[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongCybersecurity
General cybersecurity news and analysis
Expert Warns of AI Hacking Threats
Imagine a world where artificial intelligence isn't just a tool for hackers, but a hacker itself - and the expert who's sounding the alarm on this emerging threat is sharing a crucial warning. A recent DEF CON talk went viral, racking up over 100K views on YouTube in just a few days, and it's clear that the threat of AI hacking is a topic we can't afford to ignore.
Autonomous Penetration Testing Gains Traction in Continuous Security Validation
Autonomous penetration testing is revolutionizing continuous security validation, with Breach360 by BreachLock leading the charge, leveraging intel from over 40,000 real-world engagements to simulate real-life attacks. Traditional severity scores have limitations, and it's time to look beyond them to get a true picture of your security risk.
GitLab Warns Users to Patch Path Traversal Flaw
GitLab is urging users to upgrade immediately to patch a critical path traversal flaw, CVE-2026-85706, that could expose sensitive files to unauthenticated attackers. This maximum-severity vulnerability requires prompt action to protect self-managed GitLab installations.
Microsoft Resolves Teams, Outlook Launch Failures on ARM Windows PCs
Microsoft has fixed a frustrating issue that prevented Microsoft Teams and Outlook from launching on ARM-based Windows PCs, such as Surface Pro 11 and Surface Laptop 7, after installing certain security updates. The problem, affecting devices running Windows 11 24H2 or later, has been resolved with the latest patch.
AI Deployments Outpace Permissions Reviews, Leaving Organizations Exposed
Most organizations are launching AI tools without properly assessing the risks, leaving them exposed to potential security breaches. A recent survey found that while 76% of organizations have deployed AI tools, only 43% have completed a thorough review of permissions.
Pentagon Shifts Cybersecurity Focus to Leverage Emerging Tech
The Pentagon is shaking up its cybersecurity strategy, recognizing that technology - not just personnel - holds the key to defending its vast digital landscape. Department of Defense CIO Kirsten Davies calls it a complex puzzle that requires a tech-savvy solution, leveraging cutting-edge tools like automation, machine learning, and AI.
Apple Watch Enables Secret Conversation Snippets
The latest Apple Watch feature, Live Rewind, can secretly record and transcribe 15 seconds of nearby conversations, sparking concerns in 11 US states where all-party consent is required for recordings. This new capability, part of Apple's Audio Intelligence package, is easily activated with a double-press of the Digital Crown.
Survey Exposes Gap Between Cybersecurity Confidence and Readiness
There's a jarring disconnect between cybersecurity confidence and actual readiness, with 91% of leaders feeling secure, yet only 8% making it a lasting priority after an incident. This gap is starkly illustrated by the 44% of organizations that made no meaningful changes after being hit, despite swift fixes.
Microsoft Updates Disrupt Remote Desktop Services on Windows Servers
Windows admins are in a panic as September's Patch Tuesday updates cause Remote Desktop Services to go dark on production servers, forcing hard resets to get things back online. Reports are flooding in of RDS failures just hours after installation, with symptoms including stuck sessions, refused connections, and frustrating error messages.
Federal CIOs Confront IT Complexity With New Strategies
Federal CIOs are shifting their focus from technology for its own sake to delivering real business value, with a clear emphasis on centering citizens and driving meaningful outcomes. By adopting this approach, they're finding a balance between modernizing IT and ensuring responsible stewardship.
Microsoft Excel Update Disrupts Copy-and-Paste Functionality
Microsoft's latest security update, KB5002914, has caused frustration for some Excel users, disrupting basic workflows like copy-and-paste and autofill. The update, part of September's Patch Tuesday, has left many users, including entire teams, scrambling to find workarounds.
US National Cyber Director Warns of AI-Driven Cybersecurity Time Crunch
National Cyber Director Sean Cairncross warns that the rapid spread of AI is creating a pressing cybersecurity time crunch, framing it as a high-stakes race between innovation and securing critical systems. Governments are scrambling to "buy time" to bolster defenses before AI-driven threats overwhelm them.
AIs Accelerate Exploit Discovery
Meet the AI super sleuths that can uncover software vulnerabilities with just a whisper of a rumor. With minimal input, these agents can sniff out working exploits, potentially beating the patch cycle and leaving security teams scrambling to keep up.
