Ubiquiti has urgently patched a critical vulnerability in its UniFi OS, warning customers of a maximum-severity flaw that could allow malicious actors to inject commands on host devices - and it's crucial to upgrade to version 3.4.20 or later to stay safe.
Tenda routers have a shocking security flaw: a hidden backdoor that can give attackers full control of your device, allowing them to hijack your admin access. This vulnerability, tracked as CVE-2026-11405, lets hackers easily bypass standard login security and take over your router.
The UK government's Cyber Resilience Pledge has gained momentum with 60 signatories, demonstrating a united front against cyber threats. By signing the pledge, businesses acknowledge that cyber resilience is a top priority, not just an IT issue, but a business imperative.
Joining forces to combat cyber threats, the UK government has launched a groundbreaking Cyber Resilience Pledge, signed by over 60 organisations, to strengthen board-level accountability and supply chain security. By making three key commitments, signatories can bolster their defences and stay ahead of emerging threats.
Critical software flaws in BeyondTrust's Remote Support and Privileged Remote Access products could allow hackers to bypass authentication and gain unauthorized access, potentially putting your system integrity at risk. Two vulnerabilities, CVE-2026-40138 and CVE-2026-40139, have been identified, highlighting the urgent need for an update.
BeyondTrust has patched critical flaws in its Remote Support and Privileged Remote Access software that could let hackers take control of affected systems - but you can safeguard yours with a simple update to version 25.3.3 or higher.
A newly discovered 16-year-old flaw in Linux's KVM, nicknamed "Januscape," allows guest virtual machines to break free and interact with their host systems on Intel and AMD machines, potentially leading to full host code execution. This vulnerability, tracked as CVE-2026-53359, can cause a host to panic and be exploited for malicious purposes.
The irony of AI-powered vulnerability discovery is that it's creating an overwhelming crisis: despite spotting weaknesses at unprecedented speed and scale, organizations are no safer - just more inundated. The harsh truth is that a vulnerability is just a clue, not risk, and the real challenge lies in prioritizing and assessing true threats.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Researchers have uncovered alarming flaws in confidential computing, including a high-severity vulnerability rated 7.5, which can trick cryptographic systems into verifying the wrong machine, putting trust at risk. This weakness was found in protocols like attested TLS, which failed to ensure sensitive data reaches its intended destination.
Millions of embedded devices are at risk of code execution due to seven vulnerabilities in the widely-used FatFs filesystem, which can be easily exploited with physical access, effectively leading to a jailbreak. This set of flaws, ranging from medium to high severity, poses a significant threat to device security.
A newly discovered Linux flaw, CVE-2026-46242, allows ordinary users to gain root access to a machine, and even Android devices are vulnerable. This alarming vulnerability, known as Bad Epoll, can be exploited with ease, but thankfully, a working fix is now available.
A newly discovered vulnerability in Schneider Electric's Floating License Manager could put industrial facilities at risk, allowing attackers to exploit a weakness in the FlexNet Publisher component. This security gap stems from a hardcoded OpenSSL configuration path that can be manipulated to load malicious DLLs.
With around 530 vulnerabilities discovered in under two years, the OpenClaw ecosystem poses a growing security threat to its users, putting their sensitive data at risk. Its design, while user-friendly, may be inadvertently leaving users exposed.
Adobe is racing against the clock to keep you safe, with emergency updates for ColdFusion and Campaign Classic that squash critical flaws allowing hackers to wreak havoc. The timely patches fix vulnerabilities that could lead to devastating attacks, from code execution to security breaches.
Despite having a high awareness of cyber risks, many organizations are struggling to build operational resilience, with gaps in visibility, capability, priorities, and culture hindering their ability to effectively manage threats. The 2026 Bitdefender Cybersecurity Assessment reveals a concerning disconnect between knowing the risks and taking action to mitigate them.
Microsoft is speeding up its transition to post-quantum cryptography, aiming to integrate quantum-safe security into its critical products and services by 2029, in response to rapid advancements in quantum computing. This accelerated timeline is part of its effort to stay ahead of emerging threats and secure trust chains.
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlog
Microsoft is speeding up its post-quantum cryptography push, aiming to complete the transition by 2029, as advances in quantum research increase the urgency to protect against potential cyber threats. The move is driven by the risk of cryptographically relevant quantum computers emerging sooner than expected, capable of cracking current encryption methods.
Citrix has uncovered a high-severity flaw in its NetScaler appliances, adding to concerns about the trend of fragile memory management in these systems, which can lead to sensitive data leaks with just a misconfiguration. This latest vulnerability, CVE-2026-8451, was discovered by watchTowr researchers and is part of six newly disclosed vulnerabilities in Citrix's NetScaler ADC and Gateway appliances.
Citrix has patched six high-risk vulnerabilities in its NetScaler software, including flaws that could expose users to file reads and devastating denial-of-service attacks. These critical updates address issues with CVSS scores as high as 8.8, emphasizing the urgent need for users to apply the fixes.
A critical flaw in Progress Kemp LoadMaster, known as CVE-2026-8037, allows attackers to run root commands without authentication - but a patch is now available to fix this gaping security hole. This vulnerability, scoring a severe 9.8, can be exploited with a simple crafted API request.
Apple is stepping up its security game by releasing patches for over three dozen WebKit flaws, discovered with the help of AI, to protect its users from potential hacking threats. By speeding up its update process, Apple aims to outpace malicious hackers who are leveraging AI to develop exploits at an alarming rate.
Meet the badkeys project, an open-source service that scans public keys for vulnerabilities, which recently uncovered a surprising pattern of weak RSA keys in widespread use. By analyzing a massive dataset of real-world public keys, the team discovered a substantial number of keys with a suspicious structure, featuring regularly spaced blocks of zero bits and random data.
Researchers have uncovered a shocking vulnerability in AI model security, revealing that a simple formatting trick used to separate system instructions from user requests has become a critical weakness. This flaw, known as role confusion, threatens the very foundation of modern AI systems.
The clock is ticking: by December 31, 2030, federal high-value systems must adopt post-quantum cryptography for key establishment, and by December 31, 2031, for digital signatures too. Are your systems ready to beat the quantum deadline?