[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentEmerging Threats
CISA Warns of Active Exploits in Zyxel Switch Vulnerability
A high-severity vulnerability in Zyxel GS1900 series switches is under active attack, prompting the US Cybersecurity and Infrastructure Security Agency (CISA) to issue a directive for federal agencies to patch the flaw and prevent data theft. This urgent warning highlights the vulnerability's potential impact on enterprise and agency environments.
CISA Flags Active Exploitation of Zyxel, Veeam Flaws
The US Cybersecurity and Infrastructure Security Agency (CISA) has sounded the alarm on a high-severity Zyxel vulnerability, warning that hackers are actively exploiting it to gain control of unpatched GS1900 series switches. This critical flaw, now patched, has a CVSS score of 8.8 and could allow attackers to execute malicious OS commands via a simple HTTP request.
BigCommerce Breach Exposes Merchant Data via Compromised Ribon Apps
Hackers struck BigCommerce by compromising a key held by Ribon, a third-party app, and used it to siphon off customer data - but the e-commerce platform quickly sprang into action to contain the breach. BigCommerce swiftly removed the tainted apps, cut off the hackers' access, and alerted affected merchants to take control of their data.
CISA Warns of Active Exploitation of Linux Kernel Flaws
Hackers are actively exploiting three Linux kernel vulnerabilities, prompting the US Cybersecurity and Infrastructure Security Agency (CISA) to escalate them to the highest federal priority, requiring immediate security updates and forensic analysis. The alarming part? One of these flaws, CVE-2025-39964, had been lurking in the Linux kernel for a staggering 14 years.
North Korea Targets 30,000 Devices in Global Crypto Heist
North Korean hackers have launched a massive global crypto heist, compromising over 30,000 devices in more than 100 countries and stealing at least $10.71 million in cryptocurrency. This staggering cybercrime spree has been uncovered by a joint advisory from top cybersecurity agencies worldwide.
Fake LastPass Installer Exploits Microsoft Driver to Disable Antivirus Software
Beware of fake LastPass installers that can disable your antivirus software and steal your saved credentials. A convincing fake LastPass Authenticator page on GitHub tricked victims into downloading a malicious ZIP archive that paved the way for a password stealer.
WordPress Flaw Exposes Servers to Remote Code Execution
A newly discovered WordPress vulnerability, dubbed Click2Shell, can be exploited to execute remote code on servers, and security researchers have already published technical details and a proof-of-concept. This critical flaw was patched in WordPress 7.1.1, but earlier versions remain vulnerable.
Ransomware Actors Exploit Active Directory Group Policy
In a clever twist, hackers used Active Directory Group Policy to spread ransomware across an entire domain without installing a single malicious file on individual computers. By exploiting this native tool, they were able to hijack wallpapers, lock screens, and even disable admin accounts, all with just a few clicks.
PowerShell Backdoor TASK#STOMP Exfiltrates Sensitive Data in Stealthy Campaign
Meet TASK#STOMP, a sneaky PowerShell backdoor that's quietly harvesting sensitive business data, including documents, Wi-Fi passwords, and clipboard contents, while also taking screenshots and allowing remote control. This stealthy campaign uses a clever VBS-driven framework to evade detection and keep its operators informed.
Cisco Zero-Day Exploited in Active Attacks
Cisco is warning of a critical zero-day flaw in its Identity Services Engine (ISE) that's being actively exploited, allowing attackers to bypass authentication and gain unauthorized access with just a crafted request. This severe vulnerability, tracked as CVE-2026-76460, has been assigned a maximum CVSS score of 10.0.
Exvicy Malware Framework Exploits Rival Code to Target WordPress Sites
Malware operators are sounding the alarm: detections of the Exvicy Malware Framework are on the rise, with one seller warning that daily detections are making their service less effective. The Russian-speaking actor behind Exvicy is now charging $2,000 a month for the malware-as-a-service framework, up from $1,200 just a few months ago.
Attackers Exploit npm Trusted Publishing in GHAPPIER Supply Chain Campaign
Malicious actors have cleverly exploited npm's trusted publishing feature to unleash a supply-chain attack, using a hijacked maintainer account to distribute a sneaky loader called GHAPPIER. They got away with it by hiding behind a valid provenance attestation, highlighting a loophole in the system.
