[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentEmerging Threats
Capcom Breach Exposes Millions of Users' Personal Data
Millions of Capcom fans are being notified that their personal data may have been compromised in a massive breach, with hackers gaining unauthorized access to email addresses and other sensitive info linked to CAPCOM ID accounts. Capcom has already reset passwords and is investigating the full extent of the incident.
Microsoft 365 Accounts Targeted in Widespread Token-Spraying Attacks
Cyber attackers have launched a massive assault on Microsoft 365 accounts, unleashing over 200,000 automated login attempts worldwide between July and September 2026, with a staggering 497 successful breaches. Using clever tricks like fake sign-in pages and social engineering, hackers stole valuable session tokens to gain unauthorized access.
Tech Firms Targeted in Most Third-Party Data Breaches
In today's digital landscape, a single security lapse at a vendor or supplier can have far-reaching consequences, exposing multiple businesses and individuals to risk. A staggering 69% of data breach victims in the past year were affected through third-party breaches, highlighting the urgent need for robust security measures beyond your own organization's walls.
Mirai Botnet Targets PHP2Shell Flaws in Mass Exploitation Push
Massive exploitation efforts are underway targeting PHP2Shell flaws, two high-severity vulnerabilities that allow hackers to remotely execute malicious code on vulnerable systems. Security teams must act fast to patch these flaws, which affect PHP versions as far back as 5.4, released in 2012.
Node.js Flaw Exploited via Crafted Brotli Data
Security researchers at Imperva have discovered a vulnerability in Node.js, dubbed Node2Shell, which allows attackers to run malicious code by feeding crafted Brotli data to the runtime's decoder, putting systems at risk. This flaw, tracked as CVE-2026-111497, was successfully exploited on a standard Node.js image, but has since been patched in version 24.22.1.
OAuth Attacks Expose Growing Threat to Enterprise Security
OAuth attacks have become a prime target for adversaries, who can bypass multi-factor authentication and survive password resets by stealing access and refresh tokens, granting them durable access to sensitive data. This shift in attack strategy highlights a growing threat to enterprise security, as tokens are often configured to be long-lived and provide persistent access.
eMudhra Certificates Compromised Due to Cryptographic Defect
A critical cryptographic defect has led to the compromise of eight intermediate certificate authority private keys belonging to eMudhra Limited, putting digital trust at risk. This flaw allowed hackers to generate fake security certificates, prompting swift action from eMudhra and major browser and OS vendors to revoke the affected certificates.
Railway Breach Exposes Developer Secrets, Prompts Credential Rotation
Railway's urgent notice to customers revealed a breach that may have exposed encrypted environment variables, putting sensitive credentials at risk. The incident affects a massive 4.8 million users and 16 million services, making swift action crucial to mitigate potential damage.
New Exploit Bypasses ASLR to Target PHP2Shell Vulnerability
Security experts at VulnCheck have crafted a potent exploit that targets a critical PHP bug, CVE-2026-109618, which can lead to remote code execution and is part of the PHP2Shell vulnerability pair. This innovative technique can bypass tough production defenses, including Address Space Layout Randomization (ASLR), to wreak havoc on x86-64 servers.
Capcom Breach Exposes 11.7 Million Accounts
A massive data breach at Capcom has compromised a whopping 11.7 million CAPCOM ID accounts, leaving customer email addresses and sensitive account info vulnerable. The breach, detected on October 19, exposed a range of personal data, including login details and IP addresses.
Arista Discloses Zero-Day SQL Flaw in VeloCloud Orchestrator
A critical zero-day SQL flaw in Arista's VeloCloud Orchestrator has been actively exploited in the wild, allowing attackers to gain top-level control with a 9.9 CVSS score. This severe vulnerability can be triggered by any user with a valid login, including those with limited Enterprise Read Only role access.
Hackers Exploit LiteLLM Pipeline to Distribute Info-Stealer Malware
A malicious release of LiteLLM, downloaded a whopping 92 million times monthly on PyPI, was compromised by hackers on October 21, who injected info-stealer malware into version 1.107.0, putting users at risk of credential theft and remote-code execution. The attack was quickly detected by security firms within six minutes of publishing.
