Hackers have launched over 440,000 exploit attempts on WordPress sites, targeting critical flaws in popular plugins Super Forms and Elementor Pro, with attackers seeking to upload malicious files and execute remote code. Two high-severity vulnerabilities, CVE-2026-14894 and CVE-2026-32475, were behind the attacks, and have since been patched in the latest plugin updates.
Google just patched a high-severity Chrome zero-day flaw that's being actively exploited - a type confusion vulnerability in V8 that could let hackers run malicious code inside the browser's sandbox. This critical update brings Chrome's version up to 152.0.7977.82, so make sure you've got the latest version installed!
SonicWall's SMA 1000 appliances are under attack, thanks to two newly disclosed zero-day vulnerabilities - CVE-2026-83548 and CVE-2026-83549 - that can be chained together for a complete network compromise. Attackers are already exploiting these flaws in the wild, prompting urgent patching advice from the vendor and cybersecurity authorities.
Latin America's transportation, government, and water utility sectors are under siege by sophisticated AI-powered attacks that leverage advanced proxy networks and living-off-the-land techniques to infiltrate and exfiltrate sensitive data. These multi-stage intrusions have already compromised key organizations in Mexico and Ecuador.
Cyber attackers are sneaking into systems through the front door - by exploiting legitimate tools and services to gain rogue access, with a recent dark-web claim boasting of 153 million stolen U.S. and Canadian driver's licenses. Attackers are finding clever ways to impersonate trusted sources, like IT personnel, to get inside and take control.
Healthcare breaches are skyrocketing, sparking urgent concerns about patient safety and data protection, with a recent string of incidents exposing millions to potential harm. In just one alarming example, Aesto Health's December 2025 breach went undetected for five months, ultimately affecting 9.5 million people and compromising highly sensitive information.
A security researcher known as Nightmare Eclipse has made a stunning discovery, exploiting a zero-day bug in CrowdStrike's Falcon software and prompting the company to urge customers to disable a key Windows policy setting. This latest finding is part of a string of proof-of-concept exploits released by the researcher, targeting major cybersecurity products.
Morning chaos erupted for chatbot users, with ChatGPT leading the pack with a whopping 37,000 outage reports by 11 a.m. EDT, while other AI services like Grok and Claude also experienced significant disruptions.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
A recent Thomson Reuters breach exposed sensitive court data across the US and Canada, impacting 11 US states, the US Virgin Islands, and Ontario, with affected entities including appellate and supreme courts. The breach, discovered in June, involved unauthorized access to files from C-Track, a court case management platform.
Meet BraZetsu, a powerful malware toolkit that's turning compromised computers into hot commodities on the dark web, allowing cybercrooks to buy, sell, and trade access to unsuspecting victims' systems. This game-changing tool has evolved from a simple remote-access trojan to an AI-enhanced platform, making it a highly sought-after asset for Initial Access Brokers.
A massive data breach has exposed a staggering 153 million driver's licenses, putting the sensitive information of millions of people in the US and Canada at risk. The breach, linked to a service called Nexus on a Russian cybercrime forum, also includes 10 million ID cards, 3 million travel documents, and 579,000 medical cards.
Big trouble hit Anthropic on September 3, 2026, when a widespread outage caused multiple AI models, including Claude Mythos 5.1, Claude Fable 5.1, and Claude Opus 5, to produce elevated errors, disrupting users at 9:41 AM ET. The company quickly identified the issue and was working on a fix, but the outage remained ongoing.
A shocking spyware attack has been uncovered, where a Serbian student activist was secretly infected with Pegasus spyware through a clever iMessage exploit that required zero clicks from the target. This sinister attack allowed the spyware to be delivered undetected, putting the activist's personal data and safety at risk.
Big trouble for ChatGPT users: OpenAI is investigating a major outage affecting its popular chatbot and other services, with errors reported across multiple features. The disruption comes just ahead of the highly anticipated launch of the Astra model.
A critical flaw in Elementor Pro, tracked as CVE-2026-32475, has put thousands of WordPress sites at risk, with nearly 200,000 attempted exploits blocked by Wordfence's web application firewall since August 19. This vulnerability allows attackers to bypass file-upload validation and inject a malicious PHP payload, compromising site security.
Despite a major takedown effort that seized servers, domains, and $100,000 in payment wallets, the Outsider Phishing Kit is still up and running, with over 700 new phishing pages created within just a month. This alarming resurgence shows that threat actors are relentless in their pursuit of online deception.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Nearly half of all stolen corporate credentials come from personal or unmanaged devices, putting businesses at risk of identity breaches. Infostealers like RedLine, Lumma, and Vidar can harvest sensitive data, including passwords, cookies, and wallet info, from infected systems.
The US has become the primary target of a massive global phishing campaign, accounting for nearly 45% of all observed activity, with education, technology, and government sectors being hit the hardest. This widespread operation, linked to 601 cases across 46 countries, has also prominently targeted banking, finance, and manufacturing industries.
Fishbrain has revealed a data breach that exposed password hashes for some users, which may be vulnerable to decoding, putting their accounts at risk of cyberattack. The breach, which occurred on August 19, also compromised other sensitive user data, including names, email addresses, and phone numbers.
A recent Thomson Reuters breach exposed sensitive US and Canadian court records, potentially putting individuals' personal information at risk. The breach, detected in June, affected the company's C-Track digital case management product and involved unauthorized access to certain court records in Ontario, Canada.
A recent Shai-Hulud infostealer worm variant has significantly upped the ante, now scanning 469 credential locations - a massive jump from 189 in earlier variants - to harvest sensitive access credentials and threaten software supply chains. This strategic shift allows attackers to exploit existing trust and gain unauthorized access with ease.
Australians lost a whopping $3 billion to scams in 2022, but the true figure is likely much higher. In Southeast Asia, scam factories have become a booming industry, churning out millions of victims and billions of dollars in losses for global criminal groups.
Malicious actors have compromised at least 31 organizations by exploiting Node.js, a trusted developer tool, to deliver long-running implants - and here's why this tactic is so appealing to attackers. By using legitimate Node.js runtime to deploy malicious payloads, threat actors can cleverly evade detection.
A Serbian student activist's iPhone was hacked with NSO Group's notorious Pegasus spyware through a clever zero-click exploit targeting Apple iMessage, according to a joint investigation by Citizen Lab and SHARE Foundation. This sneaky attack allowed the spyware to infect the device without the user even clicking on a link.