Cybersecurity intelligence, threat analysis, and national security reporting.
Hackers are exploiting WordPress plugins to secretly create hidden admin accounts, allowing them to control your site without you even knowing. This sneaky tactic uses vulnerabilities like stored cross-site scripting (XSS) to install backdoors and gain full control.
In a staggering display of cybersecurity prowess, researchers at Pwn2Own Ireland 2026 exploited a whopping 32 zero-day vulnerabilities on the competition's first day, raking in $388,500 in awards. The successful hacks targeted a range of products, from mobile phones like the Apple iPhone 17 and Samsung Galaxy S26, to smart home devices and AI infrastructure.
The astonishing truth is that a whopping 2,514 cybersecurity events occur every single second, according to the Comcast Business 2026 Cybersecurity Threat Report, which analyzed a massive 79.3 billion events over just 12 months.
A shocking data breach at Trump Mobile has exposed the personal info of 3,615 customers, including names, email addresses, phone numbers, and home addresses, to hackers. The alarming part? The company reportedly responded to the breach by saying they had no team to handle it.
A critical file-access flaw has been discovered in various Atlassian products, including Jira and Confluence, allowing unauthenticated attackers to access sensitive files. To stay safe, ensure you're running the latest versions: Bitbucket Data Center 9.4.26 or later, Confluence Data Center 9.2.26 or later, and more.
ASOS app users were shocked to receive a disturbing push notification at 5am ET on Tuesday, claiming that the company had been hacked and data compromised. The alert, which appeared to come from hackers, even taunted ASOS's data protection team, threatening to leak sensitive information if not contacted.
The city's computer systems were temporarily shut down due to a ransomware incident on October 1, but essential services like 911, Police and Fire Departments, and utility services remained operational, ensuring public safety. Residents may experience delays with in-person utility payments until systems are restored.
The Operational Technology Cybersecurity Coalition is urging CISA to set mandatory OT security standards for federal agencies, ensuring the government practices what it preaches when it comes to cybersecurity. By doing so, agencies will have clear responsibility for OT cybersecurity and a baseline for protection.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
In a chilling move, Iranian state-backed hackers launched a stealthy campaign, dubbed Blinder Tunnel, that infiltrated Iraqi critical infrastructure by tricking developers into opening a booby-trapped Visual Studio project file. This cunning attack unfolded in three swift steps, allowing the hackers to execute malicious code without triggering a compile or user-run binary.
Leonardo DRS is bolstering its UK presence with a new subsidiary, DRS UK, which will start producing tactical radios at a state-of-the-art facility, enabling the company to better support local customers and partners. This strategic move allows for closer collaboration with UK industry partners to deliver cutting-edge defence capabilities.
Anduril is shaking things up in the submarine supply chain with a massive $6.6 billion investment in a new Maryland shipyard, taking on the majority of execution risk to ensure on-time, high-quality production. The innovative deal, which combines private capital with Navy funding, marks Anduril's bold entry into the defense industry.
Get ready for a show of military strength as China's elite troops head to Russia for a massive joint exercise called Tsentr-2026, alongside troops from Russia, Belarus, and Pakistan. The People's Liberation Army is sending its top armored units to the Chebarkul Training Range in Russia's Chelyabinsk Region for a high-stakes display of cross-border military cooperation.
DEFTECH, a leading Azerbaijani defense company, has made a significant sale to Pakistan, supplying its cutting-edge F-1500 and F-5000 loitering munitions, capable of delivering 1.5 kg and 5 kg warheads, respectively. This deal was announced at the 6th Azerbaijan International Defence Exhibition (ADEX 2026).
Boeing's surprise win of the Navy's F/A-XX fighter contract has raised eyebrows, and now the question is: what's next for this cutting-edge aircraft? The deal has also sparked interest in Ukraine's rapidly scaling defense-tech industry, where innovation meets real-world action.
To succeed, Australia's Guided Weapons Effort must overcome workforce hurdles by moving beyond ad hoc coordination and providing clear, long-term demand signals to attract and train specialised talent. This critical step will help unlock the full potential of the AU$26-36 billion initiative launched in 2024.
The game has changed in space - it's no longer a safe haven, but a high-stakes warfighting domain where adversaries are rapidly developing anti-satellite capabilities to take down our satellites. The 2007 Chinese anti-satellite test was a wake-up call, sparking a rush to orbit and creating a complex, congested space environment that's vulnerable to both kinetic and non-kinetic threats.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
Magnet Forensics has just unveiled a game-changing solution that helps bypass iPhone security, allowing for seamless forensic analysis even after 72 hours of inactivity. Their innovative tools, GrayKey Preserve and Evidence Preservation Mode, are set to revolutionize iOS forensics.
A cyberattack on a US-bound oil supertanker, the VL Prosperity, sparked a swift response from the FBI and US Coast Guard, who boarded the vessel to investigate a suspected network breach. The incident raised concerns about the security of critical maritime infrastructure.
Microsoft is taking a firmer stance on email attachments, adding two new file types to Outlook's restricted list in a bid to boost security and keep users safe. This move is the latest effort to crack down on potentially hazardous files.
Beware of the sneaky ClickFix attack, where hackers hide a malicious VBScript payload in your browser cache, disguising it as an innocent image - and Microsoft is sounding the alarm. A clever trick allows attackers to get a head start, loading the script into your cache before you even take action.
Scammers are now using fake AI tools to trick victims into handing over their ad accounts and multi-factor authentication codes, with one phishing campaign gathering hundreds of victim submissions. They're getting clever with a technique called browser-in-the-browser, creating fake login prompts that look legit and are almost impossible to spot.
Nikkei revealed that around 9,000 phishing emails were sent from a hijacked Microsoft 365 mailbox, adding to a string of account breaches that exposed sensitive employee and partner contact data. The breaches, which started with a Google Workspace account hack in late July, affected over 1,646 individuals, with compromised info including names and email addresses.
A shocking data breach at Frontline Education exposed sensitive employee information, including Social Security numbers, after an unauthorized user exploited a vulnerability in third-party software used by the education-tech organization. The breach highlights the hidden risks of entrusting vendors with confidential data.
MSPs, beware: with great power comes great vulnerability - RMM software can put thousands of customer devices at risk if not properly secured, and the stats are alarming, with nearly 1,500 servers recently exposed online. One compromised account or server can have a devastating blast radius, making it crucial to act now to protect your business.