Two US Air Force veterans orchestrated a brazen multi-year scheme that scammed over $1.68 million from a victim in Iowa City, using a complex web of domestic and international co-conspirators to divert funds into their control.
Researchers have uncovered a new Spectre v2 variant, dubbed Branch Target Reuse (BTR), that can exploit Linux systems and leak sensitive data, including root password hashes, in a matter of minutes. This attack can be executed in as little as 3-5 minutes, leaving systems vulnerable to potential breaches.
One tiny authentication mistake can have massive consequences - just ask Microsoft, which recently exposed a whopping 17.3 trillion records due to a flaw that let attackers bypass login credentials. A 16-year-old security researcher discovered the vulnerability, which could have let hackers pose as admins, but thankfully there's no evidence it was exploited.
Thousands of sensitive screenshots from 343 companies, including tech giants, have been inadvertently exposed by AI models on public GitHub repositories, revealing a shocking lapse in data security. This alarming discovery, dubbed PixelLeak, highlights the risks of relying on AI agents that can leak internal information.
Beware of malicious npm packages that have been downloaded a staggering 490,000 times, hijacking developers' WhatsApp accounts and adding them to groups without consent. These 101 rogue packages exploit the popular Baileys WhatsApp open source project to pull off the scam.
A Dutch nonprofit dedicated to exposing vulnerabilities was breached in a shocking attack that left investigators stunned, describing it as loud and extremely messy. The incident marks a serious turn of events for the volunteer-run organization, which has operated with relative calm for seven years.
Apple just dropped an urgent patch to fix a CoreGraphics zero-day vulnerability that's been exploited in targeted attacks - it's crucial to update your devices ASAP to stay protected. This swift fix comes after the flaw was used to launch attacks before a public fix was available.
RatHat Malware is rapidly evolving with an AI-powered command center, having undergone three major command-and-control infrastructure updates in just six months, with nearly 100 deployments since April 2026. This malware-as-a-service model is getting smarter and more aggressive by the day.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Microsoft uncovered a sneaky malware operation, dubbed NeedyMantis, that's been secretly giving hackers prolonged access to compromised networks since at least October 2025. This stealthy threat has been targeting key sectors like telecommunications, universities, and government-linked organizations, primarily in campaigns linked to China.
A whopping 50,277 NetScaler instances are potentially vulnerable to two newly exploited zero-day flaws, CVE-2026-88771 and CVE-2026-88772, according to Palo Alto Networks' Cortex Xpanse telemetry. This alarming number was highlighted in Unit 42's threat brief, revealing a possible zero-day attack on NetScaler devices.
Citrix has rushed out patches for two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, which were being actively exploited by hackers, with a severity rating of 9.5 on the CVSS scale. The patches fix command-injection flaws that allowed remote code execution, and were released just days after researchers warned of the threats.
A Vietnamese man has been charged in the US for masterminding a crypto scam that raked in a staggering $16 million, with authorities seizing over $53 million in cryptocurrency assets from his wallets. He was arrested at Los Angeles International Airport after entering the US from Mexico and was set to flee to Taiwan.
Kiteworks took a proactive stance against a potential threat, issuing a rare advisory that led to a nine-hour shutdown of its systems after receiving credible intel from US authorities about a possible targeted attack. The precautionary measure was lifted two days later, with the company allowing customers to resume operations.
Dutch police have made a significant breakthrough in the case against the notorious hacker group ShinyHunters, arresting a 24-year-old Amsterdam resident on September 15, who is set to face the Rotterdam District Court on September 29, 2026. The suspect, identified as Pepijn van d, is now one step closer to facing justice.
Tokyo Metro is warning 59,000 Metpo loyalty scheme members to be on high alert after a cyber attack exposed their email addresses, prompting the company to urge customers to exercise extra caution. The breach, which was quickly contained, is a stark reminder of the importance of online security for even the most trusted brands.
Apple just patched a zero-day flaw in CoreGraphics that was exploited in super-sophisticated targeted attacks - and you might want to update your devices ASAP! This out-of-bounds write vulnerability, tracked as CVE-2026-20700, could put your iOS device at risk if you're running an older version.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
A disturbing data breach has exposed sensitive information about FBI agents, including personal contact details, family members, and job assignments, sparking serious concerns about counterintelligence and safety risks. The breach, attributed to ShinyHunters, has raised alarms among researchers and threat hunters who have seen samples of the stolen data.
In a show of solidarity, ShinyHunters vowed to support their team member, providing emotional, mental, and financial backing, as well as a criminal defense lawyer, amid a Dutch investigation that led to the arrest of 24-year-old Pepijn van der Stap. The group made the statement in response to reports about the suspected member's detention in mid-September.
Keio's business operations were disrupted after a ransomware attack was detected on its servers in the early hours of September 26, prompting swift action to shut down its network and prevent further damage. The company is now working closely with the police and external experts to investigate the incident and assess its impact.
Microsoft uncovered a sneaky malware called NeedyMantis that's used to secretly maintain long-term access to compromised networks. This lightweight but persistent threat is designed to fly under the radar, allowing attackers to keep a grip on networks for an extended period.
A massive data breach at Times Car has compromised the personal info of 6.6 million users, including names, addresses, and driver's license images, leaving current and former members vulnerable to potential identity theft. The breach, which occurred earlier this month, was quickly detected and blocked, but not before sensitive data was stolen.
Apple patched a critical CoreGraphics flaw that could let hackers execute arbitrary code on your device, and warned that highly targeted attacks may have already exploited this vulnerability. The fix, which improves bounds checking, is now available for affected systems.
In just 18 hours, a concentrated cloud assault on an Azure tenant combined lightning-fast reconnaissance, credential harvesting, and resource destruction - a stark warning of the devastating potential of Azure identity hijacking. Microsoft researchers uncovered the attack, linked to a notorious group known as Storm-3168, which used compromised service principals to wreak havoc.
A 24-year-old Dutch hacker, known online as "Umbreon," has been arrested in Amsterdam as part of an investigation into the notorious ShinyHunters hacking group. The suspect, identified as Pepijn van der Stap, is set to appear in Rotterdam District Court on September 29.