SPIFFE/SPIRE Exposed to Post-Exploitation Identity Misuse
When a host is compromised, the damage runs deep: attackers can exploit identity mechanisms to access all authorized identities on that node, essentially collapsing machine identity and putting your entire system at risk. This is the stark reality of a SPIFFE/SPIRE security breach, where short-lived workload identities can become a double-edged sword.
Malicious Extensions Expose Crypto Data AI Agents Automate Cyber Intrusions Shadow AI Exposes Sensitive Data Fake M&A Deals Drive Wire Fraud 200 Android Flaws Patched 119K Domains Power Fake Shops Chrome Accelerates Security Releases Singpass Scheme Tied to 170 Victims Email Breach Fuels Wallet Phishing 33K+ Plex Servers Remain Exposed EtherRAT Chain Ends in Ransomware CISA Refreshes Insider Threat Guidance AI
Google just patched 200 security flaws in Android, including a critical Wi-Fi vulnerability that could let hackers take control of your device - and it's a stark reminder to stay vigilant about the risks lurking in ordinary access and trusted services.
CISA Updates Insider Threat Guide to Combat Evolving Risks
The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Insider Threat Mitigation Guide to tackle today's complex risks, offering fresh insights and resources to help organizations stay ahead. This update acknowledges that insider threats are no longer just about disgruntled employees, but also about adapting to emerging trends like AI and remote work.
[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
CISA Revamps Insider Threat Guide with Expanded Mitigation Advice
Stay ahead of insider threats with the latest guidance from CISA's revised Insider Threat Mitigation Guide, your go-to playbook for protecting your organization from evolving security risks. The updated guide offers practical advice on tackling emerging challenges like hybrid work, AI, and more.
Check Point Discloses High-Severity VPN Certificate Flaws Enabling Unauthenticated RCE
Check Point has uncovered two critical vulnerabilities in VPN certificates that could let hackers run code remotely without authentication, posing a huge threat to security. The flaws, with a near-perfect CVSS score of 9.8, affect various Check Point products, including Security Gateways, Security Management Server, and Spark Firewall.
CISA Flags Exploited Cisco, Citrix, Fortinet Flaws Ahead of Federal Patch Deadline
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has sounded the alarm on three critical vulnerabilities in Cisco, Citrix, and Fortinet products, adding them to its list of Known Exploited Vulnerabilities - and federal agencies have just until September 12, 2026 to patch up. These flaws, including a severe CVE-2026-20079 with a CVSS score of 10.0, could leave systems exposed to serious threats if not addressed.
Microsoft Resolves Mouse Settings Reset Bug with September Updates
Good news for Windows 11 users: Microsoft has squashed a frustrating bug that reset customized mouse settings, and the fix is now available through the latest security updates. Installing the latest update will not only resolve this issue but also bring important improvements and fixes to your device.
LiteLLM Gateways Expose Cloud Credentials to Risk with Default Admin Key
Thousands of LiteLLM gateways are leaving cloud credentials vulnerable due to a shocking security flaw: nearly 300 online gateways accepted a default admin key, granting hackers unrestricted access to sensitive data and cloud accounts. This easily exploitable weakness puts countless organizations at risk of devastating breaches.
Microsoft Fixes Bug That Erased Windows Desktop Settings
Microsoft has squashed a frustrating bug that prevented Windows desktop settings from loading, leaving users with a dull black background - but thankfully, the fix is now in place! The issue had been triggered by a recent update, causing customized settings to disappear and manual restores to fail.
Skullcandy Earbuds Expose Users to Bluetooth Hijacking Risk
Thousands of Skullcandy earbud owners may be vulnerable to Bluetooth hijacking due to a high-severity flaw in the Airoha Bluetooth Audio SDK - leaving them with a tough decision: risk compromised hardware or toss their earbuds.
AI Workflows Expose New Backdoor Vulnerability
Imagine a hidden vulnerability in AI workflows that lets malicious actors sneak in and access production systems without needing human credentials - a threat that's easy to overlook but hard to ignore. Researchers have uncovered a backdoor called Workflow Identity Hijacking that exploits non-human identities to execute malicious requests, all while masquerading as legitimate actions.