[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongCybersecurity
General cybersecurity news and analysis
GitLab Exposes Private Email Addresses to Code Push Risks
GitLab's helpful hack for easy bug reporting has turned into a security risk, with researchers discovering that publicly exposed email addresses can be easily manipulated to create unauthorized merge requests. Simply tweaking a few characters in the address can open up a project's inner workings to potential code push risks.
File Notification Flaws Expose System Data Across Major Operating Systems
Major operating systems, including Linux, Android, Windows, and macOS, are vulnerable to file notification flaws that can expose sensitive system data, thanks to decades-old bugs in their file-notification subsystems. These flaws can leak timing and path information about file activity, putting users at risk.
Ubuntu Accelerates Kernel Releases Amid CVE Surge
Canonical is shaking up its Ubuntu kernel release schedule to keep pace with the rapidly evolving threat landscape, introducing overlapping two-week cycles that will allow for weekly kernel releases. This move aims to get security patches and updates to users faster, addressing the surge in Common Vulnerabilities and Exposures (CVEs).
Google Deploys AI Scanners to Bolster Critical Infrastructure Defenses
Google's new Scan for Good program is using AI hunters to supercharge defenses for critical infrastructure, uncovering massive vulnerabilities like an exposed administrator key that left 8.8 million files in a nationally significant archive open to read, write, and delete access. By pairing its Gemini 3.8 Flash Cyber model with Wiz's Red Agent, Google aims to proactively identify and fix public exposures and attack paths across vital public services and nonprofits.
CISA Overhauls CVE Program with Quality-Focused Framework
The CVE Program is getting a major overhaul with a quality-focused framework, marking a new era of prioritizing reliability, responsiveness, and top-notch vulnerability data. CISA is leading the charge by defining quality across four key dimensions: program governance, ecosystem participation, data infrastructure, and CVE record content.
AI Coding Agents Exacerbate Secrets Sprawl as Credential Exposure Surges
AI-powered coding agents are supercharging the secrets sprawl problem, with AI-assisted commits leaking secrets at nearly twice the rate of human-written ones. This alarming trend reveals that AI tools are accelerating credential exposure, making it more crucial than ever to address the issue.
Microsoft Releases KB5124010 Update, Bolsters Windows 11 with 46 Fixes
Microsoft just dropped the KB5124010 update, packing it with 46 fixes and tweaks that supercharge Windows 11 with exciting new features, smoother accessibility, and seamless Bluetooth and backup performance. This optional update is a sneak peek at what's to come in next month's Patch Tuesday release, giving you a taste of the improvements ahead.
UK Shifts Cybersecurity Governance to Service-Led Model
The UK's 2022 "defend as one" cybersecurity approach hit a roadblock, faltering on the assumption that simply issuing standards and requiring assurance would drive compliance across its sprawling, 465-strong network of ministries, agencies, and public bodies. A new service-led model for cybersecurity governance is taking its place.
Microsoft 365 Governance Gaps Expose Organizations to Risk
Most organizations think their Microsoft 365 environments are fine - until disaster strikes. But the truth is, hidden governance gaps are lurking, putting companies at risk, with 77% of global organizations experiencing at least one governance incident in the past year.
Microsoft Fixes File History Backup Bug in Windows Updates
Microsoft's September 2026 security update caused a frustrating problem for some Windows users: File History, a built-in backup feature, stopped working, leaving users unable to create or restore backups. Fortunately, the tech giant has now fixed this bug.
Data Quality Overtakes Skills as Top Threat Hunting Barrier
Even the best threat hunters can come up empty-handed if their data is incomplete, inconsistent, or hard to access. Data quality has now overtaken skills as the top barrier to effective threat hunting, with 50% of cybersecurity practitioners citing it as their biggest hurdle.
