Meet Bronze Sandcastle, a sneaky China-aligned threat cluster that's been wreaking havoc across Asia and Africa since mid-2025, using a clever trick called Sandboxie DLL sideloading to catch its victims off guard. This group's favorite tactic has been leaving a trail of digital breadcrumbs, allowing researchers to track its activities.
Malicious actors have hijacked over 300 Tor exit relays, redirecting sensitive SSH traffic to their own servers to capture passwords. This sneaky attack, which took place between October 1 and 5, rewrote exit policies on hundreds of relays, tricking users into accepting forged host keys and exposing their login credentials.
Beware: the SafePay ransomware group has already compromised over 600 critical infrastructure organizations worldwide, and their attacks are on the rise. With a recent surge in activity, particularly in Germany, this threat is one you can't afford to ignore.
The PHP security team has warned that details of two high-severity vulnerabilities may be released early if evidence of active exploitation emerges, following a leak on Hacker News that disclosed CVE identifiers for the flaws. The vulnerabilities, which affect PHP versions dating back to PHP 5, could allow for remote code execution and potentially enable server takeover.
A shocking security breach at TeamUpdraft, the creators of UpdraftPlus, has left WordPress sites vulnerable to backdoor attacks after hackers gained unauthorized access to customer data. The breach may have exposed sensitive information, including names, email addresses, and login credentials.
A decade-old test account with a ridiculously weak password, "Password1", left the door wide open for hackers to breach Data Cymru's network, exposing sensitive data of thousands of children and their families in Wales. This shocking lapse in security highlights the devastating consequences of neglecting basic password protection.
Meet Operation FlashHole, a sneaky cyberattack that has been targeting South Korea since July 2025, using a popular security software as a Trojan horse to infect unsuspecting users. The attackers cleverly exploited INISAFE CrossWeb EX, tricking victims into downloading malware through phishing emails and fake websites on GitHub Pages.
Those who've bravely served our nation deserve better than to be targeted by heartless scammers - and thanks to justice being served, one mastermind behind a massive identity theft scheme has pleaded guilty. Robert Wayne Boling Jr., a US citizen, admitted to running a five-year scam that exploited thousands of servicemembers and veterans, stealing their benefits and draining their bank accounts.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Beware: SafePay ransomware has hit over 600 critical infrastructure organizations worldwide, wreaking havoc on businesses and essential services across North America, Europe, Australia, and South America since August 2024. This highly active threat has already left a trail of destruction, and the true impact may be even more extensive than reported.
Meet the Cyber Partisans, a Belarus-aligned hacktivist group that's been wreaking havoc in the Russian healthcare sector, and learn how they managed to hide a sneaky backdoor called Vasilek in VMware Tools during a nearly two-year-long intrusion.
The State Bank of India is investigating a data leak incident that exposed 3,897 customer records on the dark web, part of a massive 375,000-record dataset. The bank is working to verify the authenticity of the leaked data and assess the potential risk to affected customers.
A major security breach has hit TeamUpdraft, the developer behind popular WordPress tools like UpdraftPlus and UpdraftCentral, with hackers gaining unauthorized access to its infrastructure and potentially exposing 400,000 WordPress sites to backdoor attacks. The company has since taken swift action, replacing compromised keys and credentials to contain the damage.
A shocking security lapse at Indian certification authority eMudhra has put 60 million digital certificates at risk, thanks to embarrassingly weak private keys that were little more than single-digit integers. This fundamental flaw undermines the digital trust of millions of websites, requiring extensive verification and cleanup to restore security.
A brazen hack attempt hit auto tech startup IQ.Lvbs, with a rival's IP address linked to repeated tries to steal sensitive data, including its NovaSpark model and private driving files, over a span of just 7 days. The startup swiftly sprang into action, revealing the intrusion and sharing log data to shed light on the incident.
A single misstep led to a massive security breach: a threat actor gained access to a highly sensitive credential used by ConnectWise Cloud Backup, putting hundreds of customers at risk. This simple credential gave hackers the keys to the kingdom, allowing them to request access tokens in any tenant where the application was installed.
Meet the hackers who are taking espionage to a whole new level: Russian GRU hackers are using hands-on tactics to infiltrate top NATO defense firms, with human operators calling the shots every step of the way. This targeted approach has one clear goal - to steal sensitive information.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Zeabur is shutting down its services by the end of 2026 after a massive breach exposed 3.2 million environment-variable records and 321,810 accounts, thanks to leaked internal credentials that allowed attackers to wreak havoc across its platform. The incident, which occurred on October 14-15, 2026, affected shared clusters, GCP servers, and customer disks, highlighting the severity of the breach.
A security researcher sent a cryptic alert to root programs on October 17, 2026, warning of a major issue: eight intermediate certificate authority private keys belonging to eMudhra's emSign hierarchy had been compromised. The breach affects various types of TLS and code-signing certificates, prompting swift action from major browser and software providers.
Ransomware groups are exploiting a vulnerability in Palo Alto Firewalls to gain a foothold in corporate networks and bypass security controls, including multi-factor authentication. This allows them to establish unauthorized VPN connections and wreak havoc on unsuspecting organizations.
Ransomware groups like Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) are exploiting a Palo Alto Networks flaw, CVE-2026-0257, to bypass multi-factor authentication controls and create unauthorized VPN sessions. This vulnerability, patched in May 2026, has been added to the US government's list of known exploited vulnerabilities.
A critical flaw in Fortinet FortiSIEM leaves it vulnerable to unauthenticated remote code execution, allowing attackers to wreak havoc with just a few clicks. This severe vulnerability, tracked as CVE-2026-106173, scores a 9.4 on the CVSS scale, highlighting the urgent need for a fix.
Malicious hackers have unleashed AI-powered agents on the internet, attempting to breach over 1,200 websites across more than 100 companies - and that's just based on the attackers' own records. These autonomous agents were given free rein to work step by step, using open-source tools to find vulnerabilities and plant web shells.
A single compromised login on a file-transfer server went undetected for four months, leading to a massive data breach that exposed sensitive information of around seven million current and former California public school students. The stolen data includes personal details such as names, addresses, birth dates, and more.
Serbian University Rector Vladan Đokić's iPhone was hacked with notorious Pegasus spyware just days before a crucial election, sparking concerns of intimidation. The sophisticated attack, which required no interaction from Đokić, was detected by researchers at the University of Toronto's Citizen Lab.