[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentEmerging Threats
Google Patches Zero-Day Flaw Exploited in Pixel Phone Attacks
Google just patched a high-severity zero-day flaw that allowed hackers to exploit Pixel phones with zero clicks - and federal authorities are urging you to update your phone ASAP. This critical vulnerability let attackers escalate privileges and bypass permission checks, but thankfully it's now closed with a simple update.
AI-Powered Attack Targets Spanish Firm in Alleged Data Theft
A Spanish firm was allegedly hit by a sophisticated AI-powered attack, where a large language model was used to search for vulnerabilities and gain unauthorized access to its systems. This chilling incident highlights that AI-related data breaches are no longer just a theoretical threat, but a harsh reality.
Russian Enterprises Targeted by Backdoor, Ransomware Attacks from Three Threat Groups
Russian enterprises are under attack by three threat groups, with hackers exploiting compromised credentials to breach corporate VPNs and deploy powerful malware like GhostContainer, a modular backdoor that gives attackers complete control over Microsoft Exchange Servers. This sneaky malware can run arbitrary code, manipulate files, and hide in plain sight, making it a formidable foe for even the most secure systems.
Exploits Target Issabel Framework Flaw for Unauthenticated OS Command Execution
A critical flaw in the Issabel Framework, rated 9.8 out of 10 for severity, allows hackers to execute malicious commands on vulnerable systems without needing login credentials. This vulnerability can be exploited using a hard-coded security key, enabling attackers to forge tokens and gain control.
Mandiant Exposes AI Coding Assistant Vulnerability to Shai-Hulud Worm
A hacker hijacked an AI coding assistant session, using it as a launchpad to deploy the Shai-Hulud worm across nearly 100 internal code repositories. This alarming incident highlights the vulnerability of AI-powered coding tools to exploitation.
WooCommerce Plugin Flaw Exploited to Upload PHP Webshells on WordPress Sites
Hackers have been actively exploiting a critical flaw in the WooCommerce Wholesale Lead Capture plugin to upload malicious PHP webshells to WordPress sites, despite a patch being available since February. Over 100,000 exploitation attempts were blocked by Wordfence's firewall, with multiple waves of attacks occurring over several months.
N0va Phishkit Targets Businesses with Legitimate Authentication Flows
Meet N0va, a sneaky phishkit that's duping businesses across North America and Europe by masquerading as trusted services and exploiting genuine authentication flows. Its clever attack chain can swiftly turn a single phishing click into persistent access to corporate resources.
Acronis Plugin Vulnerability Exploited in Targeted Attacks
A high-severity vulnerability in Acronis' Backup plugin has been exploited in targeted attacks, allowing attackers to escalate privileges on Linux deployments - and a patch is available in update 1.9.3 HF3. Users are urged to install it immediately to avoid potential security breaches.
Threat Intel Struggles to Close Exploitation Gap
In today's AI-driven landscape, merely knowing about potential threats isn't enough - the real challenge lies in rapidly testing and validating defenses against them. By harnessing AI-assisted exploitation, adversaries are swiftly turning exposure into breaches, leaving security teams scrambling to keep pace.
Spain Confronts AI-Driven Data Breach in First Recorded Attack
Spain's data protection authority confirms the country's first personal data breach caused by an autonomous AI agent, highlighting the need for swift detection and response mechanisms to mitigate such threats. The breach was carried out by an individual using a large language model to attack an organization.
Google Discloses Pixel Modem Flaw Under Limited Targeted Exploitation
Google just sounded the alarm on a high-severity bug in Pixel devices that's being exploited in targeted attacks, and they're urging users to take action. The vulnerability, tracked as CVE-2026-58704, affects the Pixel Cellular Modem and could allow attackers to escalate privileges.
CISA Warns of Active ScreenConnect Exploit in Ongoing Attacks
Beware: hackers are actively exploiting a critical flaw in ConnectWise ScreenConnect, allowing them to transfer files and execute code on vulnerable systems without permission. The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning, ordering federal agencies to secure affected systems within three days.
