[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentEmerging Threats
Vulnerabilities in Critical Network Infrastructure Actively Exploited
In just four weeks, a staggering 2,813 vulnerabilities were uncovered across 18 vendors - including 37 critical advisories and 5 with a maximum severity score of 10.0 - putting critical network infrastructure at risk of active exploitation.
Hackers Probe Internet for Unpatched Oracle Flaw
Hackers are actively searching for unpatched Oracle systems vulnerable to a critical flaw, known as CVE-2026-101767, that could let them take control with just a few clicks. This gaping security hole allows unauthenticated attackers with basic network access to wreak havoc on Oracle E-Business Suite systems.
Skyw4lker Phishing Campaign Targets US Firms with Legitimate Services
Meet the Skyw4lker phishing campaign, a sneaky threat that's targeting US firms by cleverly blending legitimate cloud services with social engineering tactics to outsmart traditional identity defenses. This devious attack uses device code authentication to get its hands on Microsoft 365 authentication tokens, putting companies at risk.
123 Reg Exposes AI-Driven Cyberattack on Customer Data
123 Reg revealed a shocking breach: a sophisticated AI-driven cyberattack compromised sensitive customer data, including contact info, VAT numbers, and product details, in an incident dating back to September 18. The company is now alerting affected customers after detecting the intruder's attempts to access and possibly copy their data.
Hackers Exploit Node2Shell Flaw as CISA Urges Emergency Patching
Hackers are actively exploiting a critical vulnerability, CVE-2026-111497, in the Brotli decoder, and CISA is urging immediate action to patch the flaw and prevent potentially disastrous consequences. Unprivileged attackers can exploit this unchecked return value vulnerability to corrupt memory, disclose sensitive data, or even execute arbitrary code.
Ransomware Affiliate Draws 70-Month Prison Sentence
Meet Artem Stryzhak, a notorious cybercriminal who teamed up with multiple ransomware groups to launch devastating attacks on US hospitals, businesses, and government entities - now facing a 70-month prison sentence for his crimes. His attacks, which crippled organizations worldwide, have finally caught up with him, resulting in a hefty sentence after a dramatic extradition from Spain to the US.
FBI Disrupts Virtualine, Bulletproof Hosting Service Used for Cybercrime and Money Laundering
In a major win for cybercrime-fighters, the FBI has shut down Virtualine, a notorious bulletproof hosting service that had become a haven for illicit activities, including child exploitation and money laundering. The service's boastful claims of ignoring abuse requests have been silenced, as the US Department of Justice takes down the Virtualine domain in an international operation.
Brotli Exploit Targets Vulnerable Systems as PolyShell Attacks Breach E-commerce Stores
A newly discovered Brotli exploit can corrupt process memory, allowing attackers to wreak havoc on vulnerable systems, while a separate threat, PolyShell, has already breached hundreds of Magento and Adobe Commerce stores. The PolyShell flaw, scoring a severe 9.3, enables attackers to inject malicious code and take control of e-commerce sites.
Oracle PeopleSoft Zero-Day Exploited via Chained Flaws
Oracle just patched a critical vulnerability in PeopleSoft, but here's the catch: it was actually three flaws chained together that attackers had been exploiting since May. The single patch, CVE-2026-35273, earned a near-perfect CVSS score of 9.8, highlighting the severity of the issue.
GMO Offers $1 Million Bounty Over FX Trading Cloud Hack
GMO Internet Group is taking a bold step to tackle a massive cloud hack that potentially affected 26,739 servers - they're offering a $1 million reward for information leading to an arrest or international wanted notice. The hack, which involved malicious programs and unauthorized access to customer info, has already sparked reports of suspicious FX trades.
Ransomware Affiliate Behind 1500 Attacks Sentenced to 70 Months
A ransomware mastermind behind a staggering 1,500 cyberattacks has been sentenced to nearly six years in prison, a major win in the fight against these devastating crimes. His attacks caused millions in damages, disrupted critical facilities like hospitals, and put sensitive data in the wrong hands.
