[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentCybersecurity
General cybersecurity news and analysis
Large Firms Bolster AI Security with New Leadership Roles
As AI continues to grow, companies are scrambling to find leaders who can balance technical security, risk, and compliance with business goals - and the big players are leading the charge, with 65% of large organizations having already established a head of AI security role. This emerging position is rapidly becoming a key priority, with 18% of major firms creating a dedicated role and 47% combining it with an existing leadership position.
DHS Disrupts DeepSeek AI Use Across US Federal Agencies
The Department of Homeland Security has issued a directive for federal agencies to immediately halt the use of DeepSeek AI products and remove them from their IT systems. Agencies must act fast, with exceptions only granted if requested within 60 days with a clear justification and risk mitigation plan.
US Hacker Sentenced for $3.3 Million Taxpayer Heist
Meet Chukwuemeka Amachukwu, a hacker who thought he was above the law - operating from offshore, targeting unsuspecting victims, and making off with a staggering $3.3 million, but his freedom has now been curtailed with an eight-year prison sentence. US Attorney Jamie McDonald said Amachukwu has been held to account for his crimes, and justice has been served.
Go Blocks Eight CA Keys Citing Security Concerns
The Go team has taken swift action to bolster security by blocking eight intermediate CA keys in its latest releases, Go 1.27.3 and Go 1.26.10, due to specific security concerns. This urgent update aims to prevent potential vulnerabilities by rejecting certificate chains linked to these keys.
Security Teams Struggle to Tame 'Wild Code' from Rogue AI Development
Imagine a sales manager building an AI-powered workflow that quickly delivers value, only to have other employees replicate it, creating a sprawling mess of unapproved software - known as "wild code" - that spreads rapidly across the organization. This phenomenon poses serious technical risks, including excessive permissions, data exposure, and orphaned access.
WhatsApp Exposed Hiding Instructions That Undermined User Privacy Rights
WhatsApp's hidden instructions revealed a concerning disregard for user privacy rights, instructing support chatbots to steer users away from data protection authorities and regulators. This surprising discovery raises questions about the company's commitment to transparency and user protection.
AI Adoption Outpaces Security Oversight, Exposes Risks
The rapid rollout of AI agents is outpacing security oversight, leaving many businesses vulnerable to risks - in fact, 38% of organizations don't have clear ownership or accountability for monitoring AI, creating a gap in governance and visibility.
Microsoft Bolsters Windows Server 2025 with Quick Machine Recovery Feature
Microsoft just dropped a game-changer for Windows Server 2025 users: with the October 2026 security update, admins can now quickly recover servers from critical boot failures without having to physically touch them. This update brings the powerful Quick Machine Recovery feature to the table, saving time and headaches.
UK Public Sector Faces Imperative to Embed Cyber Resilience
The UK public sector is under mounting pressure to bolster its cyber resilience, with the National Cyber Security Centre (NCSC) reporting a staggering 204 nationally significant cyber incidents in the past year alone - that's four major attacks every week. As a result, cyber resilience has become a top boardroom priority.
AI Solvers Adapt to Outsmart CAPTCHAs
Researchers have made a breakthrough in CAPTCHA-solving technology, developing a hybrid AI solver that combines the strengths of vision-language models and specialized detectors to achieve an impressive 85.4% accuracy rate. This innovative approach outperforms its individual components, offering a more effective solution to visual CAPTCHAs.
Siemens Software Center Flaw Exploited in ClickFix Attacks
Siemens has patched a high-severity vulnerability in its Software Center that allowed hackers to execute arbitrary code with ease, thanks to a clever exploit involving a legitimate installer. This flaw, tracked as CVE-2026-110936, could have let attackers take control of affected systems - but fortunately, it's now fixed in version 4.0.9.8.
Financial Firms Exposed to Spoofed AI Traffic Blind Spots
Nearly 8 in 10 financial firms have been duped by malicious bots masquerading as legitimate AI assistants or search crawlers, slipping past their defenses undetected. This shocking vulnerability highlights the growing threat of spoofed AI traffic in the financial sector.
