[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentMalware & Ransomware
Adtech Firm Exposes Online Ads as Spyware Vector
Meet Discover-Tech, an Israeli adtech firm with a shady secret: its Controlium platform has been caught exploiting online ads to spy on users across over 70,000 mobile apps and 120,000 websites.
Danfoss Controllers Disappear After Cyber-Attack
A massive 71% of internet-exposed Danfoss StoreView control panels in France vanished within just three days following a cyber-attack that crippled hundreds of supermarkets, suggesting a frantic effort to pull systems offline rather than fix them. This sudden disappearance was tracked by Censys researchers, who monitored the dramatic decline from 1,825 exposed hosts on October 11 to just 537 by October 14.
Aoki Infostealer Expands to Target AI Coding Assistant Credentials
Stolen AI coding assistant credentials can be a goldmine for attackers, allowing them to resell or rack up usage charges on the victim's account, and even gain a foothold into the developer's broader environment. The Aoki infostealer has evolved to target these valuable credentials, expanding its reach beyond browser data and cryptocurrency wallets.
Fake AI Attacks Target US Companies via Impersonated Brands
US companies are under attack by fake AI campaigns that impersonate trusted brands like Claude, ChatGPT, and Copilot, spreading malware and stealing sensitive data. Attackers are using clever tactics, such as sponsored search results and fake download websites, to trick victims into compromising their business accounts.
Air Force Exposed to Malware Risk via Unsecured USB Drives
The Air Force's use of CDs and later USB drives to transfer mission data between unclassified and classified systems created a vulnerability that allowed malware to slip into sensitive areas, reveals Justin Henkel, former Air Force IT security expert. This simple habit, born from convenience, ended up bridging the gap between secure and unsecure environments.
Microsoft Disrupts Global Phishing Network Behind 1 Billion Messages
Microsoft and Japanese police have joined forces to take down a notorious phishing network, known as Yam Store or Storm-3119, that was responsible for a staggering 1 billion phishing emails and texts sent to over 75,000 organizations since January 2026. This underground marketplace was selling compromised accounts, licenses, and storage to threat actors, fueling a massive wave of cyber scams.
AhsayCBS Flaws Get Fresh Fixes After Exploitation
Don't wait until it's too late - apply the AhsayCBS hotfix immediately to shield your environment and customer data from severe vulnerabilities that can be exploited for unauthenticated remote code execution. Reboot your server after applying the fix to ensure you're fully protected.
Langflow Exploit Attempts Surge Amid Authenticated RCE Flaw
Authenticated hackers are on the hunt, with 1,423 attempts recorded to exploit a critical remote-code-execution flaw in Langflow, a vulnerability that scores a near-perfect 9.9 on the CVSS scale. This alarming spike highlights how quickly attackers pounce on high-risk weaknesses.
GhostAction Exploits 1,900 GitHub Accounts, Hits 30,000 Repositories
Malicious actors launched a massive attack, dubbed GhostAction, that compromised nearly 1,900 GitHub accounts and infected over 30,000 repositories with a malicious workflow. The concentrated surge, which occurred on October 8-9, 2026, put thousands of users and organizations at risk.
Palo Alto Networks Fixes Authenticated RCE Flaw Under Active Exploitation
Palo Alto Networks has patched a critical vulnerability, CVE-2026-0322, that allowed hackers to execute malicious code with root privileges on its firewalls - and it was under active attack. This authenticated remote code execution flaw, scoring 8.6 in severity, could be exploited by anyone with network access to the PAN-OS management interface.
Cisco Email Flaw Exploited in Zero-Day Attacks
Cisco is urging customers to upgrade to a fixed software release after a critical vulnerability in its Secure Email Gateway was exploited in active zero-day attacks, allowing hackers to gain root access with just a malicious email. The flaw, scored 9.8 out of 10 on the CVSS scale, enables remote attackers to write files and execute commands with root privileges on the appliance operating system.
Microsoft Disrupts Vast Chinese-Language Phishing Kit Network
Microsoft swooped in to dismantle a massive Chinese-language phishing kit network that had been bombarding over 75,000 organizations worldwide with a staggering 1 billion+ emails and SMS messages since January. The campaigns, tracked as Storm-2990, were fueled by a commercial ecosystem of customizable phishing kits.
