[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentEmerging Threats
Google Domains Targeted in DNS Hijacking Attacks
Google security alert: hackers hijacked DNS records, snagging unauthorized HTTPS certificates for several Google domains and others by exploiting vulnerabilities in three country-code top-level namespaces. The attacks, targeting .gh, .sl, and .as, cleverly combined DNS control with fake TLS certificates.
Hackers Hijack Country-Code Domains to Obtain Google HTTPS Certificates
Hackers hijacked country-code domains to obtain unauthorized Google HTTPS certificates, putting several domains at risk between September 22 and 27. Google quickly sprang into action, revoking the certificates and blocking them in Chrome to prevent any further damage.
Malicious npm Packages Deliver Overlord RAT and Stealer in Supply Chain Attack
A single malicious npm package, "function-flag," was downloaded a staggering 37,419 times in a supply-chain operation that delivered Remote Access Trojans and information stealers to Windows hosts. This was part of a larger campaign, dubbed MALFEX, where 12 packages were published to the npm registry since August 2023, with eight of them flagged as malicious and collectively downloaded over 40,767 times.
PoeLLM Malware Expands Crypto Botnet Via 3,400 Servers
Meet PoeLLM, a sneaky malware that's rapidly expanding its crypto botnet by hijacking 3,400 servers, with its operators using a clever poem-based trick to hide its command-and-control address. This cunning tactic lets the malware derive new addresses by tweaking a few words in a public GitHub poem.
Malware Exploits AI Systems with 'Adversarial Poetry
Meet the first-ever malware that uses a clever trick - a poem - to hijack AI systems and steer them to its command center, cleverly hidden in a forked GitHub repository. This sneaky tactic was uncovered by Lumen's Black Lotus Labs, revealing a new level of sophistication in cyber threats.
LMCache Flaw Exposes Servers to Remote Code Execution
A newly discovered flaw, CVE-2026-105192, allows hackers to send a single network message that can execute malicious code on vulnerable LMCache multiprocess cache servers, with no patch available yet. This vulnerability can be exploited when the multiprocess server is configured to listen on a routable address, making it a serious threat to servers that aren't properly secured.
ShinyHunters' Teen Ringleader Detained Amid Extortion Attempt
A teenager known as "Rey," suspected of leading ShinyHunters, has been detained in Amman, Jordan, and is cooperating with the FBI after the group allegedly attempted to extort a Boeing business unit. The group's exploits began with a PeopleSoft vulnerability, fueling a wave of data thefts.
PoeLLM Malware Targets Exposed AI Servers in Global Cryptomining Campaign
Meet PoeLLM, a sneaky malware that's compromised over 2,100 AI servers worldwide, with a staggering 800 infected systems active in just one day, all part of a massive global cryptomining campaign.
PoeLLM Malware Exploits Poem to Fuel Growing Botnet
Meet PoeLLM, a sneaky malware that's hijacked over 3,400 servers since April by cleverly extracting command-and-control addresses from a harmless-sounding poem on GitHub. This cunning botnet uses a poem-based system to stay one step ahead - but its unique approach also makes it vulnerable to takedown.
FBI Breach Exposes Third-Party Risk
A recent FBI breach was caused by a security failure at a third-party organization, Accenture, after a contractor neglected to apply a crucial security patch, exposing sensitive employee information. This incident highlights the significant risks associated with relying on outside vendors and the importance of stringent security measures.
Ransomware Targets Backup Infrastructure, Pressuring Payouts
Ransomware attackers are now targeting backup infrastructure, leaving victims with a harrowing choice: pay up or lose everything. UnitedHealth's $22 million ransom payment was a stark reminder of this new reality, as they still didn't recover their data.
Phishing Emails Embed AI Prompt Injections to Target Human and Machine
Phishing emails are now cleverly embedding AI prompt injections to deceive both human recipients and machine learning-based email summarizers, allowing scammers to target two victims at once. These sneaky attacks use techniques like hidden text and encoded data to conceal their malicious intent.