ICANN Tests Authentication Tech to Unlock Non-Public WHOIS Data for Law Enforcement
ICANN is testing innovative authentication technology to enable law enforcement agencies to access non-public WHOIS data in emergency situations, such as imminent threats to life, child exploitation, or critical infrastructure. This new tech aims to help vetted law enforcement personnel quickly obtain crucial domain information to prevent serious harm.
Wyden Pushes Encryption Adoption at 350 Federal Agencies
Senator Ron Wyden is pushing for widespread encryption adoption across 350 federal agencies to shield sensitive online activity from prying eyes, warning that the current lack of protection puts whistleblowers, federal personnel, and Americans seeking crisis support at risk. He’s urging key agencies to take immediate action to deploy crucial privacy-preserving measures.
Singapore Bolsters Cyber Resilience with Deepened Tech Industry Ties
Singapore is stepping up its cyber resilience game by fostering deeper ties with the tech industry, enabling rapid information-sharing and joint responses to cyber threats. This means that when a cyber incident strikes, governments and companies can work together in real-time to minimize the damage.
Senator Warns of Federal Websites' Vulnerability to Spy Tracking
A whopping 350 federal websites are vulnerable to spy tracking due to a missing encryption feature, prompting Senator Ron Wyden to urge the government to plug this gap and protect sensitive information. This loophole could allow foreign adversaries to monitor visits to US government sites, compromising national security.
[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
Authentication Errors Hobble Healthcare Sector
Healthcare organizations are losing a staggering 32,400 hours of productivity each year due to authentication issues, with 37% of frontline workers experiencing interruptions that delay patient care. These errors are not just frustrating - they're also costly, with each affected worker losing an average of 2.5 hours of worktime per month.
Vulnerabilities Exposed: Patching Lags Behind AI-Powered Attacks
The gap between vulnerability disclosure and exploitation is rapidly shrinking thanks to AI-powered attacks, which can now compromise systems in mere days. This alarming trend highlights the urgent need for accelerated patching to stay ahead of increasingly swift and sophisticated threats.
Microsoft Fixes Audio Decoding Issue Behind Windows 11 App Crashes
Microsoft has fixed a frustrating issue that caused some Windows 11 apps and games to crash or shut down unexpectedly, thanks to a problem with AC-3 audio decoding. The fix is now available in the October 2026 Patch Tuesday cumulative update.
Zero-Days Exposed in Pwn2Own Contest Microsoft Disrupts Phishing Kits AI Agents Cross Security Lines Ledger Reveals Supply Chain Compromise French Supermarkets Hit by Cyber Attacks
In a thrilling display of cybersecurity prowess, white-hat hackers at Pwn2Own Ireland 2026 uncovered a staggering 98 zero-day flaws, raking in a collective $1,262,000 in rewards and sparking a frantic patching scramble among vendors. The contest's top performers, including Ikotas Labs, Xint, and Team ZyGoat, demonstrated the vast vulnerability landscape, with Google's Pixel 10 among the targets successfully breached.
F5 Discloses Critical NGINX Vulnerabilities, Releases Urgent Patches
F5 has sounded the alarm on three critical NGINX vulnerabilities that could let hackers crash or take control of your systems - and they've rushed out emergency patches to fix the problem. If you're using NGINX, you'll want to update ASAP to protect yourself from potential attacks.
Microsoft Resolves Outlook Bug That Hid Copilot Buttons
Good news for Windows users of classic Outlook: Microsoft has squashed a pesky bug that was hiding Copilot buttons from view, restoring access to this handy feature for those with a Copilot Chat or Microsoft 365 Copilot account. The fix resolves issues with missing Copilot entry points in the navigation pane and ribbon.
US Cybersecurity Job Postings Plummet to Four-Year Low
Cybersecurity job postings in the US have taken a significant hit, plummeting 26.4% year-over-year to a four-year low of 235,786 roles from January to September 2026. Leadership positions, including Chief Information Security Officer (CISO) roles, were among the hardest hit.
Microsoft Updates Disrupt Exchange Sign-in, Mail Flow on Windows Server
Beware: the latest Windows security update may be causing chaos for your on-premises Exchange servers, leaving users unable to sign in to Outlook on the web or send emails that get stuck in their Outbox. This Windows-related issue affects certain Exchange Server systems, regardless of the Exchange version.