Grivyonx Intelligence Hub
Zero-days, ransomware, data breaches and active exploitation, explained with practical defence advice.
A seemingly harmless feature in GitLab that lets users file issues via email can become a serious security problem if the generated address is exposed. Attackers who obtain this address can impersonate you, push commits to any branch you can access, and trigger CI/CD pipelines under your identity. This article explains the mechanics of the risk, its potential impact, and how to safeguard your projects.
By Gourav Rajput
Security researchers have uncovered a chained vulnerability dubbed MikroTrick that allows attackers to seize complete control of MikroTik routers exposed to the internet without needing a password or SSH key. By combining an SSH state‑machine flaw with an argument‑injection bug in the login process, threat actors can bypass authentication and execute arbitrary commands. This article breaks down the technical details, observed exploitation, and practical defenses.
By Gourav Rajput
Security researchers have uncovered a sophisticated supply chain compromise affecting legitimate MemTensor packages distributed through both npm and PyPI repositories. The attack introduces sckit, a cross-platform Go-based implant designed to harvest credentials across Windows, Linux, and macOS environments. Multiple security firms including Aikido, SafeDep, Socket, and StepSecurity have confirmed the malicious activity.
By Gourav Rajput
OpenAI has announced the expansion of its Daybreak cybersecurity initiative to support Ukraine's government in defending critical civilian digital infrastructure. The move comes as cyber threats continue to evolve alongside geopolitical tensions, marking a significant step in leveraging AI for national security purposes.
By Gourav Rajput
Two critical vulnerabilities in cPanel's infrastructure allow malicious actors to execute code with root privileges and manipulate databases belonging to other hosting accounts. The flaws affect CalDAV, CardDAV services, and the WP Toolkit plugin, requiring immediate patching.
By Gourav Rajput
A severe use-after-free flaw in the Linux kernel's AF_UNIX socket subsystem has been exploited in the wild, allowing attackers to break out of containers and escalate privileges to root on the host machine. Despite being patched upstream in August, Ubuntu's Long Term Support releases including 26.04, 24.04, and 22.04 still lack official fixes, leaving millions of deployments exposed.
By Gourav Rajput
F5 has disclosed and patched a critical zero-day vulnerability in its BIG-IP Access Policy Manager that could allow attackers to execute arbitrary code remotely without authentication. The flaw specifically targets OAuth authorization server configurations.
By Gourav Rajput
A Chinese threat actor known as UTA0565 has leveraged a previously undisclosed chain of zero-day vulnerabilities spanning Google Chrome and Microsoft Windows to compromise targets through fraudulent websites. The campaign, first observed in early September 2026, demonstrates the growing sophistication of state-sponsored cyber operations. Security researchers are now scrambling to understand the full scope of the breach and the capabilities of the newly identified CLEANGULP malware.
By Gourav Rajput
The latest security research highlights a critical flaw in Next.js' ImageResponse component. This vulnerability enables unauthorized servers to execute malicious code by manipulating SVG inputs. Vercel, the creator of Next.js, recently released a fix on September 22nd to address the issue.
By Gourav Rajput
The cyber extortion group ShinyHunters says it has infiltrated the U.S. Federal Bureau of Investigation and obtained confidential information on current and former agents, as well as individuals who applied for FBI positions. The claim, posted on a dark web forum, includes a statement that the group "holds very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job." This alleged breach raises serious questions about the bureau's internal security measures and the potential exposure of both operational and personal records.
By Gourav Rajput
A strong partnership between the chief information security officer and chief marketing officer creates a shared language that aligns cybersecurity risks with brand messaging, ensuring clear, credible communication during potential crises. By establishing regular touchpoints, joint crisis plans, and translating technical threats into reputational impact, organizations outperform competitors that treat security as a purely operational IT function.
By Gourav Rajput
In a major legal and technical operation, Microsoft has disrupted the EvilTokens phishing-as-a-service platform, seizing infrastructure used to bypass multi-factor authentication on Microsoft 365 accounts. The action highlights the evolving sophistication of identity-based attacks.
By Gourav Rajput
The Cybersecurity and Infrastructure Security Agency has released a comprehensive guide urging organizations to adopt deception-based defense strategies. By deploying traps, honeypots, and false signals, even resource-strapped teams can mislead attackers and gather critical threat intelligence. This approach turns the tables on cybercriminals, making networks far harder to compromise.
By Gourav Rajput
In late July, attackers leveraged an undisclosed vulnerability in Check Point’s Security Management Server, enabling unauthenticated script execution. The flaw, cataloged as CVE‑2026‑93616, was patched in September. The incident highlights the importance of rapid vulnerability response and continuous monitoring.
By Gourav Rajput
Researchers have uncovered a malicious npm package named "tw-pkgprobe-7731" that masquerades as a security tool for Twilio integrations. While its outer appearance suggests legitimacy, the package quietly attempts to harvest sensitive developer credentials, posing a serious risk to organizations adopting new dependencies without thorough vetting.
By Gourav Rajput
A threat actor group known as Shai-Hulud has successfully infiltrated the systems of cybersecurity firm CrowdSec, stealing 170 private repositories. The breach was traced back to a stolen OAuth token from a former employee's device, linked to the broader TanStack npm supply chain attack. This incident highlights the growing vulnerability of software supply chains.
By Gourav Rajput
Security researcher Abdelhamid Naceri has published a proof‑of‑concept tool that deliberately consumes all available disk space, preventing Microsoft Defender from installing platform and signature updates. The release highlights a stark vulnerability in a widely used antivirus solution and raises questions about how organizations guard against such low‑level disruptions.
By Gourav Rajput
A critical CVSS 10.0 vulnerability in VeloCloud Orchestrator enables remote attackers to bypass authentication and escalate privileges in certificate-based SD-WAN deployments. Arista disclosed the flaw on September 22, confirming active exploitation in the wild.
By Gourav Rajput
