[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentIntelligence Briefing
Latest Analysis
Cybersecurity intelligence, threat analysis, and national security reporting.
F-15EX Pairs with Ghost Bat Drone in Valiant Shield Exercise
In a groundbreaking display of innovation, a U.S. Air Force F-15EX Eagle II teamed up with the cutting-edge MQ-28 Ghost Bat drone in a thrilling exercise over the Philippine Sea. This powerful partnership is set to revolutionize the future of human-machine teaming.
Taiwan's Drone Industry Sparks Defense Spending Showdown
Taiwan's ruling party is pushing for a NT$210 million budget to supercharge its drone industry with 208,200 coastal attack drones and over 3,000 other unmanned systems, but opposition parties are fiercely resisting, warning that backing down would be political suicide. The contentious spending plan has sparked a heated showdown over Taiwan's defense strategy.
Trump Grants Pulte Broad Declassification Authority, Sparking National Security Fears
President Trump just gave acting Director of National Intelligence Bill Pulte a surprising green light to declassify almost anything during his short-term stint, sparking concerns about national security. This move allows Pulte to release classified records at an unprecedented pace, with minimal oversight.
US Space Force Faces Looming Legal Gaps in Orbital Warfare
The US Space Force is facing a critical gap in its ability to navigate the complexities of orbital warfare, with a glaring lack of specialized space law expertise and infrastructure. The Senate Armed Services Committee has taken notice, ordering a review of the Defense Department's space law requirements and options for establishing a dedicated legal team.
US Navy Explores Alternatives to AARGM-ER Missile
The US Navy is proactively exploring alternatives to the AARGM-ER missile, issuing a fresh request for information to find an equivalent missile system that can meet its advanced needs. This move comes as the Navy pauses AARGM-ER procurements to validate the system's testing and software updates.
Pentagon Rushes to Commit $126 Billion Before Fiscal Year Deadline
The Pentagon is racing against the clock to commit a whopping $126 billion before September 30, or risk losing some of those funds to an automatic 8.3 percent cut. With only $26 billion already on contract, time is running out to tap into the $152 billion pot from 2025 reconciliation legislation.
Kaspersky Compromise Assessments Reveal Persistent Detection Gaps
Kaspersky's 2025 Compromise Assessment analysis reveals a shocking truth: 60% of incidents go undetected due to a lack of reliable alerts from existing tools, while manual detection accounts for only 20% of discovered threats. This blind spot allows threats to hide for alarmingly long periods, with 30.8% of incidents having a dwell time of over three months.
Italy Pursues Indo-Pacific Influence Through Defense Contracts
Italy is making a strategic play for influence in the Indo-Pacific, quietly building momentum through defense contracts, naval cooperation, and industrial partnerships. Can Rome turn commercial success into lasting strategic clout in the region?
FortiBleed exposes link between ransomware gangs
A major breakthrough in the fight against ransomware has been uncovered, revealing a direct link between ransomware gangs and the recent FortiBleed attack. Researchers have found a single operator working with multiple ransomware groups, using infrastructure tied to FortiBleed.
Card Data Theft Exposes Persistent US Consumer Vulnerability
Nearly half of US consumers are on high alert for card data theft, naming it their top fraud worry. A recent Capco survey found 46% of respondents citing card and card data theft as their biggest concern, beating out identity theft and other financial security threats.
AI Compute Hijacking Exposes New Security Risks
A shocking 62,289 devices have fallen prey to the Millenium RAT, a malicious threat that's being spread through clever social engineering tactics and sold as a cheap, subscription-based service on the dark web. This alarming infection rate highlights the growing risk of small, seemingly harmless actions becoming gateways to devastating cyber attacks.
EU Court Upholds $4.7 Billion Google Antitrust Fine
Google's last-ditch effort to overturn a $4.7 billion antitrust fine has been rejected by the EU's top court, affirming that the company's Android agreements did indeed stifle competition. The Court of Justice of the European Union dismissed Google's appeal, upholding the hefty penalty.
