In a groundbreaking move, North Korean hackers have exploited the Terraform Registry to spread Go-based malware, marking the first time threat actors have used this centralized repository as a distribution vector for malicious payloads. This alarming development was uncovered by security firm Aikido, which identified several malicious Terraform providers and Go modules published to public registries.
Hackers have been actively exploiting two major flaws in Check Point VPNs, including one that allowed for remote code execution and another that enabled script execution, putting customers at risk. The attacks, which began as early as July 23, have now been confirmed by the cybersecurity company itself.
A critical zero-day vulnerability in F5 BIG-IP APM is under active attack, putting organizations at risk of remote code execution - and it's essential to take immediate action to protect yourself. This unpatched flaw is being exploited by attackers, making it crucial to act now to safeguard your systems.
Less than five hours after WordPress released a patch for a critical vulnerability, hackers began exploiting the flaw, known as CVE-2026-87902, to execute remote code. This lightning-fast attack highlights the importance of swift updates to protect your site.
To prioritize safety, Spokane Public Schools swiftly took their online systems offline after detecting a network security breach, following established crisis protocols to assess the situation. The district is now working diligently to understand the scope of the incident and minimize its impact.
In a massive heist, over 600,000 valid credit card details were stolen from online retailers using open-source AI agent frameworks to compromise at least 119 websites and deliver skimmer malware at scale. The alarming campaign, active since July, saw a concentrated burst of 105 attack waves in just five days, targeting major companies and leaving a trail of digital devastation.
Students trying to access Elsevier's website were shocked to find themselves redirected to a notorious hacking group's leak page, sparking concerns over a possible security breach. The incident was quickly contained, but not before some users shared their alarming experiences on social media.
Meet CLOSEDQUORUM, a sneaky Windows implant that outsources its decisions to commercial AI services like DeepSeek and Google Gemini, allowing it to adapt and evolve its attacks in real-time. This clever malware sends a snapshot of its host environment to multiple AI models, then executes the action that gets the most votes.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
In a recent surge of cyber threats, 158 security advisories were issued across 17 vendors, exposing 1,699 vulnerabilities, including 42 critical flaws that could be exploited remotely. This alarming trend highlights the growing risk to network management systems, with some vulnerabilities already added to the government's catalog of known threats.
Meet x47.c, a sneaky Windows botnet that's draining AI credits with 18 clever attack methods, targeting paid AI service accounts like OpenAI and xAI by sending repeated billable requests. This malicious tool is even being sold on the darknet marketplace WraithTools, with packages starting from just $200.
Beware: compromised MemTensor packages on npm and PyPI are spreading a sneaky credential stealer called sckit, which can steal your sensitive info. Malicious actors have hijacked these packages to secretly install the sckit malware, putting your credentials at risk.
A newly discovered Linux kernel flaw, CVE-2026-80521, can allow code running inside a container to gain root access on the host, posing a significant security risk. This alarming vulnerability is just one of nearly 5,700 Linux kernel CVEs published in 2026, a record high.
Arista Networks has sounded the alarm on a critical zero-day vulnerability, CVE-2026-93952, that's being actively exploited in the wild, allowing attackers to access sensitive internal functionality in VeloCloud Orchestrator. This severe flaw can be easily exploited with low complexity, making it a high-risk threat.
Ransomware attacks just hit a record high, with a staggering 1,073 organizations falling victim in August - a 12% surge from the previous month and a clear sign that these threats are on the rise. This worrying trend marks the second consecutive month of peak activity, with North America bearing a significant 44% of the incidents.
The notorious hacking group ShinyHunters has boldly claimed to have breached FBI data, posting personnel records of all employees and applicants on its leak site in a brazen act of retaliation. The stolen records reportedly include sensitive info like addresses, phone numbers, and dates of birth for around 5,000 FBI employees.
An Armenian man has been sentenced to 2 years in prison and 3 years of supervised release for his role in a string of devastating Ryuk ransomware attacks on US companies. He was found guilty of hacking and encrypting systems, causing significant disruption and financial loss.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Chinese hackers masqueraded as reputable media organizations and NGOs, using convincing phishing messages and fake sites to deploy the CLEANGULP malware, with one recent campaign targeting Asian government entities over support for a Hong Kong activist. They sent spoofed emails that appeared to be from the Center for American Progress, complete with links to suspicious domains.
A critical flaw in F5's BIG-IP Access Policy Manager is being exploited by attackers, allowing them to run code on the system without logging in. This severe vulnerability, tracked as CVE-2026-94127, has a near-perfect score of 9.8/10 on CVSS v3.1 and enables unauthenticated remote code execution.
F5 has rolled out urgent security updates to fix a critical zero-day vulnerability in its BIG-IP APM product, which was being exploited in remote code execution attacks. The patch aims to shut down the exploit chain that attackers were using to breach systems.
The notorious cyber extortion group ShinyHunters has brazenly claimed to have breached the FBI's systems, compromising sensitive data on nearly all FBI agents and job applicants. This shocking breach puts the personal information of current and former employees, as well as aspiring agents, at risk.
A China-aligned threat group has been exploiting a chain of three zero-day vulnerabilities in Google Chrome and Microsoft Windows, highlighting a coordinated effort within the Chinese computer network exploitation community. This alarming discovery reveals the group's ability to rapidly weaponize and customize exploits across multiple campaigns.
A brazen data breach by ShinyHunters has compromised highly sensitive information on nearly all FBI agents and job applicants, including personnel records. The group is demanding action from the bureau within a week, raising serious concerns about the security of critical government data.
Meet CLOSEDQUORUM, a sneaky Windows malware that outsources its decision-making to AI giants like Google Gemini and Mistral, allowing it to autonomously pull off post-compromise actions. This cunning code queries multiple AI models, tallying their votes to determine its next move - and even has a tiebreaker system in place!
In a massive cyberattack, hackers exploited vulnerabilities in WordPress and Zyxel to steal sensitive government data from 996 devices across 48 countries. The breach exposed device configurations, network info, and critical credentials, with one Western government organization losing over 18,000 records, including accounts and passwords.