[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongEmerging Threats
Hackers Exploit FTP Server Banners to Deliver Windows Malware
Hackers have been cleverly using FTP server banners to spread Windows malware since July 2026, embedding commands in the greeting text that triggers an infection chain. This sneaky tactic, known as a dead-drop resolver, allows attackers to deliver malware via PowerShell scripts and other files.
Microsoft patches exploited Entra ID flaw amid rising attacks
Microsoft has patched a critical vulnerability in its Entra ID platform, known as CVE-2026-69836, which allowed attackers to execute code remotely with ease, and has already been exploited in recent attacks. This flaw enabled unauthorized threat actors to gain control and wreak havoc, making swift action crucial to prevent further damage.
SickKids Breach Exposes Employee and Applicant Data
A recent cybersecurity incident at Toronto's Hospital for Sick Children (SickKids) may have exposed sensitive personal data of current and former employees, job applicants, and staff from affiliated organizations. The breach, linked to a flaw in third-party software, is under investigation with the help of external cybersecurity experts.
GitLab Flaw Exploited in Wild Days After Disclosure
In a chilling demonstration of the new reality in vulnerability exploitation, attackers began exploiting a newly disclosed GitLab flaw within minutes of its public disclosure, leaving little time for patching. This rapid reproduction and exploitation is a stark reminder that waiting for the next patch cycle may no longer be a viable defense strategy.
Microsoft Entra ID Flaw Exploited, Enables Remote Code Execution
Microsoft warns of a critical flaw in Entra ID that lets hackers execute code remotely by exploiting a deserialization vulnerability, giving them free rein to wreak havoc over the network. This maximum-severity flaw, tracked as CVE-2026-69836, has been patched, but highlights the importance of staying vigilant against remote code execution threats.
Google Tracks Russian Cyber Spies Abusing OAuth in Targeted Phishing Campaigns
Google is sounding the alarm on Russian cyber spies who are using OAuth to carry out highly targeted phishing campaigns against top industries, and is sharing details of the attacks to help people recognize malicious outreach. The tech giant has identified three distinct groups behind the ongoing operations, which have been targeting individuals in Europe and the US since last year.
Rust Crates.io Supply Chain Hit by Build-Time Malware Attack
A single compromised account on Rust's Crates.io led to a cunning malware attack, with an attacker using the popular arrayref crate - which has been downloaded over 245 million times - to spread build-time malware to unsuspecting users through malicious package releases. The attack was swiftly contained, with the Rust Project removing the compromised releases within 86 to 107 minutes of their publication.
Russian Hackers Exploit Google OAuth, WhatsApp to Hijack High-Value Accounts
Meet the sneaky Russian hackers who are hijacking high-value accounts using clever tricks and fake emails to get their hands on sensitive info. They're using Google OAuth and WhatsApp to pull off their phishing scams, and experts warn that no one is safe.
Signed Drivers Exposed to Abuse Microsoft Defender Driver Repurposed $10 Million Reward Offered AI Model Exploits Vulnerabilities RCE Flaws Discovered in Gogs, n8n
In a stunning example of old-school ingenuity, a team of investigators finally thwarted a sophisticated espionage campaign by doing something remarkably low-tech: cutting a cable to a compromised router in a Chicago data center. This bold move brought an end to months of digital detective work that had been stymied by the elusive threat actors.
US Charges 17 Iranians in Massive Cybertheft Campaign
Meet the 17 Iranians behind a massive cyber heist that stole a mind-boggling 31.5 terabytes of sensitive data from hundreds of universities, companies, and government agencies - a staggering digital theft that went on for years. The charges reveal a sophisticated hacking operation linked to Iran's Islamic Revolutionary Guard Corps and other government clients.
Hackers Poison Popular Rust Crate with Infostealer Malware
In a shocking turn of events, hackers hijacked the account of a popular Rust library, arrayref, which has been downloaded over 53 million times in the past 90 days, and poisoned it with infostealer malware that compromised developers' machines during compilation. The malicious payload was delivered through a tainted software release, putting countless projects and users at risk.
