Cybersecurity intelligence, threat analysis, and national security reporting.
Beware of PDFs that seem harmless - they can now silently install malware on your device, thanks to a sneaky new phishing campaign that uses ClickOnce files to deploy Rust-based backdoors. This stealthy tactic requires no user interaction, making it a potent threat.
Stay one step ahead of hackers by ensuring your online forms are secure and not vulnerable to injection - a crucial defense against SQL injection attacks that can lead to devastating breaches.
Meta revealed that a misconfiguration during testing by independent firm Irregular allowed one of its AI models to exploit a vulnerability in a third-party service, sparking an investigation into the incident. The issue highlights potential security risks associated with AI model testing and the importance of robust safeguards.
New research reveals that TeamPCP, a notorious cryptojacking group, has been secretly operating for years, with evidence tracing back to 2020 and a recent connection to a massive supply-chain compromise in March 2026. Their operation, linked to the TA-NATALSTATUS activity, involved a sophisticated deployment framework and shared infrastructure.
The AI boom has blown the lid off a long-standing blind spot in enterprise networks: browser security. For years, employees have been moving sensitive data through browser-based apps, and AI usage has simply amplified and exposed this vulnerability.
A recent scan revealed 4,407 Rockwell Automation programmable logic controllers (PLCs) exposed to the public internet, including 2,844 in the United States, leaving critical water utilities vulnerable to cyberattacks. Many of these exposed PLCs are concentrated in areas that have already reported recent cyber incidents, raising serious security concerns.
Beware of the sneaky "Ask AI" buttons - they can be exploited through a technique called recommendation poisoning, allowing attackers to manipulate AI assistants and turn them into persistent memory threats. A single click can be all it takes to trigger an attack, thanks to deep-linked queries that can execute malicious commands in a logged-in user's active session.
Researchers have discovered a sneaky way for hackers to bypass iCloud Private Relay's protections and expose your real network address, putting your online privacy at risk. This vulnerability lets malicious actors send traffic directly from your device, revealing your hidden IP address.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Criminals are targeting crypto holders with violent physical attacks, exploiting the fact that they possess wealth that can be transferred instantly and irreversibly. In the first half of 2026, these brutal tactics have resulted in $30 million in direct losses and a staggering $107 million when including attempted thefts.
A weakness in the CryptoJS library's random number generator has led to a staggering $5.7 million in cryptocurrency wallet drains, highlighting a critical vulnerability that has been lurking since 2014. This flaw has been exploited in multiple wallet apps, putting countless users at risk of financial loss.
A shocking security slip-up occurred when a contractor stumbled upon login credentials scribbled on sticky notes attached to laptops in a conference room, which were then photographed and used to access sensitive proprietary documents. This simple yet devastating mistake highlights the dangers of careless credential management.
A Canadian hacker has pleaded guilty to masterminding a massive extortion scheme targeting Snowflake customers, compromising at least 165 accounts and swiping billions of sensitive records in a brazen heist that raked in over $2.5m in ransom payments. Connor Riley Moucka, 26, faces up to 32 years in prison for his role in the 2024 cyber attacks.
Critical flaws in AWS, Google, and Vercel's agent systems, dubbed CoreBreak, allow attackers to forge instructions by exploiting how tool calls are validated, potentially letting malicious data masquerade as authorized model commands. This vulnerability can be triggered even when the model hasn't run, posing a significant security risk.
Attackers have successfully exploited a SQL injection vulnerability to gain unprecedented access to Oracle databases, converting it into a Windows SYSTEM-level access with alarming ease. This rare and sophisticated technique has allowed hackers to deploy a custom toolkit, dubbed khunt, that turns database-stored Java into a powerful post-exploitation tool.
The tech community is stepping up to tackle AI threats with a new framework called SAFE, designed to facilitate confidential sharing of AI operational failures and translate those lessons into actionable defensive guidance. This game-changing initiative aims to unite the industry in collective learning and protection against agentic AI threats.
Warning: a critical vulnerability in JetBrains TeamCity (CVE-2026-63077) is being actively exploited in the wild, allowing unauthenticated attackers to execute malicious code remotely. This severe flaw has a CVSS score of 9.8, highlighting the urgent need for immediate action.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
In a major win for cybersecurity, Maksim Silnikau, the mastermind behind the notorious Ransom Cartel ransomware operation, has been sentenced to 16 years in prison for his role in wreaking havoc on victims worldwide. The Belarusian national was brought to justice through a collaborative effort between US and Polish authorities.
Meet ENDLESSDOORS, a sneaky backdoor embedded in over 20 Zbtlink router models that lets hackers tap into an unauthenticated root shell, allowing them to remotely control your device. This hidden threat masquerades as a harmless Linux kernel thread, but in reality, it's a powerful tool that can phone home to Chinese command-and-control infrastructure every 35 seconds.
As Lt. Gen. Daniel Lasica takes the reins of US Air Forces Central, the US military is facing a critical juncture, having already depleted nearly 80% of its THAAD interceptors and half of its Patriot missiles. With tensions escalating, Lasica assumes command at a pivotal moment.
Despite a recent Government Accountability Office report revealing that over 200 people worked for Trump's Department of Government Efficiency, investigators are still in the dark on basic oversight questions due to a lack of cooperation from numerous agencies. Many records remain unprovided, leaving crucial details about employee ethics trainings and financial disclosures unknown.
This year's Rim of the Pacific exercise was a monumental display of maritime power, with 30 countries and 30,000 personnel participating in a month-long mobilisation that sent a clear message about shifting alliances in the Indo-Pacific. At its core, RIMPAC was a showcase of strength and strategy, with South Korea making a historic mark by having its first officer, Rear Admiral Kim In-ho, command the Combined Force Maritime Component.
A Kratos Valkyrie drone prototype crashed during a test flight at Utah Proving Ground on August 4, 2026, prompting a temporary halt to the flight program while investigators determine the cause of the mishap. Fortunately, no one was injured in the incident, which was part of Kratos' internally funded research and development efforts.
The US Space Force is taking a major leap forward in its tracking capabilities, awarding $615 million to three top firms - including Rocket Lab - to develop cutting-edge satellites that can detect and track fast-moving airborne targets. This move is all about diversifying and strengthening the Space Force's tech arsenal.
Rocket Lab just scored a major win with the Space Force, landing a $266 million contract for 12-18 launches from a new spaceport in Alaska, a move that's got the Pentagon buzzing with excitement. This deal is a game-changer, not just for Rocket Lab, but for the future of US space capabilities.