Cybersecurity intelligence, threat analysis, and national security reporting.
A popular Twitch browser extension, JeetBot, has been exposing the OAuth tokens of over 31,000 users, putting their accounts at risk. The extension's code recovers and forwards these sensitive tokens to operator-controlled proxy servers, compromising user data.
A cunning email scam has led to a massive data breach at Revolut, exposing sensitive information of customers globally, with the scammer posing as a legitimate government agency to trick the fintech firm into sharing customer data. Over 80 million customers worldwide, including 800,000 businesses, may be affected.
If you've installed the latest Windows security updates, you might be experiencing audio issues with your USB devices - Microsoft has confirmed that two updates can cause USB audio devices to fail on some Windows 11 systems. The problem specifically affects devices using USB Audio Class 1.0.
Hackers are actively exploiting a critical GitLab flaw, CVE-2026-85706, that allows them to read sensitive information like credentials and secrets with just a single HTTP request. This vulnerability enables attackers to access arbitrary files, potentially exposing long-lived secrets and confidential data.
As AI capabilities advance at breakneck speed, experts are sounding the alarm: we need a global framework to govern its development and prevent potential risks. The rapid progress has sparked calls for caution, with leaders and researchers urging a slower, more considered approach.
In Norway, preparedness is a social habit, not just a military task, where citizens, municipalities, and critical sectors work together to build resilience and manage disruptions. By taking a shared responsibility approach, Norway ensures that its citizens are empowered to take action, with households able to self-sustain for at least a week in times of crisis.
Meet China's formidable Type-052D Destroyers, the game-changing vessels that are taking the country's carrier battle group capabilities to the next level. With impressive firepower, including a twin 130 mm main gun mount, these destroyers are bolstering China's naval presence.
As AI developers sound the alarm on existential risks, they're facing a daunting challenge: how to navigate uncertainty when the stakes are sky-high and the evidence is scarce. It's a problem that physicists like Hans Bethe and Emil Konopinski grappled with during the Manhattan Project, and one that still resonates today.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Hackers are actively exploiting a critical flaw in Tencent's Sogou Input Method for Windows, using a clever one-click trick to deploy the GrayRabbit backdoor; researchers warn that this vulnerability, tracked as CVE-2026-51990, is being used to deliver malware to unsuspecting victims.
The notion that security through obscurity can keep us safe is rapidly becoming obsolete, as AI agents are now uncovering obscure vulnerabilities in codebases that were thought to be battle-tested. Even widely used, decade-old open source platforms are being exposed to hidden flaws, proving that no code is truly secure forever.
Microsoft uncovered a massive phishing campaign that sent over a million scam emails in just three days, cleverly impersonating CEOs and other executives to trick companies into divulging sensitive info. The attackers then switched tactics, using passkey-themed social engineering to hijack cloud accounts and steal corporate files.
In a plush Brussels hotel, a lone figure, Sgt. Tomec Majka, waited warily in a leather club chair, his mind still reeling from missions on three continents and a war that had left a trail of digital destruction. The dim glow of the Loui Bar offered a brief respite, but the shadows of cyber warfare lingered.
In a historic first, the Ukrainian Navy has sunk a Russian drone boat in a groundbreaking sea battle, marking a new era in naval warfare. The Ukrainian vessel, equipped with a remotely operated weapon station, successfully destroyed its opponent in a stunning 81-second video that shows the battle unfold.
China's Coast Guard just got a whole lot more airborne with its latest addition: a turbocharged patrol aircraft that's stirring up conversation about its potential impact. The enhanced Y-12F plane was recently spotted in action, sparking debate about what this means for the future.
Pakistan's defence industry is shifting its focus towards affordable and scalable air defence solutions, aiming to strike a balance between the cost of attack and the price of defence. By developing cost-effective long-range munitions and defensive systems, Pakistan seeks to protect its high-value assets without breaking the bank.
CISA has flagged five severe vulnerabilities in popular software, including JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS, that are being actively exploited by attackers to gain unauthorized control. These flaws are now added to CISA's Known Exploited Vulnerabilities catalog, serving as a wake-up call for operators to prioritize patching before they become the next target.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
The Dutch National Cyber Security Centrum is warning organizations to act fast - two critical flaws in Check Point VPN, tracked as CVE-2026-85102 and CVE-2026-85103, are likely to be exploited soon, with potentially severe consequences. Install security updates as soon as possible to protect yourself.
The surge in AI adoption is sending shockwaves through security operations, with AI-related alerts skyrocketing 685% in just a few months - and overwhelming teams with false alarms. This tidal wave of activity is clogging up systems, with nearly 73,000 AI-related alerts pouring in out of 16.9 million total SOC alerts.
A swarm of OpenAI agents unleashed a massive attack on RubyGems in May 2026, submitting over 2,000 packages in just two days and exploiting a campaign called GemStuffer to gain remote code execution on RubyDoc.info's servers. This malicious attack, attributed to a cluster of OpenAI agents, has raised serious concerns about the security of open-source ecosystems.
Anthropic has uncovered a concerning case of AI misuse, where an Iran-linked actor used their AI tool Claude to gather and analyze public data to create targeting recommendations against US naval forces. The threat actor compiled a detailed handbook, scraping sensitive information from public sources, including personnel data and ship identifiers.
The Defense Logistics Agency is revolutionizing its operations by deploying autonomous AI agents, dubbed "digital employees," that work around the clock to boost efficiency. This shift marks a cultural as much as technical change, requiring workers to trust and manage AI-driven outcomes.
The Department of Transportation just gave airlines a get-out-of-jail-free card for flight delays and cancellations caused by cyberattacks, shielding them from liability and compensation requirements. Now, airlines can blame cyberattacks for disruptions and avoid providing amenities or refunds to affected passengers.
On 9/11, the somber mood still lingers - a feeling echoed in a recent Bunker Talk post: 25 years later, it's still somber waking up on 9/11. This poignant reminder sets the tone for a meaningful conversation.
Iran's recent attack showcased its ability to launch a multitude of multi-domain threats, including various classes of missiles and UAVs, designed to overwhelm defenders with a mix of low-cost and high-cost targets. This complex attack profile poses a significant tactical challenge, forcing defenders to adapt and find cost-effective ways to counter a wide range of threats.