[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentCybersecurity
General cybersecurity news and analysis
CISA's CDM Program Accelerates Federal Cybersecurity Push
The Continuous Diagnostics and Mitigation program at CISA is shifting into high gear, with a focus on speed, unification, and data-driven risk management to supercharge federal cybersecurity. We have to get faster, and CISA is taking bold steps to equip federal entities to defend themselves against rapidly evolving threats.
Apple Discloses Record 260 Vulnerabilities in Massive Patch Cycle
Apple just dropped a massive patch cycle, tackling a record-breaking 260+ vulnerabilities across its operating systems, browsers, and software products - the largest update of its kind in the company's history. This critical update includes fixes for 122 security issues in iOS 27 and 204 in macOS 27 Golden Gate.
Ransomware Recovery Plans Routinely Crumble Under Attack
The harsh reality is that most ransomware recovery plans fail to deliver, with a staggering 99.5% of over 800 clients assessed by Fenix24 missing their 24-48 hour recovery targets. Even partial recoveries were rare, and full operations often took weeks to restore.
Cybersecurity Tests Miss Mark by Focusing on Isolated Techniques
Most organizations are playing a game of cyber defense whack-a-mole, testing security controls against individual threats in isolation - but 93% of security leaders admit their organization still suffered a major cyberattack in the past year. It's time to rethink the way we validate security and stop getting caught off guard.
CISOs Redirect Budgets to AI Amid Flat Cyber Spending
To stay ahead of cyber threats, savvy organizations are shifting their security budgets towards AI, with 69% of security executives planning to prioritize AI for new investments. By aligning AI security investments with business goals and upskilling their teams, these forward-thinking companies can effectively manage risk while driving innovation.
Microsoft Fixes RDS, Hyper-V Issues with Emergency Patch
Microsoft's massive September Patch Tuesday update, which bundled a record 974 CVEs, caused widespread disruptions to core services, including RDS and Hyper-V, just days after its release. The company has now issued an emergency patch to fix these issues, restoring stability to affected systems.
LiteSpeed Web Server Flaw Enables Root Access Across Shared Hosting Accounts
A critical vulnerability in LiteSpeed Web Server Enterprise could allow a low-privilege website user to gain root access on a shared-hosting server, putting all hosted sites at risk. This flaw affects versions before 6.3.7 and can bypass key security controls, including CageFS.
Microsoft Update Disrupts Excel Copy and Paste Function
Struggling with Excel's copy and paste function? A recent Microsoft update has caused a frustrating issue where content appears to paste, but actually doesn't - with no error message or warning to let you know something's gone wrong.
Microsoft Patching Accelerates Amid AI-Driven Vulnerability Surge
Microsoft just dropped a massive September patch, fixing a record-breaking 972 vulnerabilities, including 112 critical ones that could put your system at risk. This huge update is part of a rapid acceleration in patch releases, fueled by AI-powered vulnerability detection that's uncovering more threats than ever.
Microsoft Deploys Emergency Updates to Fix RDS Failures
Microsoft has rolled out emergency updates to fix Remote Desktop Services failures caused by September's security updates. The out-of-band updates, released on September 14, aim to correct RDS instability and related issues across various Windows versions.
Telegram Flaw Exposes User Messages via Hidden JavaScript in HTML Exports
A security flaw in Telegram Desktop's HTML export feature allowed hidden JavaScript to be embedded in exported chat pages, putting user messages at risk - and thankfully, it's now fixed!
Homebrew Bolsters Security with Built-in Vulnerability Scanner
Homebrew just got a major security boost with the release of version 7.0.0, which now includes a built-in vulnerability scanner to help keep your packages safe and up-to-date. This move is especially important, given Homebrew's massive popularity on GitHub with 49k stars and 11k forks, making it a prime target for threat actors.
Researchers Expose Flaw in Modern Encryption Hardware
Imagine a stealthy attack that silently corrupts encrypted data, allowing hackers to manipulate sensitive information without detection - and it's all thanks to a flaw in modern encryption hardware. This sneaky exploit, dubbed DDRop, can make protected virtual machines operate on outdated, tampered-with data that still decrypts perfectly.
Cloud Identities Exposed Through Behavioral Clustering Analysis
Mapping the complex roles of human, machine, and autonomous agent identities in cloud environments is a daunting security challenge - but a practical, data-driven solution can turn audit logs into a revealing behavioral map. By analyzing API activity across 125 cloud environments, researchers have developed a clever method for grouping identities into functional roles, shining a light on what they actually do.
NSA's CSfC Program Gains Trusted Integrators
The NSA's CSfC program is revolutionizing data security by allowing government agencies and military organizations to tap into the power of commercial off-the-shelf products, and Sigma Defense Systems is leading the charge as a trusted integrator. This innovative approach offers a flexible alternative to traditional Type 1 solutions, empowering the warfighter with cutting-edge tools to transport and store classified data.
WordPress Fortifies Plugin Security with Automated Review Rollout
WordPress has just supercharged its plugin security with an automated review system that scans every plugin release before it's distributed, catching potential threats like a backdoor in a plugin with 20,000 active installations. This new layer of protection ensures that compromised updates never reach users, giving you peace of mind.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Patch Automation Needs Checks to Balance Speed
Automation isn't just about speeding up patch deployment - it's also about building in checks to prevent errors and ensure reliability, or you risk accelerating your way to failure. By neglecting to balance speed with safety measures, you can turn automation into a high-speed train wreck.
Validation Gap Widens as AI Spurs Vulnerability Surge
The alarming gap between vulnerability discovery and exploitation is growing: a staggering 35,853 CVEs were published in the first half of 2026, with a whopping 49% surge from the previous year. Meanwhile, only a tiny fraction - 495 - were actually exploited in the wild.
Microsoft Updates Disrupt Remote Desktop Services on Windows Server
If you've installed the latest security updates, you may be experiencing frustrating disruptions to your Remote Desktop Services on Windows Server, including failed connections, sign-in issues, and server freezes. Microsoft has confirmed the issue affects Windows Server 2012 and later, as well as Windows 10 and Windows 11 devices.
UK.gov Deploys Passkeys for 23 Million Users
Say goodbye to password headaches! The UK government just made it easier for 23 million people to securely access public services with passkeys, as part of its GOV.UK One Login rollout.
Microsoft Updates Disrupt Audio on Some Windows PCs
If you've installed the latest Windows security updates, you might be experiencing audio issues with your USB devices - Microsoft has confirmed that two updates can cause USB audio devices to fail on some Windows 11 systems. The problem specifically affects devices using USB Audio Class 1.0.
AI Exposes Obscure Vulnerabilities, Kills Security Through Obscurity
The notion that security through obscurity can keep us safe is rapidly becoming obsolete, as AI agents are now uncovering obscure vulnerabilities in codebases that were thought to be battle-tested. Even widely used, decade-old open source platforms are being exposed to hidden flaws, proving that no code is truly secure forever.
AI Adoption Overwhelms Security Operations with Rising False Alerts
The surge in AI adoption is sending shockwaves through security operations, with AI-related alerts skyrocketing 685% in just a few months - and overwhelming teams with false alarms. This tidal wave of activity is clogging up systems, with nearly 73,000 AI-related alerts pouring in out of 16.9 million total SOC alerts.
Cliff Stoll Recalls Historic Hacker Sting Operation
Forty years ago, Cliff Stoll went on a thrilling cat-and-mouse chase with a cunning hacker - and now he's sharing the electrifying story with a new generation of tech enthusiasts.