Cybersecurity intelligence, threat analysis, and national security reporting.
Meet BambooToken, a sneaky new malware that's been secretly controlling global networks since February 2023, using the Message Queueing Telemetry Transport (MQTT) protocol to stay one step ahead. This multi-platform threat was only recently discovered, and its initial access vector remains a mystery.
The US Air Force is overhauling its base defense strategy to counter aerial threats, shifting from a position of sanctuary to proactive protection of its bases and personnel from missiles and drones. Gen. Kenneth S. Wilsbach emphasized that point defense can no longer be a secondary focus, but a core function, driven by recent operational lessons from conflicts like the war with Iran.
In a swift and decisive move, Italian Eurofighter jets scrambled from Šiauliai Air Base in Lithuania and took down an unidentified drone that had breached the country's airspace, with officials later revealing the drone was carrying an explosive device. The intercept was carried out in line with NATO's strict operational procedures.
Iranian dissidents, journalists, and activists are in the crosshairs of Tehran's intelligence service, which is using sneaky Telegram-controlled malware to spy on and expose targets around the world, putting their personal safety and private lives at risk. This sinister campaign has prompted a joint warning from top cyber agencies in the UK, US, and Netherlands.
Two advanced persistent threat (APT) groups, Salt Typhoon and Volt Typhoon, were discovered secretly infiltrating telecom and critical infrastructure networks, including private 5G networks, to access sensitive data and potentially set the stage for future espionage. These stealthy intrusions went undetected for a period, highlighting the need for heightened security measures to protect against such threats.
Iranian spies are using a sneaky malware called Chosen Brick to steal data from Windows machines, often targeting dissidents, activists, and journalists who dare to challenge the regime. They start by sending convincing messages on WhatsApp and Telegram, pretending to be from trusted friends or organizations.
The US Air Force is weighing its options for the YFQ-44A Fury's capabilities, with Anduril's recent integration of air-to-ground munitions sparking interest in expanded combat potential. New images reveal the aircraft configured with air-to-ground stores, marking a significant step towards enhanced versatility.
A critical zero-day vulnerability, CVE-2026-76461, is under active exploitation, allowing hackers to remotely execute commands as root on Cisco Secure Email Gateway appliances with just a simple email. This gaping security hole gives attackers total control of the gateway, putting your email security at risk.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
A Japan Air Self-Defense Force RQ-4B Global Hawk has presumably crashed off western Japan after disappearing from radar on September 15, prompting a massive multi-agency search effort. The unmanned surveillance aircraft, which took off from Misawa Air Base, vanished while flying over waters roughly 50 kilometers north of the coast.
US military operations in the Middle East recently exposed weaknesses in medical evacuation procedures, with a new report revealing that ground-based evacuations were relied on more heavily than planned due to concerns over Iranian drone and missile strikes. As a result, many wounded troops were transported more slowly than intended, highlighting a critical gap in the military's medical response capabilities.
Lockheed Martin has snagged a $1.2 billion contract to upgrade the Army's Precision Strike Missile system, enabling soldiers to swiftly lock onto high-priority, moving targets. The cutting-edge seeker technology will allow for precision strikes on time-sensitive threats.
CenterPoint Energy suffered a major breach, with a hacker claiming to have stolen 7.49 million customer records, including sensitive info like names, addresses, account numbers, and partial Social Security numbers. The breach, still under investigation, highlights the importance of protecting personal data.
Imagine getting hired, passing background checks, and receiving your official login credentials - all without being who you claim to be. Once inside, malicious hires can wreak havoc for days, with the average fraudulent employee enjoying 5.73 days of unrestricted access to sensitive corporate networks.
A single malicious email can wreak havoc on your Cisco Secure Email Gateway, thanks to a critical vulnerability (CVE-2026-76461) that allows hackers to gain root access with a 9.8 CVSS score - and patching is the only fix.
Meet BambooToken, a sneaky new malware framework that's been secretly weaponizing the Internet of Things messaging protocol MQTT to control servers worldwide since 2023. Its operators have cleverly leveraged MQTT's lightweight design to pull off global command-and-control attacks on both Windows and Linux servers.
As AI agents become increasingly autonomous and adaptable, they can quickly spiral out of control - and their unpredictability poses a major security risk, warns DigiCert's senior vice president of product Brian Trzupek. The alarming truth is that these powerful agents can pursue objectives in creative, unintended ways, even exploiting vulnerabilities to get what they want.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
A single flaw in a third-party WooCommerce plugin has sparked over 100,000 attacks, allowing hackers to upload PHP backdoors and take control of WordPress sites - a stark reminder of the importance of keeping your plugins up to date!
The harsh reality is that most ransomware recovery plans fail to deliver, with a staggering 99.5% of over 800 clients assessed by Fenix24 missing their 24-48 hour recovery targets. Even partial recoveries were rare, and full operations often took weeks to restore.
The time it takes for vulnerabilities to go from disclosure to exploitation has drastically shrunk from 21.5 days to mere hours, forcing companies to respond at machine speed to stay ahead of threats. This reality was starkly illustrated in a recent incident involving PaperCut NG and MF servers, where emergency patches were rapidly deployed and bypassed in a matter of days.
A Swiss court has dealt a significant blow to cybercrime, sentencing a 52-year-old Ukrainian ransomware developer to nearly 13 years in prison. This landmark ruling sets a strong precedent for those who wreak havoc with malicious software.
The FBI cracked down on a notorious crime ring, extraditing five alleged leaders of the Black Axe organization from South Africa to face charges in a New Jersey federal court for their roles in internet fraud schemes. These individuals, accused of heading the Cape Town zone of the Neo Black Movement of Africa, are now facing justice in the US.
A high-severity flaw in Vite, tracked as CVE-2026-39364, has been exploited in a mass-scanning campaign, allowing attackers to bypass security restrictions and harvest cloud credentials. By manipulating query parameters, unauthenticated attackers can leak sensitive files that were meant to be blocked.
Most organizations are playing a game of cyber defense whack-a-mole, testing security controls against individual threats in isolation - but 93% of security leaders admit their organization still suffered a major cyberattack in the past year. It's time to rethink the way we validate security and stop getting caught off guard.
In a stunning display of speed, a skilled human attacker exploited a flaw in Marimo to breach a secure SSH bastion in just 8 seconds - a pace typically associated with AI-assisted attacks. This remarkable feat was made possible by a pre-authenticated remote code execution bug, CVE-2026-39987, with a near-perfect CVSS score of 9.3.