General cybersecurity news and analysis
Two teenagers have been arrested in the U.K. over last August’s Transport for London outages, with authorities linking them to the Scattered Spider hacking collective. The case highlights how young, tech‑savvy actors can trigger big disruptions—and why public systems, law enforcement and policy must adapt quickly.
MI6’s new Tor portal, Silent Courier, offers step-by-step guidance to help overseas sources contact the agency anonymously — a smart, modern shortcut that could surface lifesaving leads. But putting recruitment on the dark web also sparks tough questions about verification, misuse and source safety.
CISA is warning that threat actors have exploited critical Ivanti EPMM flaws (CVE-2025-4427/4428) to drop stealthy loaders and listeners that give attackers remote control and a wide blast radius. If you manage EPMM, patch now, lock down access and credentials, and start looking for suspicious listener and remote-execution activity before it’s too late.
Google just pushed an emergency Chrome patch for a high‑severity zero‑day being actively exploited — please check your Chrome version and update now. This is the latest in a string of browser flaws that remind users and admins alike to stay vigilant and tighten protections.
SonicWall has taken its cloud backup offline and is urging password resets after attackers accessed stored firewall configuration files — potentially exposing admin accounts, keys, VPN settings and network rules. If you manage SonicWall devices, reset credentials, rotate keys, and audit rules and logs now because those exports can act like a blueprint for targeted attacks.
Imagine the place you trust with your most private health details becoming an unlocked door — more than 850,000 Americans now face that reality after three medical centers had records, billing data, and sensitive clinical notes stolen. This wake-up call shows healthcare systems must strengthen defenses while patients stay alert and protect their information.
Flawless IT support is a frontline lifeline—when VPNs, patches, or helpdesk queues fail, missions falter and lives are at risk. Investing in resilient networks, rapid response, and user-centered tools is essential to keep warfighters safe and effective.
Nearly a year after an August 2024 cyberattack that snarled the Tube, two teenagers have been charged in a case that highlights how fragile modern transit systems can be. The prosecution raises fresh questions about cyber resilience, juvenile culpability and the stakes for everyday commuters.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
One in three Android apps — and over half of iOS apps — are leaking sensitive data through insecure APIs and hardcoded secrets, putting your personal info and company systems at risk. Luckily, with smarter developer practices, better tooling and a few simple precautions, we can close those easy doors before attackers walk through.
CountLoader — a flexible, multi‑version loader now favored by Russian ransomware affiliates and initial access brokers — is being used to deliver dangerous toolsets like Cobalt Strike, AdaptixC2 and PureHVNC. Stay vigilant: layered defenses, behavioral detection, and rapid containment are essential to stop these faster, harder‑to‑detect intrusions.
Cloudflare accidentally DDoSed itself when a single React useEffect in its dashboard created a runaway feedback loop that overloaded internal APIs and even its monitoring tools. It’s a vivid reminder that front‑end bugs, shared control planes, and brittle observability can turn a tiny mistake into a company‑wide outage.
China-backed hackers impersonated a U.S. congressman to snoop on trade deliberations, using tailored spear-phishing to harvest credentials and gain persistent access to policymakers, think tanks and law firms. Proofpoint warns this stealthy campaign undermines trust in policymaking and shows why stronger email defenses, MFA and tighter operational security are urgently needed.
Insight Partners has disclosed a 2024 ransomware breach that exposed personal data for thousands, and the firm is now notifying affected people while hiring forensic experts and tightening defenses. If you were contacted, act quickly — monitor accounts, enable multi-factor authentication, and be wary of suspicious messages to reduce your risk.
With the UK’s NCA now chairing the Five Eyes law‑enforcement group and reportedly zeroing in on the .com domain, investigators and tech companies face tough choices about disrupting crime without breaking the internet — or people’s rights. How that balance is struck will shape both cybercrime fightbacks and the future of a stable, open web.
Think they’d really retired? Scattered Spider quietly retooled and hit a U.S. bank, proving public retirements can be misdirection and that banks must move beyond checklist security to stay ahead.
Imagine a threat hiding inside a photo: the FileFix campaign uses JPG steganography, a PowerShell loader and encrypted EXEs delivered via multilingual phishing to smuggle malware past traditional defenses. Stay cautious with unexpected image attachments and push for content-aware scanning and EDR to catch these layered attacks.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
A trio of critical vulnerabilities in Chaos Mesh means the very tool used to test Kubernetes resilience can be turned into a vector for arbitrary code execution — even in default setups. If you use Chaos Mesh, inventory deployments, apply patches or mitigations, and lock down RBAC and network controls now.
Axiom Space and SpaceBilt want to turn the ISS into a high-speed Orbital Data Center, using optical links to deliver low-latency, secure computing in LEO — but that bold experiment raises big engineering, policy, and end-of-life questions as the station’s future hangs in the balance. Will this be a savvy testbed that jumpstarts commercial orbital infrastructure, or a risky bet tied to a platform with a ticking clock?
The June 6, 2025 cybersecurity executive order sets a clear — and urgent — blueprint for federal CISOs to accelerate zero‑trust, strengthen software supply chains, and tighten incident reporting while juggling legacy systems, budgets and mission continuity. Tune into our podcast briefing for practical steps, expert perspectives, and real-world playbooks to turn the EO from mandate into measurable security.
Colt’s recovery from the August cyberattack is now spilling into late November, leaving many enterprise customers with limited services even as independent testers confirm a key system is secure. The slow, careful restoration highlights the trade-off between getting networks back online fast and making sure they’re truly safe for the businesses that depend on them.
Microsoft just dismantled RaccoonO365, seizing 338 fake login sites that had harvested at least 5,000 Microsoft credentials — a big win that cuts off a major phishing operation and a wake-up call to harden your accounts.
New research shows about one in four UK and US firms have faced data poisoning attempts that corrupt AI training data — a stealthy threat that can make models misbehave, leak sensitive information, or embed persistent backdoors. It’s a wake-up call: protecting AI means treating data integrity as a first-line defense.
A fast‑spreading secret‑stealing worm nicknamed Shai‑Hulud is prowling npm, siphoning hundreds of credentials from developer machines and CI pipelines and turning routine installs into supply‑chain attacks. Act now: rotate exposed tokens, harden CI, and vet dependencies to stop further spread.
UEFI Secure Boot promises stronger boot-time protections for Linux on Arm64, but a fragmented ecosystem of firmware, vendor keys and update practices has left adoption uneven. With better coordination, transparent signing and continued work on shim, U-Boot and EDK II, we can get a reliable, user-friendly Secure Boot story across Arm devices.