[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentCybersecurity
General cybersecurity news and analysis
Amazon AI Coding Tool Exposes Cloud Credentials to Malicious Git Repos
A security vulnerability in Amazon's AI coding assistant, tracked as CVE-2026-12957, allowed malicious Git repositories to access sensitive cloud credentials, raising concerns about informed consent and user security. The flaw enabled automatic execution of commands with no user prompt required.
AI Agents Expose Governance Gap in Enterprise Identity Infrastructure
Traditional enterprise identity systems are struggling to keep up with the dynamic nature of AI agents, which can autonomously execute complex tasks, chain calls across multiple systems, and continuously act on inherited credentials. This has exposed a significant governance gap in current identity infrastructure.
Linux Kernel Flaw Exposes Local Users to Root Privilege Escalation
A newly discovered Linux Kernel flaw, CVE-2026-43503, allows local users to easily escalate their privileges to root level, putting systems at risk. This vulnerability, dubbed DirtyClone, lets attackers corrupt file-backed memory and gain unrestricted access with just a few clever steps.
MFA Rollout Exposes Invoicing Software Flaws
When implementing multi-factor authentication, even a well-planned rollout can hit snags, as seen in a recent case where an invoicing software flaw was exposed. A security expert and his team had agreed on a phased rollout plan with a customer to enable MFA across their Microsoft 365 tenancy.
FCC Tightens Cybersecurity Rules for Emergency Alert Systems, Undersea Cables
The FCC has just tightened cybersecurity rules for emergency alert systems and undersea cables to prevent vulnerabilities that could be exploited by rogue actors, foreign governments, or cybercriminals to spread chaos and misinformation. This move aims to safeguard the nation's primary public-warning platforms, including the Emergency Alert System and Wireless Emergency Alerts.
Securing Agentic AI Workspaces Requires Unified Governance
Nine out of 10 organisations are already harnessing AI assistants, but many are flying blind - unsure if these powerful tools have been compromised. As AI agents assume their own identities and access rights, a misconfigured or compromised agent can quickly become a high-speed pathway for data breaches and credential abuse.
Microsoft Extends Free Windows 10 Security Updates to 2027
Microsoft just gave you an extra year of protection: the free Windows 10 Extended Security Updates program for personal devices now runs through October 12, 2027. That's a welcome extension of security updates for your Windows 10 device, giving you more time to consider your next move.
Researchers Expose LLM Vulnerability to Prompt Injection Attacks
Researchers have made a startling discovery about the vulnerability of Large Language Models (LLMs) to prompt injection attacks, tracing it back to a simple yet flawed design element - role tags that were meant to be a formatting trick but have become the model's de facto security architecture. This role confusion is the surprising reason why LLMs are susceptible to these types of attacks.
Healthcare Sector Braces for Looming Cyberattack Threats
With AI now a staple in 93% of healthcare practices, the stage is set for a new wave of technological advancements - but also for looming cyberattack threats that have 61% of organizations bracing for a potentially fatal impact within the next five years.
Popular Chrome Ad Blocker Exposes Script Injection Risk
A popular Chrome ad blocker with over 10 million installs, Adblock for YouTube, has been found to have a shocking vulnerability that could allow hackers to inject malicious JavaScript into any website, all with just a single server-side tweak. This means users could be exposed to serious security risks without even realizing anything has changed.
CISA Guides Agencies Toward SASE for Zero Trust Adoption
CISA's new guidance is helping federal agencies ditch outdated internet gateways and make the leap to Secure Access Service Edge (SASE) technology, a key step towards adopting zero-trust architectures. By making this shift, agencies can unlock the benefits of zero-trust security and leave legacy perimeter-based models behind.
Network Detection and Response Gains Urgency in AI-Driven Threat Era
In today's AI-driven threat landscape, organizations need to move beyond prevention and adopt a more proactive approach, focusing on network detection and response to swiftly identify and disrupt malicious activity. By doing so, they can effectively mitigate vulnerabilities and contain threats before they escalate into full-blown breaches.