Linux KSMBD Flaws Expose Servers to Remote Code Execution Attacks
Linux servers are under threat from two high-severity bugs in KSMBD, the built-in SMB server, that could allow attackers to execute remote code - with a severity score of 9.0 and no fixes available yet. These vulnerabilities, tracked as ZDI-CAN-33549 and ZDI-CAN-33774, can be triggered with or without network authentication, putting your server at risk.
Cybersecurity Threats Surge With AI Secrets Leak, Credential Theft
A massive data breach at Zeabur has exposed 3.2 million environment variables and put 321,810 accounts at risk, after an attacker used leaked internal credentials to infiltrate the company's systems. As a result, Zeabur will be shutting down its services starting December 1, 2026.
APT41 Revives BlackLotus Bootkit for Central Asia Espionage
Meet BlackX, a sneaky UEFI bootkit that's been revived to target diplomatic agencies in Central Asia, bearing a striking resemblance to its notorious predecessor, BlackLotus. This cunning malware has been used in a complex espionage campaign, hitting targets in Tajikistan, Uzbekistan, and Turkmenistan.
PHP Flaws Disrupt Dozens of UK Government Services
A whopping 32 UK government services have been taken offline and four more are partially unavailable due to critical PHP flaws, with officials racing to patch the vulnerabilities and restore access. The precautionary shutdowns come as a safeguard, with next week's Budget announcement and other essential services impacted.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Account Takeover Threats Exposed in AI-Driven Email Attacks
Cyber attackers are getting smarter, using AI-driven email attacks to take over accounts and lie in wait for the perfect moment to strike, injecting themselves into conversations and causing chaos. They start by stealing legitimate credentials through clever phishing scams, then patiently observe email traffic, waiting for an opportunity to pounce.
Machine Speed Attacks Demand Faster Detection, Autonomous Response
In a chilling example, an attacker used a stolen GitHub token to pull 76 repositories in just 15 seconds, exfiltrating data from 472 of 638 repos before any human intervention could occur. This lightning-fast breach highlights the urgent need for faster detection and autonomous response to machine-speed attacks.
Capcom Breach Exposes 11 Million Customer Accounts
A massive data breach at Capcom has put 11 million customer accounts at risk, exposing sensitive information like account creation dates, login history, and IP addresses. This alarming cyberattack highlights the importance of protecting online personal data.
INTERPOL Disrupts 10,909 Cybercrime Networks in Global Crackdown
In a massive global crackdown, INTERPOL dismantled 10,909 cybercrime networks, uncovering 65,929 victims and exposing the vast reach of digital threats. This coordinated effort, involving 21 countries, marks a significant win in the fight against cybercrime.
Defense Department Sued Over Data Breach Exposing Military Records
The US Defense Department is facing a class-action lawsuit over a massive data breach that exposed sensitive military records of over 3 million servicemembers, sparking concerns over a blatant disregard for the privacy of those who serve. The plaintiffs are seeking over $5 million in damages, alleging systemic exposure of sensitive information over an extended period.
PHP2Shell Exploits Deployed Days Before Patches Released
Attackers jumped on PHP2Shell flaws just four days before security patches were released, starting their exploitation attempts on October 17, according to Amazon Threat Intelligence. Multiple proof-of-concept exploits were quickly deployed from VPN-linked IP addresses, raising red flags about threat actor involvement.
Iranian Hacker Group Prince of Persia Hosts US-Based C2 Servers
Meet the "Prince of Persia," a notorious Iranian hacker group that's been wreaking havoc for nearly two decades, targeting organizations and dissidents across the US, Europe, and the Middle East. Their highly targeted attacks have been persistent, but thankfully, experts say their activity often dwindles amid geopolitical tensions.
Microsoft Reveals Chinese Spies Exploited ConnectWise Breach to Target 2,250 Cloud Tenants
Chinese spies used stolen ConnectWise credentials and AI-powered automation to target over 2,250 Microsoft 365 tenants, swiftly gaining privileged cloud access in under three hours. This sophisticated attack, linked to the China-affiliated group Storm-0940, marks a new era of lightning-fast cyber threats.