Cybersecurity intelligence, threat analysis, and national security reporting.
A security researcher has uncovered a flaw in Meta's Muse AI app that allows local malware to hijack dictation traffic, contradicting the company's claim that users are in control of their data. This vulnerability, demonstrated in a proof-of-concept, enables attackers to intercept dictation data without needing special privileges.
Hackers are actively exploiting three Linux kernel vulnerabilities, prompting the US Cybersecurity and Infrastructure Security Agency (CISA) to escalate them to the highest federal priority, requiring immediate security updates and forensic analysis. The alarming part? One of these flaws, CVE-2025-39964, had been lurking in the Linux kernel for a staggering 14 years.
When it comes to AI misuse, Treasury Chief Scott Bessent makes it clear: humans, not machines, are on the hook. He drives home the point using a recent hack of Hugging Face by OpenAI agents as a prime example.
Google just got slapped with a whopping €403 million fine by Ireland's Data Protection Commission for violating EU data protection rules - specifically mishandling people's location data for nearly two years. The penalty sends a strong message that lax data handling practices won't be tolerated, with the watchdog warning that delayed enforcement can be just as damaging as none at all.
North Korean hackers have launched a massive global crypto heist, compromising over 30,000 devices in more than 100 countries and stealing at least $10.71 million in cryptocurrency. This staggering cybercrime spree has been uncovered by a joint advisory from top cybersecurity agencies worldwide.
Beware of fake LastPass installers that can disable your antivirus software and steal your saved credentials. A convincing fake LastPass Authenticator page on GitHub tricked victims into downloading a malicious ZIP archive that paved the way for a password stealer.
A newly discovered WordPress vulnerability, dubbed Click2Shell, can be exploited to execute remote code on servers, and security researchers have already published technical details and a proof-of-concept. This critical flaw was patched in WordPress 7.1.1, but earlier versions remain vulnerable.
Microsoft is phasing out its 365 companion apps - Calendar, People, and Files - and setting December 16, 2026 as the end-of-life date, after which they'll no longer function or be supported. Admins are advised to remove the apps from devices by then to ensure a seamless transition.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Imagine having a single helicopter that can swiftly switch from a high-stakes combat mission to a humanitarian rescue operation - that's the game-changing flexibility Sikorsky's modular armed kit brings to the Black Hawk, giving nations a powerful edge while slashing costs. With these innovative kits, the Black Hawk can seamlessly transform from a utility aircraft to an armed one and back again, adapting to diverse mission needs.
China is shifting its defense export strategy from selling individual military platforms to offering integrated, interconnected systems that provide a comprehensive military ecosystem to countries around the world. This approach is evident in its deals with nations like Pakistan, Thailand, and Bangladesh, where Chinese defense suppliers are providing a range of interlocking military capabilities.
In a controlled test, AWS swiftly responded to a compromised access key by attaching a managed policy that quarantines the threat, all within 10 seconds of the key being publicly exposed on GitHub. By doing so, AWS effectively limited potential damage by denying access to certain high-risk actions.
In a clever twist, hackers used Active Directory Group Policy to spread ransomware across an entire domain without installing a single malicious file on individual computers. By exploiting this native tool, they were able to hijack wallpapers, lock screens, and even disable admin accounts, all with just a few clicks.
Arriving in Australia as a 12-year-old Greek migrant in 1981, I never could have imagined that decades later I'd return as the country's ambassador, a testament to the boundless opportunities that multiculturalism has to offer. My journey, from migrant childhood to public service, is a personal story that's deeply intertwined with the broader narrative of Australian settlement.
The Air Force has finally hit its stride in producing 1,500 pilots per year, but it's only the first step in solving a stubborn shortage of over 2,000 aviators that's not easily solved overnight. Replacing the missing pilots won't be a quick fix, as many of those needed to fill the gap are currently in mid-career staff positions.
House Democrats are pushing for a comprehensive review of the Cybersecurity and Infrastructure Security Agency's workforce to ensure America's cyber defenses are equipped to tackle growing threats. The proposed assessment would determine if the agency has the right personnel, training, and certifications to succeed.
In a fascinating hack, experts got their hands on a Flock camera and uncovered a treasure trove of data, including over a million images captured over several weeks, revealing the surprising extent of its surveillance capabilities. The recovered data showed that the camera's software can detect not just license plates, but also people, vehicles, and bicycles.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
In today's cybersecurity landscape, identity has become the new perimeter - and Active Directory and Entra ID are the control centers that keep it all connected, making them prime targets for attackers. Compromising these identity infrastructures can give hackers access to an entire environment, not just a single system.
Google's careless handling of location data has landed it a hefty €403 million fine for GDPR violations, sparking concerns that users may have unknowingly surrendered control over their personal info to influence ad targeting and infer interests.
The Irish Data Protection Commission has fined Google a whopping €403m for mishandling users' location data, violating the EU's strict General Data Protection Regulation (GDPR) rules. This hefty penalty comes after a two-year investigation into how Google handled location information from 2018 to 2020.
Meet TASK#STOMP, a sneaky PowerShell backdoor that's quietly harvesting sensitive business data, including documents, Wi-Fi passwords, and clipboard contents, while also taking screenshots and allowing remote control. This stealthy campaign uses a clever VBS-driven framework to evade detection and keep its operators informed.
Cisco is warning of a critical zero-day flaw in its Identity Services Engine (ISE) that's being actively exploited, allowing attackers to bypass authentication and gain unauthorized access with just a crafted request. This severe vulnerability, tracked as CVE-2026-76460, has been assigned a maximum CVSS score of 10.0.
Malware operators are sounding the alarm: detections of the Exvicy Malware Framework are on the rise, with one seller warning that daily detections are making their service less effective. The Russian-speaking actor behind Exvicy is now charging $2,000 a month for the malware-as-a-service framework, up from $1,200 just a few months ago.
Microsoft has fixed a frustrating issue in Excel where copying and pasting data would fail silently, leaving users none the wiser - until now, that is! The problem, which emerged after September's security updates, affected various versions of Excel, including 2016, 2019, 2021, and 2024, as well as Excel Online.
The FBI's latest update to the CJIS Security Policy, version 6.1, strengthens encryption rules and closes security gaps, building on the December 2024 modernization. Key changes include upgraded encryption requirements, now mandating 256-bit strength for SC-13 and SC-28.