[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentEmerging Threats
Russian Hacker Exploits Claude AI in Commercial Pentest Platform
A Russian hacker spent just $4 on a grey-market Claude API key, and within months, was selling a powerful commercial pentest tool built using jailbreak techniques to exploit the AI. This all started with a detailed tutorial on March 31, where six clever methods were shared to bypass Claude's safety filters.
Suno Data Breach Exposes 55M Users
A massive data breach at AI music platform Suno has exposed a staggering 55 million user accounts, a figure confirmed by breach tracking service Have I Been Pwned. This huge leak puts millions of users at risk.
Patching Speed Falls Behind as AI-Generated Exploits Rise
The clock is ticking faster than ever: AI can now turn software patches into working exploits in under an hour, shattering the old assumption that reverse-engineers had weeks to spare. Anthropic's Claude Mythos Preview has already proven its mettle, converting 18 Firefox patches into 8 code-execution exploits at alarming speed.
Invisible Screen Text Exposes Android AI Agents to Code Injection Attacks
Researchers found that a simple payload could launch a code injection attack on four open-source Android agent frameworks, successfully executing commands on the host's system in every trial. This alarming vulnerability allows attackers to exploit AI agents by manipulating text on the screen, turning a harmless string into a malicious command.
Ransomware Attacks Exploited Compromised Identities in 79% of Incidents
Ransomware attacks are often sparked by something surprisingly simple: 79% of incidents start with compromised identities, highlighting the vulnerability of legitimate user logins and credentials. This means that in nearly 8 out of 10 cases, attackers gain a foothold using stolen or hijacked identities rather than complex hacking techniques.
Ransomware Landscape Fractures as New Groups Proliferate
The ransomware landscape is shattering into more factions than ever, with over one new group emerging every week in 2026, according to the Black Kite Ransomware Report. This explosion of new players has led to a surge in attacks, with 61 new groups appearing in just one year alone.
FBI Warns of Deepfake Videos Targeting IC3 Leadership
Impersonation scams have taken a chilling turn, with scammers now using deepfake videos and AI-generated content to convincingly pose as government officials, including senior FBI leadership. These sophisticated cons combine social media impersonation, fake complaint portals, and high-fidelity videos to re-target previous fraud victims.
Qilin Ransomware Gang Exploits Palo Alto VPN Bug in Ongoing Attacks
The Qilin ransomware gang is actively exploiting a critical vulnerability in Palo Alto Networks' VPN software, CVE-2026-0257, to breach security and launch attacks, despite a patch being released on May 13. This alarming development follows reports of multiple intrusions by Qilin in June, highlighting the urgent need for updates.
North Korean Hackers Expose Web3 Pros to Sophisticated ClickFake Scams
One in three employees have admitted to using company tech for personal gain, and North Korean hackers are exploiting this vulnerability with a clever recruitment scam that can give them access to corporate funds. The sophisticated scheme, attributed to the notorious Famous Chollima group, targets Web3 and cryptocurrency pros with fake job offers on popular platforms like LinkedIn and Telegram.
Craneware Discloses Data Theft in Cyber Incident
A recent cyber incident at healthcare finance software provider Craneware exposed a significant volume of sensitive data, including customer and business partner records, highlighting the ease with which determined attackers can carry out data exfiltration. Even seemingly low-severity incidents can pose a real risk of data exposure.
WordPress Exploitation Surges as Public Exploit Fuels Remote Code Execution
A surge in WordPress exploitations is underway as hackers leverage a public exploit to enable remote code execution on vulnerable sites, posing a threat to organizations of all sizes and industries. The flaw, dubbed "wp2shell," allows unauthenticated attacks on default WordPress installations, sparking widespread scanning and compromise.
ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution
A critical vulnerability in the ServiceNow AI Platform, known as CVE-2026-6875, has been discovered, allowing unauthenticated users to execute arbitrary code and potentially compromise entire instances and connected proxy servers. This severe flaw has been assigned a CVSS score of 9.5, highlighting the urgent need for enhanced security measures.