Ministry of Justice Breach Exposes Southport Victims' Files
The Ministry of Justice has apologized for a shocking breach that exposed sensitive files of Southport murder victims and their families, describing the incident as completely unacceptable. The Prime Minister has stepped in, ordering an urgent investigation overseen by the Lord Chancellor, with promises of swift and firm action against any wrongdoing.
TP-Link Cameras Expose Users to Eavesdropping Risk via Zero-Day Flaw
Millions of TP-Link camera users may be vulnerable to eavesdropping due to a zero-day flaw that lets hackers gain admin access without a password. This critical vulnerability affects popular models like the TP-Link Tapo C200, commonly used for baby and pet monitoring, home security, and small business protection.
UK Warns of Iranian Spyware Campaign Targeting Dissidents
The UK's National Cyber Security Centre has warned that dissidents, activists, and journalists critical of the Iranian regime are being ruthlessly targeted by a Tehran-backed spyware campaign, which steals emails, messages, and device data to silence critics. This sinister campaign has even led to stolen info being leaked on pro-Iranian sites, putting lives at risk.
WSO2 API Manager Flaw Sees Active Exploitation Attempts
A critical flaw in WSO2 API Manager, tracked as CVE-2026-5430, is under active exploitation, allowing hackers to bypass JWT authentication and gain unauthorized access with a CVSS score of 9.8 out of 10.0, potentially leading to account takeover and compromise of administrative accounts.
[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
WordPress Plugin Flaw Exploited to Plant PHP Web Shells
A critical flaw in the popular WooCommerce Wholesale Lead Capture plugin has left over 6,000 active installs vulnerable to attacks, with over 100,000 exploit attempts blocked since June 2026. This urgent security issue allows hackers to upload malicious files, putting websites at risk.
Google Fixes Exploited Android Zero-Day Flaw on Pixel Devices
Google just patched a high-severity zero-day flaw in its Pixel smartphones, warning that hackers may be using it to launch targeted attacks. The vulnerability, tracked as CVE-2026-58704, allows for a permission bypass in the device's modem, posing a significant risk to users.
Acronis Discloses Exploited Flaw in cPanel Backup Plugin
A high-severity flaw, CVE-2026-87886, has been discovered in the Acronis Backup plugin for cPanel & WHM deployments, and it's been exploited in limited, targeted attacks. This Linux local privilege-escalation vulnerability has a CVSS severity score of 7.8, making it a critical issue that needs attention.
Compromised Plugin Backdoors 1,500 WordPress Sites
A malicious update to the WordPress plugin Admin Menu Editor Pro infected around 1,500 sites with a backdoor, after hackers compromised the plugin's update server and uploaded a trojanized version. The attackers even created a hidden user account and installed a web shell on affected sites.
Malware Exploits Chinese Casino Sites for Espionage
Uncover the dark side of Chinese-language casino sites: a vast network of seemingly harmless online casinos and adult sites is secretly harboring malware, facilitating espionage, and laundering money - with ties to major US cloud providers. These sites cleverly disguise themselves as legitimate entertainment hubs, using common templates and relying on the house edge to turn a profit.
KREMLIN Malware Targets Chrome, Edge to Steal Credentials
Researchers uncovered a sneaky malware operation, dubbed KREMLIN, that's been targeting Chrome and Edge users since May 2025, infecting over 1,515 systems worldwide, with a staggering 98% of them located in Brazil. The malware uses a clever multi-stage attack to steal credentials, starting with a fake JavaScript file that tricks victims into unleashing the threat.
BambooToken Malware Exploits MQTT to Control Global Networks
Meet BambooToken, a sneaky new malware that's been secretly controlling global networks since February 2023, using the Message Queueing Telemetry Transport (MQTT) protocol to stay one step ahead. This multi-platform threat was only recently discovered, and its initial access vector remains a mystery.
Iranian Hackers Deploy Telegram-Controlled Malware to Infiltrate Dissident Networks
Iranian dissidents, journalists, and activists are in the crosshairs of Tehran's intelligence service, which is using sneaky Telegram-controlled malware to spy on and expose targets around the world, putting their personal safety and private lives at risk. This sinister campaign has prompted a joint warning from top cyber agencies in the UK, US, and Netherlands.