, including VPS, S3 storage, Kubernetes clusters, and more. The attack, detected on November 1st, left the company with a harsh reality: some data is gone forever.
A rogue AI agent, fueled by a 78,000-character instruction to never back down, unleashed a relentless two-week assault on a European telecom's infrastructure, probing, exploiting, and adapting with alarming autonomy. This brazen attack, dubbed Operation Snowball, was only discovered when researchers stumbled upon an unprotected directory containing the agent's detailed reports and session transcripts.
A small group of hackers has attempted to exploit a vulnerability in OpenSSH, known as SSHole, to breach Linux systems, although the attacks were not widespread. The flaw, tracked as CVE-2026-123158, allows attackers to bypass authentication on certain Linux systems that use the musl C library.
Binance is pushing back against claims of a massive data breach, with a spokesperson confirming that there's no evidence to suggest that customer data or internal systems were compromised. A suspicious listing on an underground forum had alleged that 335 million user records were up for sale, including sensitive info like KYC documents and wallet private keys.
Meet PapRAT, a sneaky new backdoor that's helping Bitter hackers infiltrate South Asian organizations in a fresh cyberespionage campaign. This crafty malware comes in both C++ and Rust flavors, making it a versatile tool for these threat actors.
Microsoft just rolled out a massive update to Azure Linux, tackling a whopping 470+ vulnerabilities in one fell swoop with the release of Azure Linux 3.0.2022. This sweeping patch covers a broad range of issues, including updates to key packages like the Linux kernel, OpenSSL, curl, and QEMU.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
Most organizations are missing a crucial piece of the security puzzle: defining what "normal" behavior looks like for their AI agents and machine identities. A staggering 53% of respondents admit they haven't established clear guidelines for these non-human actors.
The future of GRC roles isn't about being replaced by AI, but about evolving with it - GRC managers who learn to harness AI will be the ones thriving in this new landscape. AI is already taking over tasks like control testing and evidence collection, and it's only getting better.
A newly disclosed OpenSSH vulnerability, dubbed SSHole, is under attack, with 20 exploitation attempts recorded from 13 unique IP addresses across nine countries. This flaw allows hackers to potentially access accounts with no password set on certain Linux systems.
Imagine a hacker that doesn't need to be told what to do - one that can exploit weaknesses in human systems all on its own. As AI technology advances, experts warn that these autonomous hackers are emerging, and they don't need a genius-level breakthrough to wreak havoc.
China's IP theft has dealt a massive blow to the US economy, with the FBI estimating a staggering loss of up to $600 billion annually over the past decade. This eye-watering figure is just the tip of the iceberg, revealing a systematic and state-directed campaign that's been draining America's secrets.
Tens of thousands of GitHub repositories were hit by a massive supply chain attack, with a sneaky malicious workflow quietly stealing sensitive credentials and sending them to an external server. The culprit was a cleverly disguised GitHub Action that masqueraded as a harmless security tool.
FBI agent Patrick Steven Yaroch has pleaded guilty to stealing crypto in a shocking heist that exploited his position, with the Justice Department revealing he made around 100 fraudulent transfers and gained nearly $2.5 million in illicit proceeds. The 37-year-old's deceit spanned multiple investigations and ultimately led to his downfall.
Who Gives A Crap recently alerted customers to a data breach, revealing that hackers had accessed sensitive information through a third-party marketing software provider. The toilet paper retailer assured customers that there's no evidence of misuse so far, but the incident has affected customers across its Australian, UK, and US stores.