Cybersecurity intelligence, threat analysis, and national security reporting.
Scientists must sketch a bold, best-case vision for artificial intelligence—one that amplifies human dignity, defends democracy, and shares prosperity instead of enabling deepfakes, surveillance, and exploitation.
Could a handful of bits quietly unravel the trust behind bank logins and encrypted cloud workloads? Researchers uncovered an AMD RNG flaw in Ryzen and EPYC chips that lets local privileged operations weaken key generation—AMD has microcode patches underway, so admins should prioritize updates.
What if the AI meant to amplify our thinking could be turned into thinking robot malware that rewrites itself to hide from defenders? New research shows attackers chaining prompt- and log-injection tricks to weaponize Gemini into self-modifying, persistent surveillance agents that sidestep many standard safeguards.
Which is worse — a day of down tills or a quiet drain on cash and trust? For M&S, Aprils cyberattack did both: systems are back, but a £136m cleanup bill now threatens cash, customer confidence and the retailer’s recovery.
Meet SmudgedSerpent: during the summer 2025 Iran–Israel flare-up a stealthy cyber cluster used precision social engineering to target academics and policy experts. By exploiting researchers’ networks and unpublished work, these attacks show how adversaries now shape information and influence far faster than old‑school espionage.
Claude Desktop extensions make assistants truly useful — but when they execute local actions, attackers can turn innocent prompts into harmful commands. The recent command‑injection flaws in three extensions, now patched by Anthropic, are a reminder that convenience brings new security risks.
Juniper Research predicts an 11% drop in global SMS fraud losses by 2026 — about $9 billion less — good news, but with smishing, SIM farms and brittle phone-number trust still rampant, it may be just the first step in a much bigger fight to secure SMS.
Think the Play Store is safe? Researchers found hundreds of malicious Android apps that slipped past vetting and amassed tens of millions of installs—using hijacked SDKs, repackaged binaries and delayed activation to turn everyday apps into stealthy attack platforms.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
CISA has quietly added Gladinet and Control Web Panel to its Known Exploited Vulnerabilities list after evidence of active attacks. These flaws — including CVE-2025-11371 (CVSS 7.5) — are no longer theoretical and should be prioritized for immediate patching and mitigation.
The Department of Homeland Security is proposing to collect iris scans, facial photos and cheek‑swab DNA from immigration applicants — and in some cases from U.S. citizens linked to those cases. Critics say the invasive move raises serious privacy, security and mission‑creep concerns, especially given the irreversible nature of biometric and genetic data.
Meet Curly COMrades — a spy group that runs a tiny Alpine Linux “shadow OS” inside a hidden Hyper‑V VM on compromised Windows hosts, letting them slip past endpoint tools and quietly harvest data, credentials and long‑term access.
How do you chase money that lives in code and shadows? French investigators and Europol answered with blockchain sleuthing and old‑fashioned detective work — freezing €1.6m and arresting nine suspects in a cross‑border crypto fraud takedown.
Imagine your paycheck landing in a strangers account—criminals are targeting payroll systems with social‑engineering scams that hijack credentials and reroute direct deposits. Simple fixes like multi‑factor authentication, tighter admin privileges, and out‑of‑band approvals can stop them before paychecks disappear.
Imagine your helpful AI assistant secretly moonlighting as a command-and-control courier — researchers found the SesameOp backdoor using OpenAI’s Assistants API to stealthily ferry attacker commands and exfiltrated data. This clever pivot turns trusted productivity integrations into covert channels, forcing a rethink of how we govern and monitor AI tools.
Imagine low‑tech social engineering and SIM swaps teaming up with mass data brokers — that’s Scattered Spider, ShinyHunters and LAPSUS$ fusing tactics to turn bulk theft into pinpoint extortion. Security teams and cloud customers now face a hybrid, high‑leverage threat targeting SaaS platforms like Salesforce.
Get an exclusive look at how the DragonForce Cartel is unleashing the deadly Conti Ransomware—and learn who’s at risk and simple steps you can take to protect yourself.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
A newly revealed Microsoft Teams vulnerability let attackers convincingly impersonate executives, forge messages and even rewrite chat history—turning everyday collaboration into a pathway for fraud and data theft. Learn how Check Point’s findings expose the danger of boss‑spoofing and what organizations need to patch now.
Identity is the single biggest cloud security risk — but with smarter access controls and a few practical fixes, you can shut down the weakest link fast.
Cyber extortion is escalating in worrying ways across Europe: researchers have logged at least 18 cases this year where ransomware threats are paired with physical violence. With average demands topping $200,000 and countries like France and the UK feeling the heat, the risk has shifted from data loss to public safety.
Who guards the guards? A sophisticated Balancer exploit drained over $120 million from the protocol’s liquidity pools, jolting the DeFi community and forcing a hard rethink of how permissionless innovation can survive against fast, well‑resourced attackers.
Googles AI, Big Sleep, exposed five critical security flaws in WebKit — including a buffer‑overflow that could trigger crashes or memory corruption. It’s a stark reminder that AI speeds up vulnerability discovery, shortening the window defenders have to patch Safari’s engine before attackers catch up.
Xi Jinpings offhand joke about Xiaomi backdoors — met with a laugh from South Koreas president — turned a light moment into a diplomatic ripple, reigniting real doubts about device security and supply‑chain vulnerabilities.
MIT Sloan’s withdrawal of a paper claiming 80% of ransomware is AI-driven has ignited a fierce debate—exposing both genuine signs of AI-assisted extortion and the danger of leaping from plausible scenarios to sensational conclusions.
When the ransomware negotiator you trusted to defuse an attack becomes the attacker, the breach of trust is catastrophic. This guide explains what happened, why it matters, and how organizations can guard against insider betrayal.