The battle against online scams has become a top cybersecurity priority, with scam detections doubling and surpassing phishing attacks in just one year. Online scams, including fake stores, investment scams, and payment fraud, have reached alarming new heights, with 6.4 million detections in just one quarter.
Cisco is warning of a high-severity zero-day flaw, CVE-2026-76418, that can be exploited to crash SSL VPN firewalls on its Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. A simple crafted request can cause the device to reload, resulting in a frustrating denial-of-service condition.
The Information Commissioner's Office has taken Staffordshire Police to task for a serious data protection breach, revealing that the force mistakenly shared a domestic abuse victim's current home address with the very person who had been harming them. This careless mistake put the victim's safety at risk, prompting ICO to stress that organizations must do everything in their power to protect sensitive information.
Indian banks are in the crosshairs of MR ROBOT Malware, a sneaky Android banking trojan that's being rented out as a subscription-based service to cybercriminals, who can customize it to target unsuspecting victims. One affiliate was able to intercept over 5,400 text messages from just 153 infected devices, highlighting the alarming potential of this malware-as-a-service platform.
A critical Cisco SD-WAN flaw, rated a maximum severity score of 10.0, has been exploited by attackers to plant custom malware, known as KeyDrift, inside targeted systems, allowing them to bypass authentication and gain administrative privileges. This vulnerability puts organizations at risk, as it enables hackers to gain high-level access to SD-WAN networks.
Palo Alto Networks is warning of active exploits targeting its management interfaces, specifically the PHP2Shell vulnerabilities, that could put publicly accessible interfaces at risk. Immediate action is crucial, as threat actors are taking advantage of recently patched weaknesses in the company's management web interface and XML API service.
A newly discovered VMware ESX flaw, CVE-2026-41709, has been exploited by China-linked hackers to evade detection, highlighting a critical logging gap that allowed malicious activities to go unrecorded. Broadcom has since released fixes to address this vulnerability.
Meet the scammers who posed as gorgeous women on dating sites, charming victims into connecting their crypto wallets to fake NFT investment sites, leading to a staggering $516,695 theft. US prosecutors have charged six individuals linked to a Madagascar-based compound behind the elaborate NFT investment scam.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Meet Volt Typhoon, a master of evasion: it can swiftly rebuild its network of compromised devices in under two minutes, making it nearly impossible to track. This sneaky tactic allows it to maintain covert access to US infrastructure.
The US has seized the domain of Virtualine, a notorious bulletproof hosting provider that enabled cybercriminals to carry out sextortion, ransomware, and money laundering schemes. Virtualine was a major player in crypto-related crime, handling nearly a fifth of all illicit funds flowing through tracked bulletproof hosting providers in 2026.
As the holiday shopping season approaches, retailers are bracing for a surge in cyber threats, with ransomware operators already claiming 565 retail victims this year, and median company revenues of $22 million at risk. With predicted retail sales of over $1 trillion and online sales hitting $1.3 trillion, cybercriminals are circling, timing their financially motivated attacks to strike during the most profitable period for retailers.
The SolarWinds Orion hack, active as far back as September 2019, marked a turning point in the growing concern over insider threats, highlighting the risks of subverting third-party code and software supply chains to gain sustained access. This pivotal event showed how easily outside actors can infiltrate and undermine trust in even the most secure systems.
The US Department of Justice has seized the domain of Virtualine, a notorious cybercrime hosting service that enabled illegal activities like phishing, spamming, and child exploitation, in a successful operation backed by international law enforcement partners. This move has disrupted a hub for illicit online activity, including a website hosting explicit child content.
Be cautious: a recent supply chain breach at a third-party marketing platform used by Engie may have exposed your personal data, putting you at risk of impersonation and targeted fraud. Malicious individuals could use this information to contact organizations in your name or attempt to obtain sensitive details.
Cybercriminals have launched a sneaky malware campaign, disguising malicious code as legitimate ChatGPT and AI applications, such as GPT-5.6 Sol and GPT-6 Astra, and spreading them through fake GitHub projects and poisoned search results.
A single breach can be all it takes for attackers to wreak havoc, as sensitive information can be leveraged to compromise accounts and hold organizations hostage. This was starkly illustrated in the recent GMO Internet breach, where a vulnerability in remote access led to a significant outage.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
Meet Silent Train, a covert network of compromised devices exploited by the China-nexus cyber espionage group Volt Typhoon to launch targeted attacks and swiftly vanish without a trace. This sneaky operation relies on rapidly rotating chains of hijacked devices to gain transient access to victim environments.
Malicious hackers linked to China have launched a devastating cyberattack, exploiting PHP2Shell vulnerabilities to breach a US government network and compromise 25 servers across four countries. They cleverly combined these exploits with a Linux kernel bug to gain unauthorized access and wreak havoc.
A massive data breach at Sony Network Communications has compromised 2.5 million customer records, including sensitive info like names, phone numbers, and email addresses. The breach, which occurred on October 19, exposed personal data of current and former users, prompting an immediate investigation and report to Japan's Personal Information Protection Commission.
Meet Volt Typhoon, a master of stealth: for three years, this sneaky group has been using the "Silent Train" framework to exploit at least four zero-day vulnerabilities and launch targeted attacks on high-value targets. They've cleverly rigged a relay network of hacked devices to disguise their tracks.
A bad actor has attempted to breach the US Federal Election Commission's systems, forcing a temporary shutdown of its public-facing website and filing portal. The outage may disrupt campaign compliance reporting, but shouldn't impact voters' ability to cast their ballots.
A Ukrainian national, Artem Stryzhak, has been sentenced to 70 months in prison for his role in the notorious Nefilim and Hive ransomware operations. This significant sentence marks a major win in the fight against cybercrime, as Stryzhak was a prolific affiliate who helped these operations target and extort wealthy companies.
Just days after Oracle patched a critical vulnerability in its E-Business Suite, hackers are probing for weaknesses, exploiting the CVE-2026-101767 flaw that could lead to remote code execution. This alarming development highlights the urgent need for robust security measures to protect against such attacks.
In a whirlwind of events, researchers discovered two remote code execution flaws in PHP, which had been hiding in plain sight since 2012, and attackers quickly capitalized on them, with exploitation attempts emerging the same day patches were released. Millions of services are potentially vulnerable, making swift remediation a top priority.