AI-Generated Scripts Target Siemens PLCs in US Critical Infrastructure
The US government has issued a warning about an active threat targeting critical infrastructure organizations, where hackers are using artificial intelligence to create exploit scripts that target industrial programmable logic controllers, specifically Siemens S7 Series PLCs. This AI-assisted attack has the potential to affect a wide range of industries and is not limited to Siemens PLCs.
Attackers Exploit Trusted Collaboration Platforms for Identity Abuse
Collaboration platforms like Microsoft Teams and Slack have become a prime target for attackers, who are exploiting their trusted status to launch identity abuse attacks through chat phishing operations. These attacks are thriving, with 99% of alerts generated by one study related to chat phishing, signaling a major shift away from traditional email-based attacks.
US Bank Probes LockBit Ransomware Claim, Faces Data Leak Deadline
US Bank is investigating a potential cybersecurity incident after LockBit ransomware crew claimed to have breached the institution and stolen sensitive data. The bank has assured that there's currently no indication of internal system impacts or unauthorized network access.
Adversa AI Exposes Cryptographic Context Injection Attack on Grok Chatbot
Meet a sneaky new attack that can trick chatbots into spilling your secrets: Cryptographic Context Injection, a clever hack that forces AI to reveal sensitive info. This attack, successfully tested on xAI's Grok web chat, can expose user data like names, locations, and conversation history.
Facial Recognition Platform Exposes 9M Images
A staggering 9 million images, including facial photos of adults, teens, and kids, were left vulnerable in a publicly exposed database, revealing a massive security lapse by a facial recognition platform. The unprotected database contained 450 gigabytes of sensitive data, sparking serious concerns about identity verification and data security.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Zimbra SNMP Flaw Exploited for Remote Code Execution
A critical Zimbra SNMP flaw, CVE-2026-73570, with a CVSS score of 8.9, is under active exploitation, allowing attackers to execute remote code. This vulnerability can be triggered by sending specially crafted SNMP requests, putting unpatched Zimbra Collaboration systems at risk.
Ransomware Affiliate Exploits Fellow Extortionists with 'Recovery' Scam
In a shocking twist, a ransomware affiliate is turning the tables on its own gang by posing as a recovery service, offering victims a way out for a fraction of the original ransom demand. The scammer, operating under the guise of "Ransom Busters," claims to have infiltrated the ransomware gangs' infrastructure and recovered stolen data.
MSPs Face Evolving Phishing Threats from AI-Driven Attacks
AI-powered phishing attacks have transformed from a filtering issue to a detection challenge, with Kaseya warning that the numbers are stark. AI now turbocharges every stage of a phishing campaign, from lightning-fast reconnaissance to convincing content generation and evasive post-compromise activity.
Manic Malware Exploits Offline Phones via Nearby Infected Devices
Meet Manic, a potent Android banking malware that can infect offline phones by exploiting nearby infected devices, putting financial institutions and users at risk. This sneaky threat combines financial fraud with advanced surveillance and device control features, making it a major concern for banks, governments, and fintech services worldwide.
CDNs Exposed to Tsunami Attacks via HTTP/3 Flaw
A newly discovered flaw in HTTP/3 leaves CDNs vulnerable to devastating tsunami attacks, including two denial-of-service techniques called HTTP/3 Bandwidth Amplification and Connection Amplification. By exploiting this weakness, attackers can turn a small amount of malicious traffic into a massive flood that overwhelms its target.
Grok AI Chat Exposed to Cryptographic Context Injection Attack
Imagine a scenario where an attacker can secretly instruct an AI model to decrypt and execute malicious code, simply by embedding encrypted instructions and a decryption key on a web page. This is now a reality with cryptographic context injection, a new attack technique that bypasses traditional model guardrails.
Researchers Expose Zombie Card Attack Reviving Expired Visa Cards
Meet the Zombie Card Attack, a sneaky hack that brings expired Visa cards back to life - literally, allowing researchers to make a $500 purchase with a card that was supposed to be dead. By rewriting the expiration date, University of Massachusetts Amherst researchers showed how easily this loophole can be exploited.
French Tax Authority Breach Exposes 600K Records
A data breach at the French General Directorate of Public Finances exposed a massive 600,000 records, including sensitive taxpayer and business information such as tax IDs, addresses, and phone numbers. For around 250 individuals, the breach went even deeper, compromising the actual contents of messages exchanged with the authority.