[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentIntelligence Briefing
Latest Analysis
Cybersecurity intelligence, threat analysis, and national security reporting.
Google and Apple Roll Out Cross-Platform RCS Encryption
Big news for messaging security: Apple and Google have just launched a beta rollout of end-to-end encrypted RCS messaging, allowing for more secure conversations between iPhone and Android users worldwide. This update enables encryption by default, marked with a lock icon, and is available to users with supported carriers and devices.
Cybercriminals Leverage ClickFix with PySoxy for Persistent Attacks
Cybercriminals are using a potent combination of ClickFix and PySoxy to launch persistent attacks, with experts warning that their deliberate preparation shows a sinister intent for continued access. This sophisticated tactic allows attackers to survive removal attempts and endpoint blocks, making it a major threat.
TanStack npm packages compromised in cache-poisoning attack
Malicious attackers have launched a lightning-fast cache-poisoning attack on TanStack npm packages, flooding the supply chain with 84 tainted versions loaded with credential theft and disk-wiping code. This six-minute blitz highlights the vulnerability of software supply chains to swift and devastating strikes.
Shai Hulud Campaign Targets Developers with Malicious npm Packages
Malicious actors have unleashed a barrage of 84 tainted versions of popular software packages, cleverly disguising them with legitimate credentials to deceive developers. The Shai Hulud campaign, linked to the TeamPCP threat group, has been wreaking havoc on the software supply chain since September.
Security Teams Lag Behind on Agentic AI Risks
The alarming truth is that agentic AI is already live in many production environments, but security teams are largely in the dark about the risks they're facing. This emerging threat can be categorized into three key areas: coding and productivity agents like Claude Code and GitHub Copilot, vendor-built agents, and custom-built agents.
SAP Patches Critical Flaws in Commerce Cloud and S/4HANA
SAP has patched a critical vulnerability in its Commerce Cloud and S/4HANA systems, warning that hackers could exploit the flaw to upload malicious code and take control of the application. This security gap, caused by a misconfigured Spring Security setup, put sensitive data and system integrity at risk.
Hugging Face Repository Exploits Typosquatting to Spread Infostealer Malware
Security researchers have uncovered a cunning malware attack on Hugging Face, where a fake repository mimicked a popular AI project, racking up over 244,000 downloads and 667 likes in just 18 hours. The malicious repository used a classic typosquatting trick to deceive users searching for the genuine project.
Organizations Fortify Defenses Against Evolving Scattered Spider Threats
As Scattered Spider threats evolve, organizations across finance, healthcare, and telecom are bolstering their defenses against sophisticated identity-driven attacks. They're facing an adaptable adversary that's changing tactics, putting pressure on institutions to respond.
Apple and Google Boost Cross-Platform Messaging with End-to-End Encryption
Say goodbye to the green bubble blues! iPhone and Android users can now send end-to-end encrypted messages to each other, thanks to a game-changing collaboration between Apple and Google.
Mini Shai-Hulud Worm Targets Multiple AI, Dev Packages
Meet the Mini Shai-Hulud worm, a sneaky new malware that's infiltrating AI and development packages through a clever supply-chain attack. This malicious code can steal sensitive data from cloud providers, cryptocurrency wallets, and even popular dev tools like GitHub Actions.
UK Water Firm Fines £1m for 2-Year Data Breach Alternatively: South Staffordshire Water Breach Exposes 633,000 Or: Data Regulator Fines South Staffordshire Water £1m Best option: South Staffordshire Water Hit with £1m Data Breach Fine
Proactive security is no longer a nicety, but a necessity - as South Staffordshire Water's £1m fine for a 2-year data breach exposing 633,000 individuals' personal info painfully illustrates. Waiting for a ransom note or performance issues to discover a breach simply isn't an option.
Instructure Thwarts ShinyHunters Data Leak with Agreement
Instructure has taken swift action to protect its community by reaching an agreement with the ShinyHunters extortion group, successfully retrieving stolen data and ensuring its destruction. This move puts the minds of its 30 million users at ease, prioritizing their security and well-being.