GMO Disrupts Operations Amid Ransomware Threat
A massive ransomware threat has hit GMO Internet, putting 26,739 customer servers at risk of malware installation and data exposure after a detected intrusion on October 20. The breach has sparked a ransom demand and urgent shutdown advisory for customers.
Ransomware Gang Targets UNM Health, Exposes Sensitive Data
A ransomware gang has launched a devastating attack on UNM Health, compromising a staggering 36,000 systems and disrupting critical patient care and academic activities. The breach has forced the hospital to limit new admissions, divert ambulances, and suspend surgeries and appointments.
Hackers Inject Skimmer into Convertr Analytics Script to Steal Payment Data
In a shocking security breach, hackers turned a popular analytics script into a live card-skimmer on dozens of Brazilian storefronts, stealing sensitive payment data. Convertr quickly sprang into action, removing the skimmer and upgrading to a patched version.
AI-Driven Attacks Target Japan with Automated Hacking Tools
In a chilling October 2026 campaign, 44 AI agents were unleashed to automate a sophisticated hacking operation, complete with fake login pages and standardized reports in Japanese. This cutting-edge attack used the open-source tool CyberStrikeAI to streamline every step of the intrusion process.
Magento Sites Compromised by Advanced Scanner-Evading Malware
A sneaky malware attack has hit 953 online stores, mostly running on Magento, with a clever JavaScript loader that can tell real customers from automated security scanners - and gives scanners the cold shoulder. This stealthy campaign has been active since July 2025, quietly evading detection and putting unsuspecting shoppers at risk.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Ransomware Targets UNM Health, Disrupts Medical Operations
A ransomware attack forced UNM Health to shut down its facilities on October 26, prompting patients to seek emergency care elsewhere and delay non-emergency visits until further notice. All appointments, including surgeries, were cancelled for the day, but hospitals reopened and regular operations resumed later that evening.
University of New Mexico Grapples with Health Sciences Center Cyberattack
The University of New Mexico Health Sciences Center was hit with a sudden cyberattack on October 26, prompting swift action from its IT security teams to contain the breach and protect its network. The university quickly sprang into action, notifying law enforcement and activating an Emergency Operations Center to guide employees, students, and healthcare providers.
Warp Breach Exposes AI Agent Logs, User Telemetry Data
A breach at Warp exposed AI agent logs and user telemetry data, impacting around 1% of users, according to CEO Zach Lloyd, who assured that the company acted swiftly to contain the incident within hours. Warp has notified affected users and is working with cybersecurity experts to investigate further.
CISA confirms active PHP2Shell exploits, sets patch deadline
CISA has confirmed that PHP2Shell exploits are being actively used to attack vulnerable systems, and is requiring federal agencies to patch the flaws by October 29. This urgent deadline comes after the agency added the vulnerabilities to its list of known exploits, warning of a clear and present danger to cybersecurity.
Ransomware Attacks Expose Vulnerability in Security Tool Reliance
Ransomware attacks are happening at an alarming rate, with one machine losing its protection every three minutes - roughly 40 hosts fell victim in just 120 minutes. This shocking statistic highlights the vulnerability of relying on security tools to protect against threats like Warlock ransomware.
Huntress Report Exposes Top Cyber Threats Targeting Businesses
In a shocking trend, nearly half of endpoint-related incidents in Q1 2026 involved the abuse of remote monitoring and management (RMM) tools, highlighting a vulnerability in software administrators often trust. This alarming tactic allows attackers to gain persistent access that masquerades as ordinary admin work, making it a particularly stealthy threat.
Lazarus Exploits South Korean Security Software with Post-Quantum Encryption
Meet Operation FlashHole, a sneaky espionage campaign led by the notorious Lazarus Group, which has been targeting South Korean financial-security software since July 2025 to gain access to high-security corporate and institutional networks. The attackers have been using clever spear-phishing tactics, creating fake but convincing websites to trick their selective targets.
AI-Generated Phishing Sites Expose Login Credentials to Greater Risk
Generative AI is making phishing attacks more convincing and personal, allowing attackers to create fake login pages that closely mimic real company websites and trick employees into handing over their login credentials. This means organizations are facing a significantly higher risk of credential theft and data breaches.