Researchers Craft Billion-User Chrome Exploit in Six Days
In just six days, a team of four researchers harnessed the power of a publicly available AI model to craft a Chrome exploit that earned them a whopping $250,000 bounty from Google. With the help of OpenAI's GPT-5.6 Sol model, they chained together three zero-day Chrome vulnerabilities, proving that innovation and speed can pay off big time.
Microsoft Disrupts Phishing Kits Behind 1 Billion Scam Messages
Microsoft and its partners have struck a major blow against cybercrime, disrupting three notorious phishing kits responsible for over 1 billion scam messages sent to 75,000 organizations worldwide. This significant takedown targets the tools behind a massive phishing operation.
Hackers Exploit Flaw in Collabora's CODE App to Backdoor Nextcloud Servers
Hackers have exploited a critical flaw in Collabora's CODE app to compromise Nextcloud servers, planting web shells to gain unauthorized access. This vulnerability, tracked as CVE-2026-110447, highlights the importance of keeping your Nextcloud server security up to date.
Cisco Discloses Active Attacks on Secure Email Gateway Flaw
Cisco is warning users of its Secure Email Gateway of an actively exploited flaw that could allow hackers to run commands as root, giving them total control of the system. This critical vulnerability, scored 9.8, is being targeted by attackers who are sending crafted email attachments to take advantage of the weakness.
[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
Ivanti Discloses Zero-Day Exploits in Connect Secure
Ivanti has sounded the alarm on zero-day exploits targeting its Connect Secure software, warning that a limited number of customers have already been affected. The company has released urgent updates to patch the vulnerabilities and is urging customers to act fast to avoid falling prey to these attacks.
Hackers Exploit Refrigeration Systems in 700+ Retailers
Cyberattacks on retailers just got a whole lot chillier - literally, as hackers exploited refrigeration systems in over 700 stores, causing food spoilage, fires, and massive losses. By breaching outdated software, attackers remotely cranked up temperatures to as high as 122°F, leaving a trail of destruction in their wake.
Forescout Researchers Expose ROMULUS Malware Server Leveraging ClickFix
Forescout researchers have uncovered a cunning malware server, dubbed ROMULUS, that's linked to a notorious campaign called ClickFix, and what's alarming is that it can deliver multiple payloads. This discovery was made by Vedere Labs, part of Forescout Research, who identified six servers running the ROMULUS platform.
Law Enforcement Disrupts Phishing Network Behind 1 Billion Malicious Messages
A massive phishing network responsible for sending over 1 billion malicious messages to 75,000 organizations in 150 countries has been disrupted by law enforcement, bringing relief to countless individuals and businesses worldwide. This enormous operation had been targeting victims with sophisticated device-code phishing scams, with over 750 million messages aimed specifically at Microsoft customers.
CISA Warns of Active Ivanti Connect Secure Exploit Attempts
Warning signs are flashing: 105 attempted hacks have targeted Ivanti Connect Secure systems in a short span, exploiting a severe authentication-bypass bug that lets attackers run malicious commands remotely. This zero-day vulnerability, tracked as CVE-2026-104935, is under active attack, putting unpatched systems at risk.
Hirudo Trojan Exploits Patched Banking Apps to Evade Security Checks
Meet Hirudo, a sneaky Trojan that's exploiting patched banking apps to slip past security checks and wreak havoc on unsuspecting users. This malicious mastermind combines credential theft, device takeover, and even camera capture to pull off its dastardly heists.
Hirudo Malware Disrupts Banking Apps with Advanced Evasion Tactics
This sneaky malware outsmarts banking apps by hijacking their own defenses, essentially turning their security against them. By cleverly replacing legitimate apps with malicious versions, Hirudo malware intercepts sensitive info, putting victims' financial data at risk.
Cyber-Attack Targets French Supermarket Refrigeration Controllers
A cyber-attack on French supermarkets' refrigeration controllers has caused food stock disruptions, with hackers altering freezer settings at an alarming rate - in one case, even changing temperatures from -22°C to 150°C. This critical breach has raised concerns about the preservation of food products and the security of essential systems.