[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentEmerging Threats
Windows Netlogon flaw exploited in attacks after patch release
A critical Windows Netlogon flaw, patched just last month, is now being actively exploited in attacks, putting vulnerable systems at risk of remote code execution. This severe vulnerability, rated 9.8 out of 10 in severity, allows attackers to gain control of targeted domain controllers with just a specially crafted network request.
Dashlane Disrupts Service Amid Brute-Force Attacks
Dashlane recently took swift action to protect its users, suspending customer accounts in response to a surge of brute-force attacks that triggered the company's automatic defenses, putting engineers' weekends on hold. This decisive move showcases the password manager's commitment to safeguarding user security.
Microsoft Outage Disrupts Multi-Factor Authentication Setup, My Sign-Ins Platform
Microsoft is currently investigating an outage that's preventing users from setting up multi-factor authentication and accessing the My Sign-Ins platform, with the issue confirmed around 5 AM ET. The company is actively working to resolve the disruption, urging affected customers to monitor its Microsoft 365 Status account for updates.
FSB-Linked Worm Exploits Windows Flaw to Evade Detection
Cyber attackers have cleverly exploited a known Windows flaw, CVE-2025-8088, to sneak a malicious payload into victims' systems, allowing them to gain access and lay the groundwork for further attacks. This stealthy move was uncovered by Sekoia, which tracked the initial access stage as GammaPhish.
OpenAI Codex Tokens Exfiltrated in Malicious npm Supply Chain Attack
For a month, a malicious npm package called codexui-android secretly stole OpenAI Codex authentication tokens from over 29,000 weekly users, sending them to an attacker-controlled server. The package, masquerading as a remote web UI for OpenAI Codex, had gained user trust through active development before being compromised.
Hackers Exploit ChatGPT Features in Malware Phishing Campaigns
Hackers are exploiting ChatGPT's features to create convincing phishing pages that trick victims into downloading malware, using the platform's code-rendering feature to build fake pages that appear legitimate. These attacks cleverly use trusted ChatGPT domains to evade detection, making them harder to spot.
WP Maps Pro Flaw Exploited to Create Admin Accounts
A critical vulnerability in the popular WP Maps Pro plugin, used by over 15,000 WordPress sites, has been exploited to create admin accounts, putting countless websites at risk of complete takeover. This high-severity flaw, tracked as CVE-2026-8732, allows attackers to escalate privileges and gain unrestricted access.
Palo Alto Networks Warns of Active Exploitation of High-Severity VPN Bug
Palo Alto Networks has issued a warning about active exploitation of a high-severity VPN bug, urging users to patch their systems ASAP to avoid falling prey to potential security breaches. The vulnerability, CVE-2026-0257, allows attackers to bypass security restrictions and establish unauthorized VPN connections.
Hackers Exploit WP Maps Pro Bug to Hijack WordPress Sites
In just 24 hours, over 3,600 hacking attempts were made to exploit a critical flaw in the WP Maps Pro plugin, allowing attackers to create admin accounts and log in without a password. This vulnerability, affecting version 6.1.0 and older, puts countless WordPress sites at risk.
Dutch Police Disrupt Major Botnet Linked to 17 Million Infected Devices
Dutch authorities have successfully dismantled a massive botnet that had infected a staggering 17 million devices worldwide, turning everyday gadgets into a global attack platform. The operation, led by the Dutch Police and National Cyber Security Center, seized key servers and brought the botnet's infrastructure offline.
Hackers Exploit Palo Alto GlobalProtect VPN Auth Bypass Flaw in Attacks
Hackers are actively exploiting a critical flaw in Palo Alto's GlobalProtect VPN, known as CVE-2026-0257, to gain unauthorized access to corporate networks. This alarming vulnerability allows attackers to bypass security restrictions and establish fake VPN connections.
Palo Alto Networks Warns of Active Exploitation of GlobalProtect Flaw
Palo Alto Networks has issued a warning about a critical GlobalProtect flaw, CVE-2026-0257, that is being actively exploited, allowing attackers to bypass security restrictions and establish unauthorized VPN connections. This vulnerability affects specific PAN-OS and Prisma Access deployments with certain configurations.