OpenAI Unveils Daybreak to Automate Vulnerability Detection and Patching
Meet Daybreak, a game-changing cybersecurity tool from OpenAI that supercharges vulnerability detection and patching with cutting-edge AI, helping organizations stay one step ahead of attackers and making the world a safer place. By combining AI intelligence with advanced code analysis, Daybreak identifies and fixes vulnerabilities faster than ever before.
Instructure Pays Ransom to ShinyHunters to Prevent 3.65TB Canvas Data Leak
In a stunning move, Instructure paid a ransom to the notorious ShinyHunters group to prevent a massive 3.65TB data leak from its Canvas learning-management system. The Utah-based company reached a deal with the hackers, securing the safe return of stolen data and a guarantee that its customers wouldn't be extorted individually.
Japan Orders Cybersecurity Overhaul to Contain Mythos Threat
Japan's prime minister has launched a urgent cybersecurity review to prevent a potentially catastrophic cyberattack, dubbed "CyberZilla", which could unleash unprecedented scale and speed of digital destruction. The goal is to stop the threat, known as Mythos, from wreaking havoc on the country's digital landscape.
Apple Deploys End-to-End Encryption for RCS Messaging
Big news for messaging security: Apple just rolled out end-to-end encryption for RCS messaging in its latest iOS 26.5 update, giving users an extra layer of protection when chatting with friends and family across different devices and platforms.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Taiwan's Parliament Approves $25 Billion Defense Budget Amid China Tensions
Taiwan's legislature has approved a $25 billion defense budget, a crucial move that comes amid rising tensions with China, with 59 lawmakers voting in favor of the bill despite deep partisan divisions. The approved budget, although smaller than initially proposed, marks a significant step in bolstering Taiwan's defenses.
Russia Fits Patrol Boat with Anti-Drone Cage Amid Growing Threats
Russia has added a game-changing layer of defense to its patrol boats - a multi-tiered "cope cage" designed to protect against drone threats, as seen in a recent photo taken in the Black Sea. This improvised anti-drone shield is the latest upgrade to the Project 21980 Grachonok-class vessels, which have been safeguarding ports and naval installations since 2008.
Turkey's STM Unveils Advanced Unmanned Systems, Seeks Gulf Collaboration
STM is taking unmanned systems to the next level with the unveiling of four new aerial vehicles and an underwater system, with plans to deploy them in powerful swarms. The company's latest innovation, Kuzgun, is a long-range loitering munition with a range of over 1,000 km and a top speed of 180 km/h, sparking huge interest among potential clients.
MQ-9 Reaper Tests Fire Laser-Guided Rockets
General Atomics Aeronautical Systems, Inc. has successfully tested the MQ-9 Reaper's firepower, flawlessly launching laser-guided rockets at various targets, including aerial ones, using a specialized launcher. The live-fire trials, conducted at the Nevada Test and Training Range, mark a significant milestone in the drone's air-to-ground capabilities.
Navy Accelerates Acquisition with New Portfolio Executives
The Navy is speeding up its acquisition process with a bold new approach, appointing three interim portfolio acquisition executives to oversee key areas: Aviation, Mission Systems, and Munitions. This strategic move aims to rapidly deliver cutting-edge solutions to meet the evolving needs of warfighters and stay ahead of emerging threats.
US Weighs Military Action to Secure Iran's Enriched Uranium Stockpile
The US and Israel are pressing for urgent action to secure Iran's highly enriched uranium stockpile, with President Trump revealing that Tehran had initially agreed to let the US remove the material but then abruptly changed its mind. The development has intensified concerns that Iran may be seeking to develop a nuclear weapon.
Pakistan Unveils Fatah-3 Supersonic Cruise Missile
Pakistan has taken a giant leap in its military capabilities with the unveiling of the Fatah-3, a supersonic cruise missile that promises to revolutionize its precision-fire arsenal. This game-changing technology was showcased in a video released by the Inter Services Public Relations, giving us a first glimpse of the missile in action.
Air Force MQ-9 Drone Tests Cheap Air-to-Air Missiles Against Aerial Targets
The Air Force's MQ-9 Reaper drone just proved its mettle in a live demo, successfully taking down aerial targets with the help of laser-guided Advanced Precision Kill Weapon System (APKWS) missiles. This milestone test at the Nevada Test and Training Range brings new firepower to the fight against one-way attack drones.