Grivyonx Intelligence Hub
Zero-days, ransomware, data breaches and active exploitation, explained with practical defence advice.
Industrial companies are increasingly treating cybersecurity risk as a primary obstacle to expansion, with more than a third of organizations citing it as a top barrier. The growing complexity of connected operations, rapid AI integration, and the convergence of IT and OT environments are all contributing to a dramatically heightened threat surface.
By Gourav Rajput
A SharePoint Server vulnerability initially classified by Microsoft as a low-risk spoofing flaw actually enables authenticated remote code execution, according to detailed technical analysis published by Viettel Cyber Security researcher Dinh Ho Anh Khoa. The issue affects SharePoint Server 2016, 2019, and Subscription Edition, requiring urgent patch deployment despite the modest CVSS score originally assigned.
By Gourav Rajput
The npm ecosystem has encountered a new stealthy threat in the form of a counterfeit package called indexed-btree. Disguised to look like a genuine B‑tree utility, this package conceals its malicious loader inside the application’s runtime code, evading conventional lifecycle hooks. The discovery highlights a growing trend of attackers adapting their methods to outmaneuver existing security controls. Researchers note that the fake package mirrors the behavior of a legitimate library, making it difficult for developers to spot the compromise through visual inspection alone. By embedding its payload after the code has started executing, the attackers bypass typical script‑based detection mechanisms that rely on pre‑install or post‑install hooks.
By Gourav Rajput
The threat actor known as SideCopy has shifted its strategic focus, moving beyond government agencies to target the Indian academic sector through advanced spear-phishing tactics. By utilizing ReverseRAT and abusing legitimate system tools, these attackers aim to bypass traditional security perimeters in educational institutions.
By Gourav Rajput
The U.S. Cybersecurity and Infrastructure Security Agency has added a critical vulnerability in Zyxel GS1900 series switches to its Known Exploited Vulnerabilities catalog, signaling confirmed active attacks. Tracked as CVE-2026-7273, this stack-based buffer overflow flaw carries a CVSS score of 8.8 and allows attackers to achieve arbitrary code execution with elevated privileges. Simultaneously, exploitation activity targeting Veeam backup solutions has intensified, creating a dual threat landscape for organizations managing network infrastructure and data protection platforms. Security teams must prioritize immediate patching and implement compensating controls to reduce exposure.
By Gourav Rajput
In a stunning turn of events, the notorious threat actor ShinyHunters has compromised the infrastructure of the Clop ransomware gang, defacing their dark web leak site and claiming possession of sensitive victim data. This unprecedented 'hacker vs. hacker' incident creates a dangerous new dynamic for organizations that previously paid ransoms to Clop, potentially exposing them to a second wave of extortion attempts.
By Gourav Rajput
A fraudulent LastPass Authenticator installer discovered on GitHub uses a legitimate Microsoft-signed Windows kernel driver to disable antivirus and endpoint detection tools, paving the way for a password-stealing payload. Researchers from LastPass and Delphos Labs detailed the campaign on September 17.
By Gourav Rajput
The Contagious Interview campaign has compromised 30,000 devices globally and siphoned over $10.7 million in cryptocurrency from thousands of wallets. This joint cybersecurity advisory reveals how sophisticated the attackers are and highlights the urgent need for stronger device security.
By Gourav Rajput
Google was fined €403 million by Ireland's Data Protection Commission for improperly handling location data from 2018 to 2020. The regulatory body ordered immediate compliance reforms and mandated significant changes to how the tech giant processes personal geolocation information.
By Gourav Rajput
Security researchers have uncovered a novel campaign named TASK#STOMP that leverages a PowerShell‑based backdoor to siphon sensitive information from compromised machines. The malware not only extracts business documents and Wi‑Fi credentials but also monitors the file system in real time, captures clipboard contents, and records screenshots. This stealthy operation highlights the growing sophistication of file‑less attacks and the urgent need for robust detection mechanisms.
By Gourav Rajput
A newly identified remote access trojan known as ChainScript is being distributed through sophisticated ClickFix-style social engineering lures. The malware disguises itself as popular applications. Threat actors behind the campaign have demonstrated an evolving approach to infrastructure management by leveraging Polygon blockchain for rotating command-and-control servers.
By Gourav Rajput
Jade Sleet, a North Korean state‑backed group, has shifted toward embedding custom backdoors in developers' build pipelines, as seen in a recent breach of a small Indian IT firm that installed FLATROOF and ROOFDECK backdoors. The attackers used Apple‑signed tools to evade detection while maintaining persistent access through compromised build servers.
By Gourav Rajput
Fortinet has warned that a critical unauthenticated remote code execution flaw in Orkes Conductor is being actively exploited. The vulnerability, tracked as CVE-2026-58138, affects versions prior to 3.30.2 and carries a CVSS v3.1 score of 9.8. Attackers can leverage the flaw to execute arbitrary code on exposed workflow servers without any authentication, posing a severe risk to data integrity and service availability.
By Gourav Rajput
The U.S. Cybersecurity and Infrastructure Security Agency has expanded its Known Exploited Vulnerabilities catalog with three critical Linux kernel flaws, signaling immediate danger for unpatched systems. Topping the list is CVE-2025-39682, a maximum-severity bug in the TLS receive path that allows attackers to execute code or crash systems remotely. This move mandates federal agencies to remediate these flaws immediately, while private sector organizations are strongly advised to prioritize patching to prevent active exploitation campaigns.
By Gourav Rajput
A critical zero-day vulnerability designated CVE-2026-76460 has been discovered in Cisco's Identity Services Engine (ISE), allowing attackers to bypass API endpoint authentication entirely. With a maximum CVSS severity score of 10 out of 10, this flaw poses an urgent threat to enterprise networks worldwide. Security teams are scrambling to patch affected systems before exploitation.
By Gourav Rajput
A security researcher has published working exploit code targeting four Linux kernel vulnerabilities that could allow local users to escalate privileges to root level. Organizations running outdated kernels face immediate risk as the proof-of-concept code is now publicly available.
By Gourav Rajput
WordPress has released critical security updates addressing a vulnerability chain dubbed Click2Shell, which enables attackers to silently install themes from the official repository on sites where an administrator clicks a malicious link. The flaw, discovered by pwn.ai researchers, combines a cross-site request forgery weakness in the theme installer with a subsequent code execution path, creating a dangerous single-click compromise vector for privileged users.
By Gourav Rajput
In July 2025, a former content delivery network domain was re-registered. Despite the CDN closing years ago, thousands of websites and documentation pages continue to reference the abandoned hostname.
By Gourav Rajput
