[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentIntelligence Briefing
Latest Analysis
Cybersecurity intelligence, threat analysis, and national security reporting.
Avada WordPress Theme Flaw Enables Zero-Click Remote Code Execution
A critical vulnerability in the Avada WordPress theme, scored 9.8 out of 10, can be exploited through a zero-click remote code execution attack, allowing hackers to run malicious PHP code on affected sites without needing login credentials. This flaw enables attackers to take full control of a site, planting malware, stealing data, or creating rogue admin accounts.
US Cyber Defenses Targeted in 100-Plus Water System Attacks
In a shocking revelation, over 100 US water and wastewater systems were targeted by malicious cyber attacks in just one month, with hackers commonly exploiting programmable logic controllers connected to cellular modems. This alarming trend highlights the vulnerability of critical infrastructure to cyber threats.
GPUThor Attack Bypasses NVIDIA ECC Protection
Meet GPUThor, a game-changing attack that shatters NVIDIA's ECC protection, making it alarmingly easy to execute practical root-level attacks. This sinister technique can trigger a staggering 72,000 to 377,000 bit flips per gigabyte, putting even the toughest defenses to shame.
Boston Scientific Hit by Global Cyberattack Disruption
Boston Scientific is facing significant disruptions to its operations after a global cyberattack hit its IT systems, limiting access to crucial business applications and hindering its ability to process and ship customer orders. The company is working closely with third-party experts to investigate and restore its systems, but a timeline for full recovery remains uncertain.
China Advances J-10 Fighter Exports With Bangladesh Deal
Bangladesh is on the verge of taking its relationship with China to new heights with potential formal talks over the purchase of cutting-edge J-10CE fighters and attack helicopters, a deal that would make it only the second country to acquire the advanced export version of the J-10C. A government panel is preparing a draft agreement that could seal the partnership and pave the way for negotiations with Beijing.
Iranian Hacker Group Expands Arsenal with Advanced Backdoor, SSH Tunneler
Meet the Iranian Hacker Group that's expanding its cyber espionage arsenal with advanced tools, potentially setting its sights on a broader target list that includes Middle Eastern and European countries. Their latest moves suggest a more aggressive and sophisticated approach to digital spying.
Phishing Service NovaCookies Targets Organizations with 365 Session Theft
Meet NovaCookies, a sneaky phishing service that's stealing Microsoft 365 sessions from hundreds of organizations - and it's available for a low monthly fee of just $320. This subscription-based threat packages real-time session theft, making it a potent and affordable tool for cybercriminals.
Japan's Air Self-Defense Force Expands Reach with First Fighter Deployment to India
In a historic move, Japan's Air Self-Defense Force is set to make its first-ever fighter deployment to India, sending three F-2A fighters and 110 personnel to the country in September for a joint exercise. This landmark deployment is a testament to the strengthening defense ties between Tokyo and New Delhi.
AI-Driven Vulnerability Discovery Surges, Threatens Software Security
The AI-driven vulnerability discovery surge is alarming, with OpenClaw, a popular AI project, ranking 12th in Q2 for most vulnerabilities discovered and published, with over 200 CVEs registered. This sharp increase in registered vulnerabilities is largely driven by AI adoption in both application development and vulnerability discovery.
Spain, Poland forge $6.3 billion deal for Airbus MRTT tankers
Spain and Poland have just sealed a massive $6.3 billion deal to jointly acquire Airbus A330 Multi Role Tanker Transport (MRTT) aircraft, with at least seven planes set to be purchased. This game-changing agreement was greenlit by Spain's Council of Ministers, paving the way for a seven-year partnership with Poland.
US Water Systems Targeted in Surge of Cyberattacks
In a shocking revelation, over 100 internet-exposed US water systems were hit with cyberattacks in just one month, highlighting a systemic risk that demands immediate attention. This alarming surge in targeted attacks has raised serious concerns about the security of America's water sector.
US Agencies Embrace DevSecOps with Shift-Left Approach
The US Army's Acting CIO, Gabe Chiulli, is leading the charge to revolutionize software delivery by embracing a shift-left approach to DevSecOps, aiming to merge commercial speed with government security needs. By setting a new framework, Chiulli is paving the way for industry collaboration and rapid innovation.
