[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentEmerging Threats
Project CAV3RN Exploits Outlook Calendar for Covert C2 Communications
Meet the sneaky CAV3RN communication module that's hiding in plain sight, using Outlook calendar events and DNS AAAA records to secretly communicate with its command-and-control center. Its clever disguise is courtesy of AzureCommunication.dll, a .NET Native AOT module that's got experts curious.
AI Emerges as Force Multiplier in Cyberattacks
As AI continues to evolve, it's crucial to treat AI-driven threats as a top priority, as they can significantly accelerate and scale attacks. By leveraging AI, cyber attackers can speed up their operations, but their tactics remain familiar, including credential theft, phishing, and ransomware.
BitLocker Extortion Tactics Target Firms via Printer Ransom Notes
Cybercriminals are using a clever and intimidating tactic to extort money from companies, deploying BitLocker to lock down files and leaving ransom notes printed out on physical printers. The attackers guarantee their promises will be kept, boasting a flawless online reputation to back up their threats.
Anubis Ransomware Targets Coca-Cola's Fairlife, Threatens Data Leak
The Anubis ransomware gang has claimed responsibility for a cyberattack on Fairlife, a subsidiary of The Coca-Cola Company, boasting that they encrypted the company's systems and stole a whopping one terabyte of corporate data. With a deadline looming, the gang is threatening to leak the sensitive information unless Coca-Cola agrees to negotiate by the end of the week.
WordPress Sites Targeted as Hackers Exploit Critical wp2shell Flaws
Hackers are actively exploiting critical WordPress vulnerabilities, CVE-2026-63030 and CVE-2026-60137, to inject malicious plugins and PHP webshells, putting countless sites at risk. Attackers are using mass-scanning and plugin upload abuse to gain control, making it essential for WordPress users to take immediate action.
German Authorities Disrupt Kratos Phishing Kit Infrastructure
German authorities have successfully dismantled the infrastructure behind the notorious Kratos phishing kit, a major player in the world of cybercrime. This disruption is a significant win for cybersecurity, thanks to the coordinated efforts of the Central Office for Combating Internet Crime and the Federal Criminal Police.
Craneware Data Breach Exposes Healthcare Sector Risks
A recent data breach at Craneware, a software provider for healthcare, has exposed the sector to new risks, highlighting that the initial compromise is just the beginning of a larger story. The breach, which involved unauthorized access to a subset of data, has already revealed a significant volume of sensitive file names were viewed and exfiltrated.
Qilin Ransomware Exploits Palo Alto Networks Flaw for Initial Access
In a recent wave of attacks, hackers exploited a high-severity flaw in Palo Alto Networks' PAN-OS software to gain initial access for Qilin ransomware attacks. This vulnerability, known as CVE-2026-0257, allowed attackers to bypass authentication and establish VPN sessions without valid credentials.
SharePoint Flaw CVE-2026-50522 Sees Active Exploitation After PoC Release
Attackers are actively exploiting a critical SharePoint vulnerability, CVE-2026-50522, using a single request to gain persistent access by pulling SharePoint machine keys. This flaw, patched by Microsoft in July, has a CVSS score of 9.8 and allows attackers to inject and execute code remotely on the SharePoint Server.
Russian Hacker Exploits Claude AI in Commercial Pentest Platform
A Russian hacker spent just $4 on a grey-market Claude API key, and within months, was selling a powerful commercial pentest tool built using jailbreak techniques to exploit the AI. This all started with a detailed tutorial on March 31, where six clever methods were shared to bypass Claude's safety filters.
Suno Data Breach Exposes 55M Users
A massive data breach at AI music platform Suno has exposed a staggering 55 million user accounts, a figure confirmed by breach tracking service Have I Been Pwned. This huge leak puts millions of users at risk.
Patching Speed Falls Behind as AI-Generated Exploits Rise
The clock is ticking faster than ever: AI can now turn software patches into working exploits in under an hour, shattering the old assumption that reverse-engineers had weeks to spare. Anthropic's Claude Mythos Preview has already proven its mettle, converting 18 Firefox patches into 8 code-execution exploits at alarming speed.