CISA Unveils Plan to Boost CVE Program Quality
The Cybersecurity and Infrastructure Security Agency (CISA) is taking its CVE Program to the next level with a new plan to boost quality, accuracy, and consistency, ensuring organizations have a reliable catalog of software and product vulnerabilities to build on. This Quality Era marks a major milestone in CISA's 25-year commitment to leading and growing the program.
GitLab Exposes Email Token Flaw, Enabling Unauthorized Code Pushes
GitLab has a security flaw that exposes a private email token, allowing unauthorized users to push code changes to projects - essentially giving anyone carte blanche to act on your behalf. This token, tied to your account, doesn't expire and grants access to all projects you have permission to open.
OpenAI Bolsters Ukraine's Defenses with AI-Powered Cybersecurity Tools
In a powerful move to safeguard national stability, OpenAI is joining forces with Ukraine to deploy cutting-edge AI-powered cybersecurity tools, with a staggering $1 billion pledge to support the initiative. This game-changing partnership is set to bolster Ukraine's defenses, ensuring the country's critical systems stay online and its people protected.
MikroTik Routers Targeted in Pre-Patch Exploits
Hackers are exploiting two critical flaws in MikroTik routers, allowing them to gain full control of internet-exposed devices even before patches were available. The "MikroTrick" chain, which combines two vulnerabilities, lets attackers open a privileged console without needing login credentials.
Flock Camera Hack Exposes Surveillance Risks
A shocking security breach revealed that a Flock Safety camera, meant to enhance public safety, was hacked, exposing a treasure trove of sensitive data, including 1.6 million images and 50,200 vehicle logs collected over just three weeks. The alarming hack highlights the dark side of surveillance technology and the importance of robust security measures.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Enterprises Face Observability Gap in AI-Ready Operations
The harsh reality is that most organizations are flying blind, with 82% reporting visibility gaps and 96% struggling to pinpoint the root cause of incidents due to incomplete data. Despite using industry-standard observability tools, enterprises are failing to get the insights they need to stay ahead of cyber threats and ensure smooth operations.
GitHub App Keys Leaked, Granting Persistent Access
A staggering 474 GitHub App keys remain active, granting hackers persistent access to sensitive data, even after being publicly leaked. These compromised keys, which never expire, put users at risk of long-term unauthorized access.
Kubernetes Flaw Exposes GCP Organizations to Privilege Escalation
Google downplays a Kubernetes flaw dubbed ConfigConfusion, which researchers say could allow privilege escalation in GCP organizations, as simply "working as designed" despite concerns from the security community. The issue arises from a handoff in authority between GitOps and Google Kubernetes Config Connector.
XRanges for AI Scores Autonomous Security Agents' Real-World Performance
Imagine being able to see exactly how autonomous security agents perform in the real world, beyond just their polished reports. By simulating a fictional AI company, researchers gained unprecedented insight into the actual actions of 545 players over 48 hours.
cPanel Flaw Lets Hosting Accounts Run Code as Root
A critical cPanel flaw gives any hosting account user unrestricted power over the server, allowing them to run code as root and take full control. This urgent vulnerability was disclosed by cPanel on September 22, along with two other significant security issues.
Microsoft Updates Disrupt Always On VPN Connections
If you've configured your Always On VPN to automatically switch connection methods if the initial attempt fails, you may be in for a frustrating surprise after installing the September 2026 Windows 11 security updates. Your VPN connections could get stuck in a perpetual loop, constantly trying and failing to connect.
Network Security Integrates Mainstream
The network is the ultimate security game-changer, providing a rich source of intelligence and a strategic defense point where every user, device, and threat can be identified, verified, and contained. By leveraging its visibility and enforcement capabilities, the network can transform from passive plumbing to a proactive security powerhouse.
EU Cybersecurity Efforts Hindered by Information-Sharing Gaps
The EU's €1.4bn cybersecurity effort is being hindered by a critical gap in information sharing, leaving it vulnerable to large-scale cyber incidents. Better coordination and data exchange between countries and agencies are urgently needed to strengthen its defenses.