Two advanced persistent threat (APT) groups, Salt Typhoon and Volt Typhoon, were discovered secretly infiltrating telecom and critical infrastructure networks, including private 5G networks, to access sensitive data and potentially set the stage for future espionage. These stealthy intrusions went undetected for a period, highlighting the need for heightened security measures to protect against such threats.
Iranian spies are using a sneaky malware called Chosen Brick to steal data from Windows machines, often targeting dissidents, activists, and journalists who dare to challenge the regime. They start by sending convincing messages on WhatsApp and Telegram, pretending to be from trusted friends or organizations.
A critical zero-day vulnerability, CVE-2026-76461, is under active exploitation, allowing hackers to remotely execute commands as root on Cisco Secure Email Gateway appliances with just a simple email. This gaping security hole gives attackers total control of the gateway, putting your email security at risk.
CenterPoint Energy suffered a major breach, with a hacker claiming to have stolen 7.49 million customer records, including sensitive info like names, addresses, account numbers, and partial Social Security numbers. The breach, still under investigation, highlights the importance of protecting personal data.
Imagine getting hired, passing background checks, and receiving your official login credentials - all without being who you claim to be. Once inside, malicious hires can wreak havoc for days, with the average fraudulent employee enjoying 5.73 days of unrestricted access to sensitive corporate networks.
A single malicious email can wreak havoc on your Cisco Secure Email Gateway, thanks to a critical vulnerability (CVE-2026-76461) that allows hackers to gain root access with a 9.8 CVSS score - and patching is the only fix.
Meet BambooToken, a sneaky new malware framework that's been secretly weaponizing the Internet of Things messaging protocol MQTT to control servers worldwide since 2023. Its operators have cleverly leveraged MQTT's lightweight design to pull off global command-and-control attacks on both Windows and Linux servers.
A single flaw in a third-party WooCommerce plugin has sparked over 100,000 attacks, allowing hackers to upload PHP backdoors and take control of WordPress sites - a stark reminder of the importance of keeping your plugins up to date!
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
The time it takes for vulnerabilities to go from disclosure to exploitation has drastically shrunk from 21.5 days to mere hours, forcing companies to respond at machine speed to stay ahead of threats. This reality was starkly illustrated in a recent incident involving PaperCut NG and MF servers, where emergency patches were rapidly deployed and bypassed in a matter of days.
A Swiss court has dealt a significant blow to cybercrime, sentencing a 52-year-old Ukrainian ransomware developer to nearly 13 years in prison. This landmark ruling sets a strong precedent for those who wreak havoc with malicious software.
The FBI cracked down on a notorious crime ring, extraditing five alleged leaders of the Black Axe organization from South Africa to face charges in a New Jersey federal court for their roles in internet fraud schemes. These individuals, accused of heading the Cape Town zone of the Neo Black Movement of Africa, are now facing justice in the US.
A high-severity flaw in Vite, tracked as CVE-2026-39364, has been exploited in a mass-scanning campaign, allowing attackers to bypass security restrictions and harvest cloud credentials. By manipulating query parameters, unauthenticated attackers can leak sensitive files that were meant to be blocked.
In a stunning display of speed, a skilled human attacker exploited a flaw in Marimo to breach a secure SSH bastion in just 8 seconds - a pace typically associated with AI-assisted attacks. This remarkable feat was made possible by a pre-authenticated remote code execution bug, CVE-2026-39987, with a near-perfect CVSS score of 9.3.
Ransomware gangs are actively exploiting a critical VMware flaw, CVE-2026-59310, that was patched just two weeks ago, putting organizations at risk of devastating attacks. The US Cybersecurity and Infrastructure Security Agency has warned of the vulnerability, which allows unauthenticated attackers to execute arbitrary code.
Meet the notorious Black Axe gang, a violent transnational crime group that's been scamming people worldwide, including through romance scams, and now its leaders are facing justice. Five alleged members have been extradited to the US on wire fraud and money laundering charges.
Cisco has warned of a zero-day flaw in its Secure Email Gateway that allows attackers to run commands as root, prompting federal agencies to patch the vulnerability within just three days. This critical defect, tracked as CVE-2026-76461, lets hackers execute arbitrary commands with root privileges, putting systems at risk.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
Meet the sneaky hackers who just pulled off a triple threat: exploiting not one, not two, but three zero-day vulnerabilities to break free from Chrome's sandbox and wreak havoc on Windows hosts. Their latest move? A targeted spear-phish attack on NGOs via a cleverly crafted link.
A critical Cisco email gateway flaw, CVE-2026-76461, with a near-perfect CVSS score of 9.8, is being actively exploited in the wild, allowing attackers to send a single crafted email and gain root command execution on vulnerable devices. This severe vulnerability stems from insufficient validation in AsyncOS email parsing, making it a pressing concern for Cisco Secure Email Gateway users.
In a major blow to international crime, the US has extradited five leaders of the notorious Black Axe gang, accused of running a global romance scam network, from South Africa to face federal charges. The extradited men, originally from Nigeria, were arrested in 2021 and will face court in New Jersey.
A Reddit security expert sounded the alarm after stumbling upon a sneaky malware campaign that hijacked a verified HBO Max account, tricking macOS users into downloading the ClickFix malware by pasting a command into Terminal. The attack was delivered through a fake HBO Max ad that seemed legit, but led to a malicious landing page instead.
A shocking security breach at Japan's Digital Agency has exposed a staggering 246,000 personnel records after a third-party hacker exploited a vulnerability in a network-connected device to gain unauthorized access to the system. The breach was only discovered on July 9, after a large-scale file access was detected from a staff member's account on June 25.
Researchers uncovered a sneaky backdoor in 3BB's network, one of Thailand's largest broadband providers, where an attacker used MeshCentral, a legitimate remote-management tool, to maintain secret control of internal machines. The culprit installed MeshCentral agents on compromised servers, allowing them to run tools and gain full administrative control of at least one server.
A popular browser extension with over 30,000 installs, marketed as Twitch Enhanced Viewer | JeetBot, has been found to be secretly forwarding users' sensitive Twitch OAuth session tokens to a third-party bot service. This alarming security risk has left users potentially vulnerable to unauthorized account access.
A swarm of rogue agents claiming to be from OpenAI unleashed a torrent of malware on RubyGems, flooding the platform with over 2,000 malicious packages in just two days. The alarming attack was uncovered by security researchers who tracked the suspicious activity back to a cluster of automated tools.