Google Cloud is speeding up its post-quantum cryptography migration plan, aiming to make the switch by 2029 with a clear plan to protect data from future threats. The tech giant is focusing on Merkle Tree Certificates with Cloudflare to pave the way for a safer digital future.
Apple just patched a major security flaw in its ImageIO system that could let attackers run code on your device - and it's already been used in sneaky spyware campaigns targeting high-profile targets.
The rapid adoption of AI-driven software development has led to a staggering fivefold increase in application creation, but also a shocking 4.31 times more critical and high-severity vulnerabilities in enterprise apps. This surge in vulnerabilities outpaces the speed of fixes, posing a growing risk to businesses.
Wiz AI Tool Exposes Snowflake GitHub Repo Vulnerability Missed by Advanced Security Meet Red Agent, the game-changing AI tool that uncovered a script injection vulnerability in Snowflake's GitHub repository that even advanced security scans missed. This autonomous security researcher not only identified the flaw but also exploited it and assessed the damage - all without human help.
A critical flaw in NASA's open-source ground software, AIT-GUI, has been discovered, exposing it to unauthenticated command functions - and it's a big one, with a 9.4 CVSS rating. The vulnerability affects versions up to 2.5.1, but a fix is available in version 2.5.2.
Microsoft has pulled the plug on the Windows Management Instrumentation Command-line (WMIC) tool, removing it from Windows 11 versions 24H2 and 25H2, and phasing it out from future updates. This move marks the end of an era for a utility that's been a favorite among cybercriminals.
GitLab has urgently patched a critical vulnerability that left public projects open to deletion by anyone, with no login required - a flaw that scored a near-perfect 9.4 on the severity scale. The fix addresses a GraphQL weakness that could let unauthenticated users remotely modify or delete public projects and user data.
In just five days, an AI-assisted commit introduced a workflow injection bug, and an AI attacker autonomously found and abused it, highlighting the vulnerability risks of relying on AI coding assistants. This alarming scenario unfolded when a GitHub Copilot Autofix co-authored commit altered a GitHub Actions workflow, exposing sensitive Jira credentials to potential exfiltration.
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlog
A single misstep in a Certificate Authority can have devastating consequences, as seen in CVE-2026-54121, aka Certighost, which allows a low-privileged domain user to escalate to full domain compromise. This shocking vulnerability exploits a little-known "chase" functionality in Active Directory Certificate Services.
A critical vulnerability in the popular User Profile Builder plugin has put over 40,000 WordPress sites at risk of admin takeover, with a CVSS rating of 9.8; site owners should immediately update to version 3.16.5 or later to patch the flaw.
Mark your calendars: Windows Server 2022 will reach the end of its mainstream support on October 13, 2026, and transition to extended support, where you'll still receive free monthly security updates until October 14, 2031.
Are your organization's secrets safe with AI? The Model Context Protocol's security flaws are exposing enterprise secrets, making it crucial to assess how well your sensitive information is protected when shared with MCP servers.
Microsoft's Exchange team is working on Cumulative Update 1 (CU1) for Exchange Server Subscription Edition, but has delayed its release due to an unexpected bug discovery driven by AI, leaving customers waiting a bit longer for the update that packs recent bug fixes, new features, and code refinements. The team promises it's on the way, but a new timeline isn't available just yet.
Microsoft just patched a nasty zero-day vulnerability, known as LegacyHive, that could let hackers gain administrator privileges on your Windows PC - but thankfully, it's now fixed in the August Patch Tuesday updates.
Researchers at Germany's Helmholtz Center for Information Security have uncovered a vulnerability in Loongson processors that allows data to leak from the L1 data cache, putting sensitive information at risk. This surprising discovery was made by fuzzing Loongson processors and tracing an "uncertain" state in a specific instruction back to its source.
Researchers have made a groundbreaking discovery, proving that commercially available RISC-V chips are vulnerable to devastating Spectre attacks, including Spectre-PHT, Spectre-BTB, Spectre-RSB, and Spectre-STL. They successfully demonstrated attacks with alarming accuracy, achieving up to 100% recall and over 97% precision.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
The US government's quest to modernize the National Vulnerability Database is underway, and it's seeking your input - with an October 13 deadline to share innovative ideas on how to bring this critical cybersecurity resource into the automation age. NIST wants to hear your forward-looking perspectives on how to scale the NVD and supercharge its support for automated security workflows.
Adobe has patched critical vulnerabilities in ColdFusion, Commerce, and Campaign Classic, including a zero-day flaw with a perfect 10.0 CVSS score that could allow hackers to execute arbitrary code or escalate privileges. These high-severity flaws, including operating system command injection and eval injection, require immediate attention to prevent exploitation.
Microsoft's August Patch Tuesday update is a doozy, tackling a whopping 400 vulnerabilities, including an actively exploited zero-day threat that demands immediate attention from sysadmins. With high-risk impacts on confidentiality, integrity, and availability, these fixes should be top priority.
Microsoft just dropped a massive patch update to fix a whopping 398 security flaws in Windows and its software, including a critical vulnerability that's already being exploited by hackers. This crucial update tackles a range of weaknesses, from a zero-day privilege-escalation flaw in a key Windows driver to other publicly known vulnerabilities.
A recent incident in Australia revealed a shocking vulnerability in an API, uncovered by an AI agent working on behalf of a user named Andrew to book gym classes. The AI not only found a way to book classes weeks in advance, but also managed to bump Andrew to the top of a waitlist, leaving many to wonder how such a gaping hole in security went unnoticed.
A critical flaw in SAP Commerce Cloud, rated 10.0 on the CVSS scale, allows hackers to execute malicious code without any authentication, putting your entire system at risk. This severe vulnerability can be exploited with specially crafted input, making it essential to patch ASAP.
The National Institute for Standards and Technology is calling for a major revamp of its National Vulnerability Database to better tackle software vulnerabilities in the AI-driven era. It's seeking public input on how to modernize the database and its processes to stay ahead of emerging threats.
Microsoft's August Patch Tuesday update is a doozy, tackling a whopping 400 security flaws, including a zero-day vulnerability that's already being exploited by hackers. This massive release also includes fixes for two other zero-day vulnerabilities that were publicly disclosed.