General cybersecurity news and analysis
A critical flaw in the Apache HTTP Server, known as CVE-2026-23918, can be exploited to launch devastating denial-of-service (DoS) and potential remote code execution (RCE) attacks, putting your online security at risk. This high-severity bug has been patched in Apache HTTP Server version 2.4.67, so updating is crucial to prevent attacks.
The blind spot in CVE feeds is leaving end-of-life software vulnerabilities flying under the radar, with a staggering 167,286 false negatives identified in 2025 alone. This oversight can have serious consequences, as outdated software can still be exploited, even if it's no longer receiving patches.
Google just supercharged its bounty program, offering up to $1.5 million for the most elusive Android exploits that require top-notch technical skills to pull off. The biggest prizes go to zero-click, full-chain exploits with persistence, highlighting Google's focus on tackling the toughest security challenges.
A staggering 2 million hosts and 1 million exposed services were uncovered through a simple scan of certificate transparency logs, revealing alarming security gaps in AI infrastructure. The findings painted a concerning picture: most AI projects lack even basic authentication, leaving them vulnerable to exploitation.
Most organizations are already using AI tools, with 90% of digital trust professionals confirming employees are leveraging them, yet only 38% have a comprehensive policy in place to manage the risks. This disconnect leaves a staggering 25% of organizations with no AI policy at all, heightening cyber risk.
Get ready for a surge of software updates, warns the National Cyber Security Centre's CTO, as AI-driven patching is set to uncover and fix long-standing vulnerabilities across your tech stack. Prioritise your external attack surfaces and prepare for a "patch wave" to stay ahead of the threat.
The NHS is taking steps to boost security by moving its public GitHub repositories to private access by May 11, amid concerns that AI-powered code analysis could be exploited to uncover sensitive information. This temporary measure aims to prevent unintended disclosure of source code and other critical details.
Microsoft's recent GitHub troubles have raised red flags about the platform's reliability, sparking concerns among developers, educators, and organisations that rely on it. This comes at a time when Microsoft is pushing users towards paid services and aggressively integrating AI offerings.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
In today's digital landscape, cyber resilience has become a top priority for GEOINT firms, enabling them to operate seamlessly even when security controls fail. With their vast global reach and complex orbital infrastructure, these firms face a massive attack surface that spans satellites, ground stations, and cloud platforms.
Polymarket's event verification process has exposed a glaring vulnerability, highlighting the risks of tying prediction market outcomes to fragile and easily manipulated sources of information. This weakness has even led to alarming threats against journalists, underscoring the urgent need for a more robust verification system.
Tired of manual rule conversions slowing down your security team? Researchers from Singapore have developed a game-changing tech that translates SIEM rules universally, automating the process and freeing up experts from tedious workloads.
OpenAI is stepping up its game to protect government agencies from cyber threats by expanding its Trusted Access for Cyber program to federal, state, and local defenders. This move aims to bolster cyber defenses and keep sensitive information safe.
A pharmacist in Maryland has been indicted for allegedly spying on nearly 200 coworkers and individuals over eight years using cyber tools, breaching trust and violating digital boundaries. Matthew Bathula faces federal charges for unauthorized computer access and aggravated identity theft.
As autonomous AI systems increasingly take control, experts warn that a new wave of security risks is emerging - and being prepared is crucial. Having operational visibility into these systems is key to understanding and mitigating potential threats.
The current online age checks are failing to protect UK kids, with 46% of children admitting they are easy to bypass, leaving them vulnerable to harmful content. Stronger action is needed from government and industry to safeguard young minds online.
Progress Software has patched critical vulnerabilities in MOVEit Automation, including an authentication bypass flaw rated CVSS 9.8, that could allow hackers to gain unauthorized access and control. The update fixes CVE-2026-4670 and CVE-2026-5174, protecting users from potential data exposure and administrative takeover.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
The European Commission has pulled the plug on EU funding for solar projects using Chinese-made inverters, citing serious cybersecurity threats that could lead to countrywide blackouts and unauthorized access to sensitive operational data. This move comes after risk assessments confirmed the potential for manipulation of electricity production and disruption of generation.
A Tennessee lawsuit claims dating app Meete used a young woman's TikTok video in an ad without her consent, sparking concerns over user exploitation. The case highlights the alarming trend of apps profiting from users' likenesses without permission.
Imagine biting into a cake without knowing the recipe, ingredients, or who's behind the baking - it's a risk you wouldn't take, right? Similarly, without AI-BOMs, enterprises are left in the dark about the AI components powering their supply chains, leaving them vulnerable to shadow AI risks.
Progress Software has patched a critical authentication-bypass flaw in its MOVEit Automation product, and is strongly urging users to upgrade to the latest version to avoid low-complexity attacks by remote threat actors. Upgrading to version 2025.1.5, 2025.0.9, or 2024.1.8 and above will fix the vulnerability.
Microsoft's latest Windows security update has caused disruptions to third-party backup apps, adding a vulnerable kernel driver to its blocklist to protect users from potential exploits. This change aims to prevent attackers from escalating privileges or executing arbitrary code, but has unfortunately caused failures in some backup products.
Microsoft Defender's recent signature update mistakenly flagged legitimate DigiCert root certificates as malware, causing widespread alerts and removal of the certificates, and even prompting some users to reinstall Windows. DigiCert quickly revoked the affected certificates within 24 hours of discovery, minimizing the impact.
The UK's National Cyber Security Centre warns that AI is about to expose decades of technical shortcuts, demanding a massive and urgent patching effort - and organisations must prepare to patch quickly, frequently, and at scale. Get ready for a surge in fixes as buried technical debt is brought to the surface.
Anthropic's Claude Security Model just got a major upgrade, now helping cybersecurity platforms detect and fix software flaws faster than ever. With its advanced capabilities, Claude Security provides detailed vulnerability explanations, confidence rankings, and even generates step-by-step patch instructions.