Invisible Screen Text Exposes Android AI Agents to Code Injection Attacks
Researchers found that a simple payload could launch a code injection attack on four open-source Android agent frameworks, successfully executing commands on the host's system in every trial. This alarming vulnerability allows attackers to exploit AI agents by manipulating text on the screen, turning a harmless string into a malicious command.
Ransomware Attacks Exploited Compromised Identities in 79% of Incidents
Ransomware attacks are often sparked by something surprisingly simple: 79% of incidents start with compromised identities, highlighting the vulnerability of legitimate user logins and credentials. This means that in nearly 8 out of 10 cases, attackers gain a foothold using stolen or hijacked identities rather than complex hacking techniques.
Ransomware Landscape Fractures as New Groups Proliferate
The ransomware landscape is shattering into more factions than ever, with over one new group emerging every week in 2026, according to the Black Kite Ransomware Report. This explosion of new players has led to a surge in attacks, with 61 new groups appearing in just one year alone.
FBI Warns of Deepfake Videos Targeting IC3 Leadership
Impersonation scams have taken a chilling turn, with scammers now using deepfake videos and AI-generated content to convincingly pose as government officials, including senior FBI leadership. These sophisticated cons combine social media impersonation, fake complaint portals, and high-fidelity videos to re-target previous fraud victims.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Qilin Ransomware Gang Exploits Palo Alto VPN Bug in Ongoing Attacks
The Qilin ransomware gang is actively exploiting a critical vulnerability in Palo Alto Networks' VPN software, CVE-2026-0257, to breach security and launch attacks, despite a patch being released on May 13. This alarming development follows reports of multiple intrusions by Qilin in June, highlighting the urgent need for updates.
North Korean Hackers Expose Web3 Pros to Sophisticated ClickFake Scams
One in three employees have admitted to using company tech for personal gain, and North Korean hackers are exploiting this vulnerability with a clever recruitment scam that can give them access to corporate funds. The sophisticated scheme, attributed to the notorious Famous Chollima group, targets Web3 and cryptocurrency pros with fake job offers on popular platforms like LinkedIn and Telegram.
Craneware Discloses Data Theft in Cyber Incident
A recent cyber incident at healthcare finance software provider Craneware exposed a significant volume of sensitive data, including customer and business partner records, highlighting the ease with which determined attackers can carry out data exfiltration. Even seemingly low-severity incidents can pose a real risk of data exposure.
WordPress Exploitation Surges as Public Exploit Fuels Remote Code Execution
A surge in WordPress exploitations is underway as hackers leverage a public exploit to enable remote code execution on vulnerable sites, posing a threat to organizations of all sizes and industries. The flaw, dubbed "wp2shell," allows unauthenticated attacks on default WordPress installations, sparking widespread scanning and compromise.
ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution
A critical vulnerability in the ServiceNow AI Platform, known as CVE-2026-6875, has been discovered, allowing unauthenticated users to execute arbitrary code and potentially compromise entire instances and connected proxy servers. This severe flaw has been assigned a CVSS score of 9.5, highlighting the urgent need for enhanced security measures.
ENCFORGE Ransomware Targets AI Model Files in Langflow Attack
A new ransomware called ENCFORGE is targeting AI model files, exploiting a high-severity flaw in Langflow to deploy a custom-built payload that threatens machine learning systems. This highly specialized attack focuses on encrypting critical AI data, including PyTorch, TensorFlow, and Hugging Face files.
Cyberattack Disrupts Coca-Cola's Fairlife Production Operations
A cyberattack has forced Coca-Cola's fairlife, LLC to temporarily halt production in the US, but the company assures that product quality and safety remain unaffected. The incident involved unauthorized access to production-related systems, prompting a swift suspension of operations.
Estée Lauder Breach Exposes Sensitive Data via Oracle Flaw
Estée Lauder's HR system was hacked through a vulnerability in Oracle's E-Business Suite, exposing sensitive personal data of certain individuals after an unauthorized access on August 9, 2025. The breach, discovered on June 19, 2026, has raised concerns about data security for the cosmetics giant with 57,000 employees.