[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongCybersecurity
General cybersecurity news and analysis
Magento Exclusive: Critical Flaw Hits 250+ Stores Overnight
A single flaw prompted 250+ attack attempts against Magento-based stores in just 24 hours, forcing merchants to weigh sales against safety. Adobe’s emergency patches — plus quick steps like MFA and session token rotation — need to be applied now to stop fraud, skimming, and account takeovers.
Jingle Thief Exclusive: Alarming Gift Card Theft
Think gift cards are harmless holiday fun? Jingle Thief uses simple phishing and cloud misconfigurations to siphon stored value from retailers, turning promos into cash for criminals — shoppers and merchants need to wake up and tighten defenses.
Jingle Thief Exclusive: Costly Cloud Hack Steals Millions
Imagine criminals turning your retailer’s cloud into a holiday ATM—Unit 42 warns the Jingle Thief gang uses phishing and smishing to steal credentials and exploit misconfigured cloud systems to issue and redeem millions in gift cards. Stronger identity controls, logging and vendor oversight are urgent fixes before consumers and merchants are left cleaning up the mess.
Lanscope Endpoint Manager Exclusive Critical Bug Alert
If you use Lanscope Endpoint Manager, treat this as urgent—CISA has added CVE-2025-61932 to its Known Exploited Vulnerabilities list and says it’s being actively exploited. Act now: inventory on‑prem Clients, apply patches or mitigations, tighten admin access, and hunt for signs of compromise.
Magento Exclusive: Critical Hack Hits 250+ Stores Overnight
If you run Magento Open Source, update now — a critical CVE-2025-54236 flaw has been weaponized and saw exploitation attempts against 250+ stores, letting attackers hijack sessions, execute code, or install skimmers. This emergency forces merchants to balance urgent patching with the real risk of breaking live sites—learn how to protect your store without losing sales.
Lanscope Endpoint Manager Exclusive: Critical Bug Exploited
A critical, actively exploited flaw in Motex Lanscope Endpoint Manager (CVE-2025-61932) — now on CISA’s KEV list — can turn your endpoint manager into an attacker’s shortcut. If you run on‑prem Lanscope Client, act now: patch immediately, isolate affected hosts, and hunt for suspicious activity.
Ukraine Aid Groups Hit by Exclusive Fake Zoom PDF Attacks
Who do you trust when the envelope itself is the weapon? A campaign called PhantomCaptcha disguised malware inside a Zoom-related PDF, giving attackers stealthy, long-term access to Ukraine aid groups and risking donor data, credentials and field operations.
MPs urge tech measures to halt Britain’s phone theft wave
Imagine the phone in your pocket becoming instantly useless the moment it’s stolen — MPs want manufacturers to build standardised kill‑switches and anti‑reset tech so thieves can’t profit and victims don’t lose access to banking and ID.
3 Urgent Challenges for Modern C2 Centers
The war in Ukraine turned a once-hypothetical risk into a harsh reality: modern C2 centers must now urgently sustain resilient communications in contested electromagnetic and cyber environments, turn massive data flows into fast, trusted decisions, and deliver secure, seamless interoperability across coalitions and diverse systems.
Mermaid exploit in Microsoft 365 Copilot steals user data
What if your AI assistant could be quietly coaxed into handing over secrets? Researchers used a clever Mermaid prompt-injection to make Microsoft 365 Copilot leak tenant data — Microsoft patched the flaw, but it’s a wake-up call to lock down defenses like phishing-resistant MFA, least-privilege access, and stronger monitoring.
Digital ID now targets personal data, not illegal work
When a government pivots a digital ID from an anti-illegal-work tool to a convenience, citizens are left asking who — and what — it really protects. Slogans won’t fix the real risks: mission creep, exclusion, and centralised personal-data vulnerabilities that only careful design and legal limits can address.
Kryptos Part Four: Inside the Unsolved Cipher
Who owns an unsolved riddle — the artist, the public, or the stranger who now holds the clues? Two researchers say they found Kryptos’s elusive fourth passage in Jim Sanborn’s archived notes, now headed to auction, touching off a legal and cultural tug-of-war over the sculpture’s final secret.
