Security Insights
Latest threat analysis, industry news, and security best practices from our expert team.
GhostAction Supply Chain Attack: Credential Stealer Disguised as a Font File in 94 GitHub Repos — Detection and Response Guide
Introduction The threat actor behind the GhostAction supply chain campaign has evolved its tradecraft again — and this time the delivery veh...
Boston Children's Health Physicians and XTIUM $2.7M HIPAA Settlement: What Healthcare Defenders Must Fix Now
A $2.7M Lesson in Security Fundamentals Boston Children's Health Physicians (BCHP) and its managed IT service provider, XTIUM, have agreed t...
Eptura Archibus Authentication Bypass and Unauthenticated RCE — Detection and Remediation Guide
Overview Rapid7’s Vector Command red-team service identified three high-impact vulnerabilities in Eptura Archibus, a platform used to centra...
Weekly Threat Recap Defense Playbook: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, and 700 Supermarkets Hit — What to Patch, Hunt, and Harden Now
Introduction This week's recap is a reminder that the most damaging incidents rarely announce themselves. Between a surge of 98 zero-day vul...
Securing AI Agents From the Outside In: A Defender's Playbook for the New Privileged User
Introduction For two decades, identity and access management programs have been built around a single assumption: the privileged user is a p...
Securing AI Agent Identities: Microsoft Entra Agent ID and Tenable One Cloud Exposure Defense Guide
The New Identity Crisis Nobody Is Watching Over the past 18 months, I've watched enterprise cloud tenants quietly accumulate a new class of ...
Drupal Core RCE in Entity List and Field UI Modules: Detection and Remediation Guide for Rapid Exploitation Risk
Introduction Drupal's security team has issued a warning that a critical remote code execution flaw in Drupal core — impacting the Entity Li...
F5 Out-of-Band Patches for Critical NGINX RCE Flaws: Detection, Hunting, and Remediation Guide
F5 Ships Emergency Patches for Critical NGINX Vulnerabilities — What Defenders Must Do Now F5 has pushed out-of-band security patches for mu...
Rank Math PRO Supply Chain Compromise: Detection, Triage, and Remediation Guide for WordPress Defenders
When a widely deployed commercial WordPress plugin becomes the delivery vehicle for malware, every site running it inherits the risk instant...