CISA Flags SharePoint Flaw as Exploitable
Microsoft initially downplayed the risk of a SharePoint vulnerability, saying exploitation was less likely, but the Cybersecurity and Infrastructure Security Agency has since escalated the flaw to its list of known exploited vulnerabilities. This move signals a heightened sense of urgency for organizations to address the potentially critical issue.
Microsoft 365 Accounts Targeted in 3-Second Hijacking Attacks
Beware of a sneaky 3-second hack that can hijack your Microsoft 365 account with just a click - it starts with a harmless-looking link that tricks you into executing the attack yourself. This clever tactic, known as ClickFix, exploits a simple human reflex to gain control of your account.
Researcher Releases Zero-Day Exploits, Bypassing Disclosure Norms
A pseudonymous security researcher, known as "bikini," has made a bold move by releasing over 30 proof-of-concept exploits for zero-day vulnerabilities in open-source projects, sparking both interest and concern in the cybersecurity community. The researcher behind the Exploitarium GitHub repository is urging users to explore these vulnerabilities for research purposes only.
Medtronic Breach Exposes Patient Health Data to Cybercrooks
Medtronic is alerting patients that their personal and health information may have been compromised in a recent data breach, but has reassured them that the incident didn't impact the safe operation of its medical devices. The breach, detected on April 15, occurred between April 13 and 19, and Medtronic is now notifying affected individuals.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
ToddyCat APT Exploits OAuth to Breach Gmail via Google API
Meet ToddyCat, a sneaky APT group that's been exploiting OAuth and the Google API to secretly breach corporate Gmail accounts since 2020. Their latest trick involves a cunning malware called Umbrij, which lets them hijack email communications with ease.
India Warns WhatsApp Over Username Rollout Citing Security Risks
India's Ministry of Electronics and Information Technology has warned WhatsApp to halt its global rollout of a new usernames feature, citing security risks, and given the Meta-owned platform just three days to respond. The move has sparked concerns over regulatory action and the protection of user data.
Identity Lifecycle Management Struggles to Govern AI Agents
Traditional identity lifecycle management systems were designed with humans in mind, relying on HR data to dictate access and permissions. But with AI agents on the rise, this approach is no longer enough.
Ransomware Attacks Targeted via Fake Interpol Emails
Beware of fake Interpol emails that could be ransomware traps! Cybercriminals are impersonating the law enforcement agency, sending unsolicited emails with suspicious links and password-protected files, trying to trick organizations into compromising their security.
Microsoft Resolves Outlook Copilot Button Glitch with Service Update
Microsoft has fixed a frustrating glitch in Classic Outlook that caused the Copilot button to vanish for some users, and the solution was rolled out as a service update on June 29, 2026. The update restored access to Copilot features, which were still available through other Microsoft 365 entry points.
Cisco Confirms Active Exploitation of Unified CM Flaw
Over 200 Cisco Unified Communications Manager instances are vulnerable to a remotely exploitable flaw, CVE-2026-20230, which allows low-complexity server-side request forgery attacks with a simple crafted HTTP request. This critical vulnerability puts widely used IP telephony systems at risk, particularly in Asia and North America.
Opera Introduces Paste Protect to Thwart ClickFix Attacks
Opera's new Paste Protect feature helps keep you safe from sneaky ClickFix attacks by automatically blocking suspicious copy actions that could land malware on your device. This clever tool outsmarts scammers who try to trick you into pasting malicious commands, protecting you from unwanted surprises.
CISA Warns of Active Exploits of Microsoft SharePoint Flaw
Microsoft warns that a critical flaw in SharePoint, tracked as CVE-2026-45659, is being actively exploited, allowing even low-privilege attackers to execute arbitrary code remotely with ease. This deserialization vulnerability lets authenticated attackers run code on vulnerable servers without needing admin privileges.