Cybersecurity intelligence, threat analysis, and national security reporting.
A recent investigation revealed that a suspected China-nexus APT group is actively exploiting a critical VMware vCenter vulnerability, CVE-2026-59310, to execute arbitrary code and deploy a backdoor, with ransomware seemingly used as a smokescreen to distract from the underlying intrusion. The attackers' true intentions appear to go beyond mere ransomware deployment.
A critical vulnerability in the popular User Profile Builder plugin has put over 40,000 WordPress sites at risk of admin takeover, with a CVSS rating of 9.8; site owners should immediately update to version 3.16.5 or later to patch the flaw.
Security researchers have uncovered a two-stage exploit chain that can give attackers full access to the Android kernel on devices using Unisoc modem firmware, and alarmingly, the vendor has remained unresponsive to disclosure efforts. This chain can be triggered by a simple malformed video call, putting countless devices at risk.
Mark your calendars: Windows Server 2022 will reach the end of its mainstream support on October 13, 2026, and transition to extended support, where you'll still receive free monthly security updates until October 14, 2031.
Are your organization's secrets safe with AI? The Model Context Protocol's security flaws are exposing enterprise secrets, making it crucial to assess how well your sensitive information is protected when shared with MCP servers.
Major companies like Philips, General Electric, and Shell are investigating claims by the Clop ransomware gang that their systems were breached, with Philips confirming a contained breach of an internal server that didn't affect customers. The incidents are a stark reminder of the growing threat of ransomware attacks on businesses.
The European Telecommunications Standards Institute (ETSI) is pushing forward with 17 crucial cybersecurity standards to help vendors and buyers across the continent meet the EU's Cyber Resilience Act requirements. These draft standards cover 17 major product categories, setting a vital baseline for manufacturers to ensure their products are secure and compliant.
A threat actor known as TheHatman is peddling a staggering 1.7 million employee records from McDonald's, along with millions more from other top firms, allegedly stolen from Microsoft Azure environments. The breach, which Hudson Rock deems highly authentic, has left giants like Vodafone, Tata Consultancy Services, and IHG Hotels & Resorts vulnerable.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Apple just sounded the alarm for users in 110 countries, warning them they've been targeted by highly sophisticated mercenary spyware attacks that are among the most advanced digital threats out there. This latest alert is part of a multi-year effort to protect users, with notifications now sent to customers in over 150 countries.
Beware of a sneaky recruitment phishing scam that used fake interview pages and a clever Browser-in-the-Browser trick to steal Google and Facebook credentials from over 3,000 unsuspecting victims in just two months. This cunning attack even fooled multi-factor authentication, putting countless users at risk.
Google warns that attackers are exploiting Chrome Remote Debugging to steal cookies, and now researchers have developed a new technique to activate DevTools inside a live browser, allowing for even easier cookie extraction. This technique uses a Beacon Object File to tap into the Chrome DevTools Protocol, posing a new threat to users.
Meet the upgraded CoolClient backdoor, now armed with a signed Windows rootkit that lets it hide in plain sight, and a closer look reveals it's linked to the notorious HoneyMyte threat group, aka Mustang Panda. This sneaky malware has been targeting victims in Myanmar, Mongolia, Pakistan, and more.
To truly achieve IAM compliance, it's not enough to just have policies in place - you need to prove that they're being enforced. The real challenge lies in bridging the gap between policy intent and actual runtime execution, where compliance failures and unmanaged access often hide.
Hackers are exploiting "dropcatch domains" - previously owned domains that are re-registered by new owners - to redirect traffic to scams and malware, taking advantage of the reputation and connections they inherit from their past life. With nearly one in five new domain registrations being a re-registration of an expired name, the threat is more widespread than you might think.
Apple just released emergency updates to fix a critical flaw in macOS Screen Sharing that hackers were using to secretly install Monero miners on vulnerable Macs. The updates, available for macOS Tahoe, Sequoia, and Sonoma, patch a vulnerability that allowed attackers to bypass authentication and gain unauthorized access.
SAP Commerce Cloud has a critical vulnerability, known as CVE-2026-58231, that allows unauthenticated attackers to wreak havoc by executing arbitrary code and compromising internal components. This maximum-severity flaw, scoring a perfect 10.0 on the CVSS scale, stems from weak authorization checks and input validation.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
A China-linked APT group has been exploiting a recently patched VMware vCenter vulnerability to deploy ransomware in a widespread campaign that hit 361 victims across 47 countries. The attackers used the flaw to gain root access and, in some cases, installed a Babuk-derived ransomware that locks files with a ".babyk" extension.
Don't worry, SafePal has confirmed that sensitive info like your seed phrase, private keys, and bank account details were not compromised in the breach that exposed the order info of 39,798 customers. The exposed data includes names, email and shipping addresses, phone numbers, and purchase details of customers who placed orders between March 2025 and April 2026.
Meet Evooo1Bot, a sneaky new Linux botnet that's been quietly hijacking edge devices since July 2026, turning them into SOCKS5 proxies by exploiting known vulnerabilities. This cunning botnet is built on the Mirai codebase, but with a range of upgraded capabilities that make it a formidable foe.
A threat actor known as ZeroBytes has claimed access to sensitive French tax authority systems, boasting on a hacking forum that they could sell stolen databases containing data on hundreds of thousands of individuals. The alarming post sparked a swift response from French authorities, who disclosed a massive breach affecting over 678,000 people.
Microsoft's patching cycle has reached a fever pitch, with a record-breaking 600+ Windows security fixes released in July - a massive surge from the 60-90 fixes per month seen last year. This AI-driven deluge of bug fixes is swiftly resolving issues, but also raises concerns about potential side effects and strain on testing and deployment.
Microsoft is racing against the clock to patch a zero-day vulnerability in Defender, known as ShieldBreak, that's being exploited in the wild. The tech giant is working on a high-quality security update to address the elevation of privilege issue in the Microsoft Malware Protection Engine.
Cybercriminals have supercharged their credential-harvesting capabilities, with infostealer malware infecting 7.4 million devices and snagging a staggering 1.7 billion credentials in just six short months. This automated threat landscape redefines the speed and scale of a breach.
Meet GLM-5.3, Zhipu's groundbreaking AI model that's changing the game in vulnerability discovery, outperforming top Western systems and uncovering 2,436 vulnerabilities across 269 projects. This cutting-edge tech is proving to be a powerful tool in the fight against cyber threats.