Inside Europe’s Race to Build a Drone Wall
Europe is racing to build a drone wall — not of stone but of sensors, software and beams of light — to blunt swarms of cheap, lethal drones made painfully real over Kyiv and Kharkiv. A patchwork of emergency programs, private innovation and military improvisation is rethinking air defenses for a world where small, smart, low‑cost unmanned aircraft can swarm, loiter and strike with impunity.
Inside Europe’s Crash Effort to Build a Drone Wall
Europe is racing to build a continent-wide drone wall — a web of sensors, shooters and networks meant to stop cheap, weaponized UAVs before they rewrite war and everyday life. But stitching together tech, laws and privacy across borders while adversaries adapt has turned it into a high-stakes, make-or-break experiment.
A-PNT: Essential for USV Maritime Mission Success
When GPS goes dark or is spoofed, USVs can’t rely on lookouts — they need Assured PNT. By fusing multi‑GNSS, inertial navigation and real‑time anomaly detection, A‑PNT keeps unmanned vessels safe and mission‑capable in contested seas.
Upcoming Speaking Engagements: Schedule and Key Takeaways
How do you change a system that amplifies its own noise? Join Bruce Schneier and Nathan E. Sanders on Oct 22–23, 2025 as they turn insights from Rewiring Democracy into practical prescriptions across three public events — a policy talk at Harvard’s Ash Center, a community conversation and book signing at Cambridge Public Library, and a wide-ranging virtual session with Data & Society.
[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Trump Administration Expands Social Media Surveillance
Heads up: the Trump administration is using AI to scan public social media posts by noncitizens and feed algorithmic flags into visa‑revocation decisions. What began as quiet open‑source monitoring has become a high‑stakes tool that can cost people their legal status.
Report: Staff Burnout Now Top Organizational Threat
A new Security Magazine–backed report finds burnout—not malware or tech gaps—is now the top security threat, because exhausted teams mean slower detection, more mistakes, and fragile defenses. Leaders must treat workforce resilience as a core security control, not an HR afterthought.
Aisuru Botnet Blankets US ISPs in Record DDoS
Imagine a DDoS so huge it’s powered by the smart gadgets in your own living room — the Aisuru botnet corralled compromised IoT devices across AT&T, Comcast and Verizon to unleash nearly 30 trillion bits per second. That surge forced ISPs into an impossible choice—risk network collapse or sever millions of customers—so defenders had to rely on slow, surgical fixes instead of blunt blocks.
Securing Critical Infrastructure With Limited Funding
Budget shortfalls don’t have to mean crippling risk — prioritize high-impact, low-cost defenses like accurate asset inventories, basic OT/IT segmentation, strong access controls, and practiced incident plans to get the biggest security gains per dollar.
Unified IT, Continuity & Security Make or Break Crisis Response
When an alarm sounds, fragmented teams and competing playbooks can turn a single incident into a drawn-out crisis — and with fast-moving adversaries and complex cloud and supply chains, partial visibility just won’t cut it. The solution isn’t only better tools; it’s aligning people, processes and decision authority with shared metrics and rehearsed runbooks so responses are fast, coordinated and accountable.
145,000 Healthcare Records Exposed in Cyberattack
About 145,000 patient records — including names, contacts and treatment notes — were left accessible online after a misconfigured cloud database, showing how a small error can expose intimate health details and invite fraud, embarrassment and legal trouble. This isn’t a cinematic hack; it’s a blunt reminder that secure-by-default cloud settings, strong access controls and encryption are essential to protect patient privacy.
3 Steps to Tighten Security for Cybersecurity Month
This Cybersecurity Awareness Month, forget flashy purchases and run a short, disciplined campaign to fix the basics: tighten identity and access controls, prioritize vulnerability management and attack‑surface reduction, and rehearse detection and response — small, focused moves that stop most breaches. Start now and turn playbooks into muscle memory before the next incident.
5M Auto Insurance Records Exposed, Customers at Risk
What if your car insurance records were sitting unprotected online? For more than 5 million policyholders, that’s exactly what happened when a password-free auto-insurance database exposed names, policy numbers, VINs and claims details — creating prime targets for fraud, identity theft and social-engineering attacks.