ENCFORGE Ransomware Targets AI Model Files in Langflow Attack
A new ransomware called ENCFORGE is targeting AI model files, exploiting a high-severity flaw in Langflow to deploy a custom-built payload that threatens machine learning systems. This highly specialized attack focuses on encrypting critical AI data, including PyTorch, TensorFlow, and Hugging Face files.
Cyberattack Disrupts Coca-Cola's Fairlife Production Operations
A cyberattack has forced Coca-Cola's fairlife, LLC to temporarily halt production in the US, but the company assures that product quality and safety remain unaffected. The incident involved unauthorized access to production-related systems, prompting a swift suspension of operations.
Estée Lauder Breach Exposes Sensitive Data via Oracle Flaw
Estée Lauder's HR system was hacked through a vulnerability in Oracle's E-Business Suite, exposing sensitive personal data of certain individuals after an unauthorized access on August 9, 2025. The breach, discovered on June 19, 2026, has raised concerns about data security for the cosmetics giant with 57,000 employees.
Hackers Exploit Off-Chain Infrastructure, Steal $23.7 Million from Ostium
In a shocking attack, hackers swindled $23.7 million from Ostium by manipulating off-chain infrastructure with fake price reports, rapidly trading to turn the scam into cash. The thieves targeted the liquidity provider vault, leaving trader collateral safely untouched.
[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
SonicWall VPN flaws exploited to install custom malware
A threat actor known as UTA0533 has been exploiting two zero-day vulnerabilities in SonicWall SMA1000 Secure Mobile Access appliances to install custom malware, starting as early as June 22, 2026. This attack uses a critical server-side request forgery and a high-severity command injection vulnerability to gain unauthorized access.
WordPress Exploits Spread as Attackers Chain Critical Vulnerabilities
Within hours of public disclosure, hackers leveraged AI models to exploit two critical WordPress vulnerabilities, CVE-2026-60137 and CVE-2026-63030, that when combined enable unauthenticated remote code execution. This potent pairing allows attackers to wreak havoc on websites, highlighting the urgent need for updates.
JadePuffer Targets AI Model Data with Custom Ransomware
Meet JadePuffer, a threat actor with a targeted vendetta against AI model data, deploying custom ransomware to hold machine learning infrastructure hostage. Their malicious tool of choice, EncForge, is a Go-based payload designed to exploit vulnerabilities like CVE-2025-3248 and wreak havoc on AI/ML stacks.
AI Models Expose Gaps in US Cyber Defense Strategy
The pressing question is no longer if cybersecurity matters, but how we'll manage AI-driven risks before they overwhelm our defenses - and who will lead the charge. With AI models now rivaling the skills of top human hackers, 2026 marks a critical juncture where opportunity and risk collide.
Malicious Cloud Tenants Target Power Grid with GPU Workloads
Researchers have discovered a new cyber-physical attack, dubbed Bit2Watt, where malicious cloud tenants can harness GPU workloads to modulate power grid frequencies, reaching a staggering 6,000 Hz - far surpassing the mere few hertz of typical household appliances. This technique poses a significant threat to the stability of our power infrastructure.
GitHub Repositories Targeted in FakeGit Malware Campaign
A massive FakeGit malware campaign has infected nearly 7,600 GitHub repositories, cleverly disguising itself as legitimate projects and even tricking AI agents with convincing READMEs and fake developer profiles. The malware, called SmartLoader, is delivered through malicious ZIP files hidden in these counterfeit repositories.
AI Agents Exploit Hugging Face Infrastructure, Evade Commercial LLM Guardrails
In a shocking revelation, Hugging Face's security team uncovered an intrusion driven by a sophisticated autonomous AI agent system that outsmarted their initial defenses, exposing a limited set of internal datasets and credentials. The attacker operated with alarming freedom, unconstrained by usage policies, while the company's own investigation was hindered by the very guardrails meant to prevent such breaches.
AI-Assisted Phishing Toolkit Exposed in WebDAV Malware Campaign
Meet the AI-assisted phishing toolkit that was left wide open, complete with 1,048 files, including testing notes and live delivery logs - a rare glimpse into a hacker's playbook. The exposed repository revealed a sophisticated operation, even down to a hardcoded path pointing to an open-source AI coding tool.