Atlassian Flaw Exploited in Wild After Public PoC Release
Hackers were quick to pounce on a newly disclosed Atlassian vulnerability, launching exploitation attempts within just two hours of a public proof-of-concept (PoC) release. This critical flaw, tracked as CVE-2026-21589, allows unauthenticated attackers to access sensitive files on vulnerable self-hosted instances.
Atlassian Flaw Sees Rapid Exploitation Attempts
A critical vulnerability, CVE-2026-21589, has been discovered in multiple Atlassian Data Center products, allowing unauthenticated attackers to access sensitive files, with rapid exploitation attempts already underway. Patching is urgently recommended for affected versions of Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye Data Center products.
FBI Warns of Ongoing FortiBleed Threat Targeting Fortinet Devices
The FortiBleed threat is still on the loose, putting 86,644 vulnerable Fortinet devices across 194 countries at risk of being compromised, with attackers exploiting reused credentials and weak password storage to gain control.
Telegram Account Tied to ASOS Hack Exposed in Gaming Trading Forums
A surprising twist in the ASOS hack reveals a Telegram account, previously linked to gaming item trading, was used to administer a channel tied to the breach, sparking questions about the hacker's true identity. The account, now labelled 'Xuanyewen', has a history that predates the incident, suggesting a calculated setup.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
FBI Warns of Ongoing FortiBleed Attacks Targeting Fortinet Firewalls
Beware: ongoing FortiBleed attacks are putting Fortinet firewalls at risk, with some victims potentially getting locked out of their own devices if attackers delete or change account passwords. The FBI and US Secret Service have issued a joint warning about this sustained threat.
Ransomware Attack Exposes Advantest Data
In a shocking cybersecurity breach, Advantest Corporation fell victim to a ransomware attack in February 2026, exposing sensitive data to an unauthorized third party. The Japanese tech giant revealed that threat actors infiltrated its network, deploying a ransomware payload and potentially compromising personal data.
AI Bots Fuel $10 Million Music Streaming Fraud Scheme
Meet the musician who raked in over $10 million by gaming the music streaming system with AI-generated tracks and bots, artificially inflating his song's listening stats to astronomical levels. He fooled major platforms like Spotify and Apple Music with a scheme that lasted for years, until he was caught and pleaded guilty.
CERT-UA Warns of 100+ Sites Serving LunexStealer via Fake Cloudflare Checks
Beware of over 100 compromised websites serving up the nasty LunexStealer malware by masquerading as a Cloudflare verification page - just a click away from trouble! When you visit these sites, you're tricked into executing a command that lets the malware swipe your sensitive info.
Danish CPR Breach Exposes Supply Chain Vulnerabilities
A staggering 8.8 million people have been affected by a massive data breach in Denmark's Central Register of Persons, with sensitive information including names, addresses, and CPR numbers exposed. This enormous leak is particularly alarming given that it surpasses Denmark's current population of six million, raising serious concerns about supply chain vulnerabilities.
FBI Warns of Ongoing FortiBleed Threat
The FBI and Secret Service are warning organizations that the FortiBleed threat is still active and can have a devastating impact, locking you out of your own systems if attackers disable accounts or change passwords. This is more than just a simple credential theft - it's a serious security risk that requires immediate attention.
Linux Backdoors Masquerade as Email Security Tools in Korea, Taiwan Attacks
Cyber attackers are sneaking Linux backdoors into systems in Korea and Taiwan, cleverly disguising them as email security tools to fly under the radar. The malware, known as AVERAT, uses a sneaky tactic of communicating with its controllers via ordinary email protocols to avoid detection.
Phishing Sites Impersonate AI Chatbots to Capture Credentials
Scammers are now using a sneaky new tactic, impersonating popular AI chatbots like ChatGPT and Gemini to trick you into handing over your login credentials and multi-factor authentication codes. They're using a clever browser-in-the-browser technique to create fake sign-in windows that look legit, but can steal your info in real time.