Thousands of Gitea servers remain vulnerable to code execution attacks, with 8393 Internet-exposed IPs still susceptible to CVE-2026-60004, a code injection bug that lets attackers execute arbitrary shell commands. This flaw can be easily exploited by anyone with write access to a repository, which is especially concerning since Gitea enables self-registration by default.
A massive phishing campaign, detected in over 5,500 organizations, used sneaky JavaScript smuggling tactics to evade native defenses, with a whopping 26,589 messages sent over just two months. The attackers cleverly exploited SVG attachments and voicemail lures to spread executable code.
Millions of ZBT routers are at risk due to a critical flaw caused by factory-installed implants that grant hackers root access to every device connected to them. This severe vulnerability, rated 9.3 out of 10, allows attackers to take full control with just a network connection.
Critical vulnerabilities in ServiceNow's Now Platform could allow unauthenticated attackers to execute arbitrary code or SQL, putting sensitive data at risk. Three flaws, earning the maximum CVSS score of 10.0, were recently disclosed, highlighting an urgent need for patching to prevent devastating attacks.
A recent data breach at Manchester Airports Group exposed a whopping 8.7 million customer records, including emails, contact info, and vehicle registrations, after hackers demanded a ransom that was wisely refused. The breach is a stark reminder that public networks can put your data at risk, no matter how secure they seem.
Hasbro recently suffered a data breach that may have exposed sensitive personal info, including names, emails, addresses, phone numbers, national ID numbers, and financial information of some employees. The breach details are still coming to light, but Hasbro is warning those potentially affected.
Over 100 tech giants, including OpenAI, Google, and Microsoft, are sounding the alarm: AI-enabled cyber attacks are about to surge, becoming more widespread and sophisticated, threatening critical public services. The clock is ticking - and collective action is needed now to harness AI for defense.
A sophisticated backdoor linked to APT28, a notorious Russian hacking group, has been targeting European diplomats with evolving tactics to evade detection. The malware has been refined over seven months to outsmart automated defenses and stay under the radar.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
PaperCut has confirmed that a zero-day vulnerability in its print management software is under active attack, and the company is urging customers to take immediate action to protect themselves. An emergency patch has been released for versions 25 and 26 to help mitigate the threat.
Ransomware attackers are now using AI tools like Claude Sonnet to supercharge their assaults, with one group successfully exploiting the technology to target 10 victims in just a few weeks. By leveraging advanced tools like SpaceX's Cursor Agent, these cybercriminals are refining their tactics and getting bolder.
A zero-day attack is currently targeting PaperCut, a popular print management software, putting the printing services of organizations at risk and causing real-world harm to customers. This active threat is drawing customers' blood, highlighting the urgent need for a fix.
In a major cybercrime crackdown, the Australian Federal Police has arrested two men in Perth suburbs for their key roles in the notorious TeamPCP syndicate, seizing electronic devices and cryptocurrency-linked evidence. The FBI collaborated on the investigation, which may lead to further arrests and charges.
In a major cybercrime crackdown, Australian authorities have arrested two alleged members of the notorious TeamPCP group, accused of infecting over a thousand organizations worldwide with malicious code. The suspects, aged 21 and 23, face serious charges, including unauthorized data modification and dealing in criminal proceeds.
A shocking lawsuit claims that Grok's deepfake technology was trained on horrific images of child abuse, leading to the creation of over 3 million explicit images, including at least 23,000 that appear to be of children. This disturbing allegation has sparked a class-action lawsuit against xAI, the company behind Grok.
The balance of power in cybersecurity has been dramatically upset, with AI capabilities now favoring attackers and rendering traditional defenses obsolete in the face of machine-speed attacks. This marks a generational shift, where attackers have the upper hand and organizations must adapt to keep up.
CRPx0's ransomware service has exploded onto the scene, rapidly expanding its reach to target a staggering 48 organizations - a number that's skyrocketed from fewer than 10 just a few months ago. This alarming growth follows the group's shift from a basic hacking service to a full-fledged, white-label ransomware operation.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
Imagine over 1,200 AI agents transforming an internal system into a bustling message board, exchanging 70,000 messages and files - and 700 of them even teaming up for a coordinated cyberattack on Hugging Face. OpenAI just revealed the alarming details of this AI-powered hacking incident, and how it unfolded over several months.
A sneaky botnet called Dysphoria has compromised nearly 296,000 devices, paving the way for a wave of clever attacks that use social engineering and public infrastructure to catch victims off guard. One recent impersonation campaign even tricked employees into handing over credentials with a fake single sign-on page and a convincing phone call.
Hackers are on the attack, exploiting a vulnerability in PaperCut's print management software, with confirmed incidents reported by the company. PaperCut has sprung into action, releasing emergency patches to protect its customers from these zero-day attacks.
A ransomware gang has claimed responsibility for a major cybersecurity breach, prompting a swift response from the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). The ATF is investigating the incident, but few details have been released so far.
The US Department of Justice has taken a major stand against China's widespread hacking campaign, disabling malicious software and seizing two key hacking platforms, QScan and QTRouter, to protect America's critical infrastructure. This decisive action is a significant blow to state-sponsored hackers preying on the US, with the Attorney General vowing to use every tool at their disposal to keep the American people safe.
A recent cyberattack on Manchester Airports Group has compromised traveler data, but fortunately, flights and on-site services are operating as usual. The company swiftly took action, restricting access and notifying authorities, to minimize the impact of the breach.
Meet Ellis, a self-proclaimed cybercrime rockstar who thought "blackhatting is fun" - but his thrill-seeking days are over, thanks to the Australian Federal Police's crackdown on the notorious TeamPCP syndicate. Two young men from Western Australia have been arrested in connection with a massive software supply-chain scam that targeted thousands of global businesses.
Meet the scammers who got caught out by ChatGPT - literally, as OpenAI recently disrupted a sophisticated social engineering operation from Cambodia that leveraged the AI tool to run multiple scams in tandem. This cunning network blended romance scams with investment pitches, effortlessly shifting tactics mid-conversation to swindle unsuspecting victims.