General cybersecurity news and analysis
One compromised password toppled KNP Logistics after 158 years, a wake-up call that even the most storied businesses can be undone by weak cyber hygiene — adopt MFA, segmentation and tested recovery plans before it’s too late.
The Secret Service just shut down a massive SIM farm—300+ servers and roughly 100,000 SIM cards—that officials say could have crippled New York’s cellular network during the UN General Assembly, a stark wake-up call that ordinary tech can be weaponized at city scale.
Seven campaign groups are urging Keir Starmer to abandon a planned mandatory digital ID, warning it could fuel surveillance, exclusion and data breaches that leave vulnerable people shut out of essential services. Ministers say it’s needed to curb illegal migration, but critics argue the rushed move breaks pre-election promises and concentrates sensitive data with risky consequences.
A cyberattack has halted Jaguar Land Rover’s production and sparked urgent questions in Westminster about whether the government should step in to protect a strategic employer and its fragile supply chain. With plants paused, suppliers at risk and MPs demanding answers, this incident could reshape how Britain protects its critical industries from digital shocks.
Days before the UN General Assembly, New York authorities seized sophisticated gear that could disable cell towers and trigger citywide outages. The high-profile bust is a wake-up call about how fragile our wireless networks are—and why cities must balance security, research freedom, and public safety.
Last year’s GeoServer exploit that breached an unnamed federal agency turned CISA’s mantra assume breach into a wake-up call — proving how quickly widely used open-source tools can become a systemic risk unless agencies speed up patching, segment networks, and shore up visibility.
A newly spotted SSRF flaw in Pandoc (CVE-2025-51591) is being abused to trick EC2 instances into handing over AWS IMDS tokens and temporary credentials, letting attackers steal keys and pivot across cloud accounts. If you run Pandoc in build pipelines or servers, inventory instances, patch or block metadata access, and enable IMDSv2 now to stop casual credential theft.
A newly patched command-injection flaw in Libraesva’s Email Security Gateway was reportedly exploited by state-sponsored actors, putting email perimeters at risk of lateral movement and data theft. If you run ESG, update immediately, segment management interfaces, and hunt for signs of compromise.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
If a familiar voice can be faked, you can’t rely on phone calls alone—recent research shows deepfake calls are already hitting nearly half of businesses. Start using multi‑channel verification, stronger technical checks, and regular staff training now to stop convincing scams before they cost you money and trust.
If you manage SonicWall SMA 100 appliances, apply the urgent firmware update now — it removes a boot-level rootkit and you should follow SonicWall’s remediation checklist, validate device integrity, and rotate any exposed credentials.
The Air Force’s Cloud One shows how CSP diversity can turn vendor lock-in into resilience, speed, and mission-fit—letting developers choose the best environment while keeping security and operations consistent. That flexibility pays off only with disciplined governance, shared tooling, and a culture that treats interoperability and observability as nonnegotiable.
SolarWinds has released a third hotfix for a critical CVSS 9.8 RCE in Web Help Desk, forcing admins to weigh urgent patching against potential operational disruption. Verify your version, apply the hotfix, and isolate helpdesk services now to shrink the attack window.
Imagine any app reading your texts — that’s the risk OnePlus users face after Rapid7 revealed a critical flaw letting unprivileged apps access SMS/MMS, a bug the company reportedly knew about but hasn’t fully fixed for over three years. How safe is your phone if authentication codes and private conversations can be siphoned silently?
The Secret Service dismantled a 300‑server SIM farm around NYC that ran hundreds of thousands of SIMs and, investigators warn, could have weaponized the city’s cellular network for fraud, harassment, or outages. It’s a sharp reminder to move beyond SMS-based security and for carriers to tighten SIM controls before the next attack.
The OpenSSF warns that the critical infrastructure powering npm, PyPI and other registries is underfunded and increasingly vulnerable—if we don’t invest now, supply‑chain attacks and outages will be far costlier later. It’s time for governments, companies, and the community to share the bill and make the software plumbing resilient.
When familiar voices and faces can be perfectly faked, trust — and your business — is suddenly vulnerable. With Gartner reporting 62% of organizations hit by a deepfake attack in the past year, now’s the time to tighten verification, train teams, and plan responses before reputations and finances are damaged.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
A recent wave of phishing and malware-laced npm packages has pushed GitHub to tighten registry security—introducing mandatory 2FA for popular maintainers, trusted publishing rules, and sweeping takedowns—to stop attackers from slipping malicious updates into countless JavaScript projects. These changes aim to make the ecosystem safer without losing the openness that powers modern development.
AI’s power to boost productivity is now drawing attackers to the hardware, APIs and networks that support it, creating practical risks beyond model accuracy. Organizations that treat security as an afterthought must act now—hardening firmware, clamping down on APIs and improving observability—before vulnerabilities turn into costly breaches.
Oracle will host U.S. TikTok data on American servers — a move pitched as a security-first fix to ease fears about Chinese access, but skeptics worry it could be more paper shield than real protection. The deal’s success will hinge on strong cryptographic controls, independent audits and transparent oversight, not just where the servers sit.
SolarWinds has issued hotfixes for a critical RCE (CVE-2025-26399) in Web Help Desk—if left unpatched attackers could run arbitrary commands on affected systems. Act now: find exposed instances, apply the hotfix immediately, and review logs for any signs of compromise.
Attackers now break out in a median of just 18 minutes, not hours, so organizations must embrace zero-trust, strong identity controls, segmentation and automated detection to stop breaches before they can spread.
An EV charging provider warned some customers that a third‑party security incident may have exposed names and email addresses — a reminder that the clean‑tech convenience we love can still leave personal data vulnerable. Stay alert for phishing, enable MFA where you can, and expect the industry to tighten vendor security as it responds.
A Las Vegas teen surrendered this week in connection with the 2023 Scattered Spider attacks that disrupted casino networks and reportedly caused millions in damage, prompting fresh questions about how minors acquire the skills to hit high-value targets and how justice should respond. The arrest spotlights worrying cybersecurity gaps in the industry and the urgent need to channel youthful technical talent into lawful paths.
Scattered Spider is skipping the fences and walking through the front door by exploiting weak identity controls, help‑desk processes, and third‑party trust. Tightening phishing‑resistant authentication, enforcing least privilege, and hardening vendor and support workflows are the urgent, practical steps every organization must take.