Cybersecurity intelligence, threat analysis, and national security reporting.
Democratic lawmakers are raising red flags over a $620 million Pentagon loan to Vulcan Elements, a small North Carolina startup, after it emerged that a top White House aide, and friend of Trump Jr., intervened to secure the deal. The loan has sparked questions about favoritism and undue influence at the highest levels.
The language used in cybersecurity can be a major turn-off, as one panelist discovered when a high school student sniggered at the term "penetration tester" - a reaction that sparked a thought-provoking question about who this language invites into the field, and who it inadvertently shuts out. This moment highlights a broader cultural issue in cybersecurity's approach to attracting new talent.
China has just revealed a massive, futuristic submarine without a traditional sail, sparking curiosity among naval enthusiasts and experts. This sleek, 394-foot-long vessel is taking shape at the JN Shipyard in Shanghai.
The US Air Force has chosen GE Aerospace and Rolls-Royce to develop engine designs for its Medium Thrust Class Autonomous Collaborative Platforms, a key step in expanding propulsion options for unmanned systems. This move is set to accelerate innovation in drone technology.
Behind the scenes of cheap streaming deals, complex crime networks are at work - but thanks to Operation Kratos 2, 29 alleged cybercriminals have been arrested and nine organized crime groups dismantled. This major crackdown on illegal streaming networks marks a huge win for European law enforcement.
Cyberattacks are no longer just about stealing data - they're now aimed at taking over entire virtual environments, wiping out all data and leaving businesses in a state of digital darkness. The game has changed, and it's time to rethink our approach to resiliency.
Chinese hackers have significantly ramped up cyberattacks in Europe, with a financially motivated group, tracked as TA4922, launching a high volume of unique campaigns targeting countries including Germany, Italy, and the UK. This surge in activity, which began in March, has been marked by unprecedented diversity in tactics and objectives, including fraud, data theft, and network breaches.
A 2-year-old vulnerability in Redis, tracked as CVE-2026-23479, went undetected until a cutting-edge autonomous AI tool uncovered it, revealing a critical remote code execution flaw that had been hiding in plain sight. This shocking discovery highlights the power of AI in uncovering even the most elusive security threats.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
A single line of code, "setIsDebugMode(true)," inadvertently left in multiple Microsoft 365 Android apps, created a gaping security hole that allowed other apps on the same phone to access sensitive account tokens without user permission. This tiny oversight, discovered by Enclave's Yanir Tsarimi and Ofek Levin, exposed users to potential security risks.
Cyber attackers are cleverly using Google's DoubleClick to disguise malicious emails, routing victims through a legitimate domain that often flies under the radar of security tools. By exploiting this trusted platform, hackers can easily trick people into downloading the DesckVB RAT malware.
Researchers have uncovered a shocking weakness in anti-jamming technology, revealing that curved radio beams can outsmart even the most advanced direction-finding defenses. In lab tests, this vulnerability led to disastrous errors, leaving traditional safeguards useless.
Researchers have uncovered a vulnerability in Google Gemini on Android that allows hackers to hijack the assistant using a single hostile notification, no malicious app required. This shocking exploit lets anyone able to push a notification to a device deliver a payload and take control.
Cyber attackers are launching targeted strikes on internet-exposed fuel tank monitoring systems, allowing them to modify and manipulate critical infrastructure. These compromised systems, known as automatic tank gauges, remotely track fuel levels, temperatures, and leaks, making them a prime target for malicious actors.
The US Treasury has sanctioned Nobitex, Iran's largest crypto exchange, and several top executives, citing its role in supporting the regime and processing over 50% of Iranian digital asset inflows. This move is part of a broader effort to crack down on terrorism financing through cryptocurrency.
A home computer on a typical 100Mbps connection can cripple a vulnerable server in mere seconds using a new technique called the HTTP/2 Bomb, which cleverly combines two known weaknesses in HTTP/2 server configurations. This potent attack can be unleashed quickly, leaving servers inaccessible.
The alarming truth is that 91% of organizations are leaving themselves exposed to known threats due to a vulnerability patching lag, with only 9% able to remediate high-severity flaws within a critical 24-hour window. This delay is not just a statistic - it's a recipe for disaster, with organizations that patch more slowly facing significantly higher breach rates.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Florida's top lawman, Attorney General James Uthmeier, is taking a stand against OpenAI and its CEO Sam Altman, alleging the company prioritized profits over safety, putting users at risk. He's filed a civil suit seeking penalties and holding Altman personally accountable for the harm caused to Floridians.
A high-severity Android flaw, CVE-2025-48595, is being actively exploited in targeted attacks, allowing hackers to gain increased privileges without needing any user interaction. This critical vulnerability affects Android 14-16 and has prompted CISA to add it to its list of Known Exploited Vulnerabilities.
A bug hunter's frustrating experience with Microsoft's disclosure process sparked a protest, as Ammar Askar publicly exposed a VS Code flaw that could allow attackers to steal OAuth tokens and access GitHub repositories. Askar's proof-of-concept exploit highlights the vulnerability, which was previously mishandled by Microsoft's security response team.
The Antarctic Treaty, meant to keep the continent out of global conflicts, is showing signs of fraying as geopolitical tensions rise, with recent talks in Hiroshima failing to yield consensus on crucial issues like protecting emperor penguins and regulating tourism. Despite a gathering of over 400 international delegates, key measures were left unadopted, leaving the treaty's future uncertain.
Imagine having 345 days of potential vulnerability, with hackers free to exploit your defenses while you wait for your annual security test. That's the harsh reality of the traditional annual testing model, which leaves your business exposed for nearly 11 months of the year.
As President Trump recently issued an executive order calling on AI companies to voluntarily share their most powerful models with the US government, concerns linger about the lack of concrete safety and security oversight. It's now up to Congress to step in and address the potential risks without stifling innovation or compromising free expression.
Konvu took top spot in the Infosecurity Europe Cyber Startup Award, impressing judges with its innovative solution and beating out four other contenders. CEO Lucas Masson was thrilled, saying it was a huge honor for their solution to resonate with the judges.
The US Marine Corps bid farewell to its iconic AV-8B Harrier II squadron, Marine Attack Squadron 223, in a ceremony at Marine Corps Air Station Cherry Point, marking the end of an era for the legendary jump jet. The Harrier's unique vertical takeoff and landing capabilities made it a staple of Marine aviation for decades.