Linux kernel flaws are being actively exploited in the wild, prompting CISA to add three vulnerabilities to its Known Exploited Vulnerabilities catalog. This high-risk threat has known public exploits, making swift remediation a top priority.
A shocking npm attack on TanStack exposed a massive 170 private GitHub repositories after a malicious actor exploited a stolen OAuth token from a former employee's account. The breach was linked to a supply-chain compromise of TanStack's npm packages, tracked as CVE-2026-45321, which allowed attackers to steal sensitive credentials.
A 24-year-old Texas resident, Ahmed Hossam Eldin Elbadawy, has pleaded guilty to federal charges related to a cybercrime spree with the notorious Scattered Spider hacking group. The guilty plea, entered a year ago, has only now been made public as prosecutors seek to seize assets obtained through the crimes.
North Korean hackers are posing as dream employers to trick software developers and IT pros into handing over sensitive data and cryptocurrency - all under the guise of a job offer that's too good to be true. They're using fake job opportunities to get close to their targets, with AI, cryptocurrency, and NFT firms in their sights.
Beware of scammers posing as law enforcement or government officials - they've already swindled over $1.6 billion from victims since January 2025, with the average loss per complaint topping $26,000. These impostors often use threatening tactics, like fake jury duty or "pay to remove charges" scams, to get their hands on your hard-earned cash.
North Korean hackers have compromised over 30,000 devices by posing as recruiters, targeting unsuspecting job seekers with a clever ruse that steals sensitive information and cryptocurrency. By exploiting stolen IDs, these cybercriminals can impersonate victims and generate foreign currency, ultimately funding the regime.
A massive data breach at Gyazo has exposed a staggering 23.6 million user records, thanks to a server vulnerability that was exploited by attackers on September 11, 2026. The incident has prompted the company to temporarily suspend its service for maintenance, and users are advised to wait patiently for its recovery.
Meet RUSTYSHADE, a sneaky Rust-based backdoor that's being used by Transparent Tribe to target government and defense organizations in India and Afghanistan, leveraging private GitHub repositories for covert communication. This latest tactic is part of a broader campaign, dubbed Operation RapidRust, aimed at infiltrating sensitive targets.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Beware of a sneaky malware campaign targeting LastPass users with the Rapuncel Infostealer - hackers are using fake GitHub repositories and search engine tricks to steal your info. Victims who search for popular software like LastPass Authenticator may unknowingly download the malware.
Thousands of websites, repositories, and documentation pages are unwittingly exposing users to rogue scripts, thanks to a long-abandoned content delivery network domain that was re-registered by a malicious actor. This simple domain hack has opened the door to a massive security vulnerability.
Meet Settra, a sneaky new ransomware variant that's targeting retail and manufacturing firms with clever tactics, leaving a trail of chaos in its wake. First spotted in June, this malicious software has already been linked to two separate attacks, one in July and another in September.
Meet WeaselBiscuit, a sneaky new malware that's small but packs a punch, stealing Chrome data by masquerading as harmless npm packages. This stripped-down stealer is designed to evade detection, and it's being spread through 13 infected npm packages.
Meet PhantomRaven, a sneaky JavaScript information stealer crafted by a financially motivated actor - and likely created with the help of a large language model, a cutting-edge AI tool. The surprising twist? The malware's code reveals telltale signs of AI involvement, including verbose comments and placeholder code.
Ransomware attacks on manufacturing organizations are surging, with a staggering 22% of all victims coming from this sector over the past year, making it the most targeted industry for the fifth year in a row. This alarming trend shows a steady rise in attacks since 2022, with a significant spike in early 2026.
Meet RatHat, a sneaky Android malware that uses Accessibility tricks and ADB exploits to break free from the sandbox and gain shell-level control on your device. By combining these tactics, RatHat can secretly pair with your device and run malicious daemons with elevated privileges.
Cisco has disclosed a second actively exploited zero-day vulnerability, CVE-2026-76460, a maximum-severity flaw in its Identity Services Engine (ISE) that lets attackers bypass authentication and take full control of affected devices. This vulnerability is particularly alarming because it allows hackers to modify network access policies, extract sensitive credentials, and move undetected across the network.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
Meet HEAVYGRAM, a sneaky Telegram backdoor linked to Iran that's packed with espionage capabilities, from snapping screenshots to siphoning off sensitive data, and controlled remotely by its masters. This malicious tool has been quietly lurking in the shadows since September 2023, leaving a trail of compromised systems in its wake.
A shocking 230 out of 243 unauthenticated LocalAI instances were found to be vulnerable to exploitation, highlighting a disturbing trend: our increasing reliance on convenient tools is creating new avenues for old security mistakes. This alarming vulnerability was recently exploited in a large-scale campaign, compromising high-value targets, including infrastructure linked to the Thai military.
A newly discovered vulnerability, dubbed Plugin4Shell, allows attackers to execute remote code with just a single click - or none at all - giving them carte blanche access to sensitive data and assets. This zero-click flaw in AI coding agents highlights the urgent need for updated security measures to prevent devastating supply-chain attacks.
Meet RatHat, a sneaky new Android malware that uses AI to take control of your device, navigating and interacting with it in real-time - making it a formidable foe for security software. This clever malware is spread through cleverly disguised ads, texts, and fake websites, and may even have ties to Chinese threat actors.
Iranian hacking groups are using surprisingly simple yet effective tactics to wreak havoc on US critical infrastructure, businesses, and public services - and they don't need to be the most sophisticated players in the game to get results. By relying on volume, repeatability, and clear objectives, they're able to impose significant pain and disruption.
Meet MovieReaper, a sneaky new malware that's been infecting hundreds of victims worldwide by hiding in compromised torrents, and Kaspersky's security researchers are sounding the alarm. This modular threat has been spreading rapidly across Europe, Asia, and Africa, putting both individuals and organizations at risk.
Meet Salt Typhoon, a notorious PRC-backed espionage group that's set its sights on Latin America, infecting government agencies with sophisticated backdoor malware. In just a few months, they've targeted a whopping 90% of their victims in the region, hitting countries including Argentina, Ecuador, and Venezuela.
In a major win for cybersecurity, US authorities have shut down NightmareStresser, a notorious DDoS-for-hire service that had been wreaking havoc globally. This coordinated takedown, dubbed Operation PowerOFF, marks a significant blow to cybercriminals who rely on these services to launch devastating attacks.