US Army Deploys Swarming Ground Drones from Bradley Fighting Vehicle
Imagine a Bradley Fighting Vehicle unleashing a swarm of mini robots - weighing just 27 kg each - to revolutionize the battlefield. The US Army recently tested this game-changing tech, deploying five FireAnt drones from a M2A4 Bradley during a 1st Cavalry Division exercise.
California Election Official Taps Convicted Felon as Consultant
Shasta County registrar Clint Curtis revealed that he's offered a consulting role to Tina Peters, a convicted felon, to help oversee California's 2026 midterm elections, but she's yet to agree due to concerns about potential roadblocks and ensuring everything is above board.
FBI Disrupts China-Linked QTFY Hacking Infrastructure
The FBI has successfully dismantled a global hacking operation linked to China, used to target critical US infrastructure, in a major cyber disruption. This crackdown targeted a China-sponsored hacking group, QTFY, and its operator, Nanjing Xinjiuwei Network Technology Company.
Meta Faces $18 Billion Settlement Over Alleged Harms to Teen Users
Meta's proposed $18 billion settlement aims to revolutionize teen safety online, introducing industry-leading protections that will safeguard young users across Facebook, Instagram, and beyond. The agreement includes game-changing defaults like a two-hour daily usage limit, nighttime app blocks, and muted notifications, all designed to shield teens from potential harm.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Carhartt Breach Reveals 12.9M Affected, Exposes ShinyHunters' Data Padding Tactics
The Carhartt data breach just got a reality check: an analysis by Troy Hunt revealed that around 12.9 million accounts were genuinely affected, not nearly as many as initially claimed by the hackers. Turns out, you can't always take cybercriminals at their word!
CISA Red Team Tests Expose Organizational Vulnerabilities
CISA's red team tests revealed some eye-opening vulnerabilities, with the team slipping past security operations centers undetected, gaining access to workstations, escalating privileges, and moving freely between systems. This simulated cyber attack exposed weaknesses in critical infrastructure organizations, highlighting areas for improvement in detecting and responding to threats.
Boston Scientific Hit by Cyberattack Disrupting Global Operations
Boston Scientific's global operations have been disrupted by a cyberattack, causing significant hiccups in processing and shipping customer orders due to limited access to key information systems and business applications. The incident was detected on August 25, prompting an immediate response to mitigate the impact.
CISA Red Team Exposes Gaps in Critical Infrastructure Defenses
The CISA red team uncovered alarming gaps in critical infrastructure defenses, revealing that even with detection tools in place, the real vulnerability lies in the people, processes, and procedures supporting them. In a striking example, a recent red-team exercise showed that detection tools can be ineffective if not backed by robust supporting systems.
Hackers Exploit Microsoft SharePoint Flaws in Ongoing RCE Attacks
Hackers are actively exploiting a pair of Microsoft SharePoint vulnerabilities, chaining them together in a potentially devastating attack that could give them remote control of your system. Threat intelligence firm Defused has detected live probes against its honeypots, sounding the alarm for businesses to take action now.
Tortoiseshell Malware Toolkit Expands with New Backdoor, SSH Tunneling
Meet Tortoiseshell, a stealthy malware toolkit that's been lurking in the shadows since 2018, and just got a nasty upgrade with a new backdoor and SSH tunneling capabilities. This cyber-espionage group's toolkit expansion could spell trouble for defense, aerospace, and military organizations worldwide.
Phishing Kit NovaCookies Exploits Docusign Notifications to Hijack Microsoft 365 Sessions
Meet NovaCookies, a sneaky phishing kit that's being sold for just $320 a month, and can hijack your Microsoft 365 sessions in real-time by cleverly intercepting Docusign notifications. This live adversary-in-the-middle relay captures active sessions, allowing hackers to harvest your credentials and multi-factor authentication codes.
Snowflake Tackles Identity Debt as Passwords Lose Favor
The alarming rise of identity debt has led Snowflake to take a bold stance against outdated password practices, proactively tackling the vulnerabilities that leave businesses exposed. By phasing out password authentication, Snowflake is revolutionizing identity debt management and setting a new standard for secure data protection.