Confidence in Automated AI Vulnerability Scanning Plummets
Confidence in automated AI vulnerability scanning has taken a nosedive, with a recent survey revealing a dramatic drop from 29% to 9% in organizations relying solely on AI for testing. Instead, nearly half are turning to a hybrid approach, combining AI with human expertise for more reliable results.
macOS Flaw Enables Users to Disable EDR, MDM Tools
A security flaw in macOS has been discovered that allows users to quietly disable crucial enterprise security tools, including EDR and MDM, without needing administrator privileges. This gap in endpoint security models could leave businesses vulnerable to attacks.
UK School's Lax Network Security Exposes Sensitive Data
A 17-year-old student gained unrestricted access to a UK school's network, discovering sensitive leadership documents and being able to reset passwords, delete accounts, and even wipe the entire network. The alarming vulnerability was uncovered when the student connected their laptop to the school's Active Directory domain, which surprisingly required no administrator authentication.
Google Unveils Separate Controls for Search History, Personalization
Google is giving you more control over your online experience by separating search history and personalization settings, allowing you to customize your Google Search services and Google Play experience like never before. You'll start seeing these changes in your Google Account over the next few days.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Researchers Expose AI Browser Vulnerability to Credential Theft
Imagine a simple game trick that could convince AI-powered browsers to hand over your login credentials - a vulnerability researchers have now exposed, leaving users at risk. By creating a malicious web page that changes an AI agent's sense of reality, hackers can bypass safety guardrails and gain access to sensitive information.
UK Museums Exposed to Rising Cybersecurity Threats
The UK's cultural treasures are under threat from rising cybersecurity risks, with a recent report criticizing the Department for Culture, Media and Sport for being reactive rather than proactive in protecting national galleries and museums. This vulnerable stance puts priceless artifacts and historical exhibits at risk of being compromised.
Microsoft Rolls Out Windows 11 Update with Point-in-Time Restore Feature
Microsoft's latest Windows 11 update is here, bringing with it a game-changing feature: Point-in-time restore, which lets you snap your PC back to a previous state in just minutes. With this update, you can easily turn back the clock and get your computer up and running smoothly again.
Squidbleed Vulnerability Exposes Decade-Old Flaw in Popular Proxy Server
A 29-year-old memory leak in the popular Squid proxy server, dubbed Squidbleed, could silently expose sensitive data, including login credentials and session tokens, to hackers in certain setups. This shocking vulnerability, rooted in a 1997 code commit, highlights the importance of regularly updating and securing even the most trusted systems.
Trump Order Accelerates Federal Post-Quantum Crypto Migration by 2030
The clock is ticking: by December 31, 2030, federal agencies must upgrade their cryptography to protect high-value assets from the looming threat of quantum computers, with digital signatures following suit by December 31, 2031. This executive order accelerates the migration to post-quantum cryptography, compressing the government's previous timeline by four to five years.
AI Skill Exploits Security Scanners, Reaches 26,000 Agents
In a shocking experiment, a security firm created a fake AI skill that evaded detection by security scanners and reached a staggering 26,000 agents, including those on corporate accounts. The skill, designed to be harmless, was able to bypass every scanner it was tested on, raising serious concerns about the safety of AI marketplaces.
OpenAI Targets Faster Patching with Expanded Cyber-Defense Program
OpenAI's new GPT-5.5-Cyber model has achieved a record 85.6% score on CyberGym's vulnerability test, outperforming its standard counterpart and paving the way for faster patching with cutting-edge tooling and partnerships. This major breakthrough enables verified defenders to accelerate vulnerability fixes with enhanced security capabilities.
GitHub Bolsters Supply Chain Security by Blocking Pwn Request Patterns
GitHub is stepping up its game to protect your code by blocking common attack patterns on pull requests, helping to prevent security vulnerabilities from untrusted code. As of June 18, 2026, its actions/checkout v7 will refuse risky fork checkouts by default, keeping your workflows safer from attacker-controlled code.