FBI Disrupts Online Child Abuse Ring Linked to Violent Extremist Collective
The feds have taken down a predator, arresting a Tennessee man linked to a violent extremist collective for exploiting vulnerable children online. Zachary Sweeney, 30, faces up to 50 years in prison for his heinous crimes, including sexual exploitation and distributing child abuse material.
Malicious npm Packages Target Cloud Credentials
Malicious actors are targeting cloud credentials by publishing fake npm packages that mimic popular projects, allowing them to infiltrate developer environments and gain access to sensitive AWS and Elastic credentials. In just four hours, a single attacker published 14 malicious packages using cleverly disguised names.
Gogs Vulnerability Exposes Open-Source Git Service to RCE Attacks
A critical vulnerability in Gogs, an open-source Git service, has been exposed, leaving users open to remote code execution (RCE) attacks - and an exploit module is already available. The flaw was reported as early as March, but shockingly, the project's maintainers have failed to respond to the researcher ever since.
Threat Actors Exploit ChatGPT Sharing Feature to Deliver Malware
Malicious actors are exploiting ChatGPT's sharing feature to spread malware, using convincing fake outage messages to trick users into downloading malicious desktop applications. They even hijacked Google ads to make their scam look legit.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
California AG Sues 23andMe Over Data Breach Handling
California's top law enforcement official is taking on 23andMe for its botched handling of a massive data breach that exposed the sensitive genetic and personal info of nearly 7 million customers - including over 855,000 Californians. The lawsuit claims the company's lax security and software quality allowed hackers to get away with highly sensitive data.
California Sues 23andMe Over Data Breach Security Failings
California's top lawyer, Rob Bonta, is taking on 23andMe for allegedly failing to protect millions of people's sensitive genetic data and downplaying the severity of a massive 2023 data breach. The lawsuit claims the company broke California law by not keeping personal info safe and lying to customers about the breach.
LLM Agent Enables Rapid Post-Exploitation in Marimo Networks
On May 10, 2026, a savvy attacker used a large language model agent to rapidly exploit a vulnerable Marimo instance, leveraging CVE-2026-39987 to spark a swift and damaging breach. This critical vulnerability allowed the attacker to execute arbitrary system commands, paving the way for cloud credential theft and further malicious activity.
Dutch Authorities Disrupt Massive Botnet of 17 Million Devices
In a major cybercrime crackdown, Dutch authorities have successfully dismantled a massive botnet comprising 17 million infected devices, seizing over 200 servers used to host its infrastructure. This significant takedown was made possible through a collaborative effort between the Police and the National Cyber Security Centre (NCSC).
Dutch Police Disrupt Mystery Botnet, Seize 17M Devices
Dutch police have successfully dismantled a massive mystery botnet, freeing a staggering 17 million devices from its control. This significant disruption was made possible by tracing around 200 servers to the Netherlands and having the hosting provider shut them down.
Silent Ransom Group Escalates Tactics with In-Person IT Impersonation
The FBI warns that the notorious Silent Ransom Group is taking a more aggressive approach, impersonating IT staff in person to infiltrate corporate systems, targeting US law firms, insurance, finance, and healthcare companies since 2023. This new tactic marks a significant escalation from their previous remote trickery methods.
Russia-linked Group Leverages ChatGPT in Cyberattacks on Ukraine
Meet GREYVIBE, a Russia-linked cyber group that's taking its attacks on Ukraine to the next level with the help of AI tools like ChatGPT, targeting the country's military and government. This sinister crew is leveraging cutting-edge tech to supercharge its cyberattacks.
Russia-Linked GREYVIBE Exploits AI in Ukraine Cyberattacks
Discover how the Russia-linked group GREYVIBE is using AI to launch sophisticated cyberattacks on Ukraine, leveraging tactics like spear-phishing emails and fake websites to spread malware. WithSecure researchers have tracked GREYVIBE's activities back to August 2025, revealing a pattern of attacks targeting Ukraine's military, government, and civilian sectors.