ShinyHunters Disrupts Clop Ransomware Gang's Operations
In a bold move, ShinyHunters infiltrated and defaced Clop's dark web leak site, claiming to have stolen sensitive private keys and server data that could dismantle the notorious ransomware gang's operations. This daring cyber heist has sent shockwaves through the ransomware underworld.
Rivals Hijack Clop's Leak Site, Demand Eight-Figure Payout
A rival hacking crew, ShinyHunters, has hijacked Clop's dark-web leak site, posting a bold takeover message and demanding an eight-figure payout in a shocking display of cyber power. The group claimed to have exploited a vulnerability in Clop's software to seize control of the site.
Rust Project Warns of Fake Job Interviews Used to Spread Malware
Scammers are tricking people into installing malware or executing malicious commands by posing as potential employers or clients on video calls, often under the guise of a job interview or contract opportunity. They set up fake company profiles and LinkedIn pages to make their ruse appear legitimate.
Revolut Phishing Attacks Surge After Data Breach
Hackers are taking advantage of a recent data breach at Revolut to ramp up phishing attacks, with scammers sending convincing smishing messages to customers in an attempt to harvest more account information. These attacks are getting more sophisticated, with scammers even collecting selfies or videos to fuel further identity fraud or scams.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Gyazo Breach Exposes 490 Million Metadata Records
A staggering 490 million metadata records were exposed in a Gyazo data breach, putting sensitive information at risk of being exploited by attackers. This massive leak, triggered by a vulnerability in an upload server, could allow hackers to uncover hidden details and track users' online activities.
Malware Campaigns Exploit ClickFix to Deploy RATs via Blockchain Infrastructure
Malicious ads masqueraded as legitimate software, spreading malware like ChainScript RAT through blockchain infrastructure via ClickFix lures, targeting both macOS and Windows users. Security researchers uncovered 108 fake ads from a hijacked Reddit account that seeded multiple malware families over just 48 hours.
Jade Sleet Targets Indian IT Provider with FLATROOF and ROOFDECK Backdoors
North Korean-aligned threat actor Jade Sleet has launched a targeted attack on an Indian IT provider, using FLATROOF and ROOFDECK backdoors to gain long-term access to high-value targets by exploiting developer workflows and supply-chain tooling. The attack, detected as early as March 18, 2026, is part of a persistent campaign that highlights the group's evolving tactics.
Malicious npm packages exploit runtime evasion tactics
Meet the sneaky npm package that impersonated a popular library, racking up 2 million weekly downloads before revealing its true malicious intent. This cleverly disguised package, indexed-btree, hid its payload in plain sight, masquerading as a legitimate tool until it was too late.
North Korean Hackers Infect 30,000 Devices in Global Campaign
North Korean hackers have pulled off a massive global cyberattack, infecting 30,000 devices in over 100 countries and making off with millions in cryptocurrency. The financially motivated gang, known as WaterPlum, has been siphoning funds and account credentials from over 7,000 cryptocurrency wallets since December 2025.
ShinyHunters Breaches Clop Ransomware Site, Threatens Extortion
In a stunning turn of events, the ShinyHunters group has breached the Clop ransomware gang's Tor leak site, leaving a cheeky message and ASCII art of Umbreon in its wake. The hackers boldly declared they'd been rooting the gang's systems since 2019.
AI Model Exploits Chained Flaws to Breach OpenAI Staff Accounts
In just 72 hours, researchers exploited a chain of flaws - starting with a bug in image-processing software - to breach several OpenAI staff accounts and gain access to an internal code repository. The surprising attack began with a vulnerability in a library used to parse HEIC and HEIF images, highlighting the potential for unexpected entry points.
Orkes Conductor Flaw Exploited in Wild, Fortinet Warns
A critical flaw in Orkes Conductor is being exploited in the wild, allowing attackers to execute malicious code remotely without authentication. Fortinet has reported blocking 1,290 attack attempts in just 24 hours, a 132% surge in malicious activity.