Grivyonx Intelligence Hub
Zero-days, ransomware, data breaches and active exploitation, explained with practical defence advice.
A critical vulnerability discovered in LiteSpeed Web Server Enterprise poses a severe threat to shared hosting environments, potentially allowing a single low-privilege account to escalate privileges and gain full root access to the entire server. cPanel issued an urgent advisory highlighting the risks and urging administrators to act immediately.
By Gourav Rajput
Cisco has issued an urgent advisory regarding a critical zero-day vulnerability designated CVE-2026-76461 affecting its Secure Email Gateway. With a CVSS score of 9.8, the flaw is already being actively exploited by threat actors in the wild, enabling unauthenticated remote attackers to execute arbitrary commands with root privileges. Organizations must act immediately to remediate this threat.
By Gourav Rajput
A Chinese threat actor designated UTA0560 by Volexity has launched a sophisticated spear-phishing campaign against multiple non-governmental organizations. The attackers leveraged a chain of recently patched zero-day vulnerabilities in Google Chrome and Microsoft Windows to silently infiltrate targets and deploy a malicious JavaScript backdoor known as GRIMWEDGE. The operation, discovered on September 1, 2026, highlights the persistent and evolving danger posed by state-linked cyber actors against civil society groups.
By Gourav Rajput
The notorious Sandworm threat group is leveraging multiple Cisco security gaps to spread a refreshed version of the Cyclops Blink botnet. This article breaks down the attack chain, the malware’s evolution, and practical steps organizations can take to defend against such sophisticated threats.
By Gourav Rajput
A newly disclosed maximum-severity vulnerability in GitLab Community and Enterprise Editions allows attackers to traverse file systems and potentially compromise entire software supply chains. With a perfect CVSS 10.0 score, CVE-2026-85706 demands immediate patching and a reassessment of repository access controls. Organizations relying on GitLab for source code management and CI/CD automation must treat this as a top-tier incident. The flaw resides in core repository handling, meaning exploitation could lead to unauthorized code injection, artifact manipulation, or lateral movement into build environments.
By Gourav Rajput
Hunt.io discovered a sophisticated intrusion at Thai broadband provider 3BB where attackers leveraged MeshCentral for persistent root access. The breach exposed critical subscriber credentials and internal network infrastructure.
By Gourav Rajput
Security researchers at ExPatch revealed a critical vulnerability in Telegram Desktop that allowed hidden JavaScript code to be embedded within chat exports. The flaw could silently exfiltrate all messages from HTML files when opened in a browser. This discovery raises serious concerns about data safety in messaging platforms.
By Gourav Rajput
CISA has added five actively exploited security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog. The move underscores the growing urgency of patching critical systems before threat actors can leverage known gaps.
By Gourav Rajput
In May 2026, a coordinated attack leveraged autonomous OpenAI agents to infiltrate RubyGems, ultimately gaining remote code execution on RubyDoc servers. Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx, along with Maciej Mensfeld from Mend.io, revealed how a swarm of AI‑driven bots executed the breach, highlighting new risks in software supply chains.
By Gourav Rajput
GitLab has rushed out emergency patches for a maximum-severity vulnerability tracked as CVE-2026-85706, a path traversal flaw in the repository commits API that allows unauthenticated attackers to read arbitrary server files. Within hours of public disclosure, security researchers observed active scanning and exploitation attempts across the internet, underscoring the shrinking window between patch availability and weaponization.
By Gourav Rajput
Malicious actors have successfully exploited a combination of two distinct vulnerabilities within JFrog Artifactory to seize administrative control over self-hosted servers and embed persistent backdoors. According to a recent report by cloud security firm Wiz, these attacks were actively observed between mid-August and early September, targeting unpatched instances of the critical software repository.
By Gourav Rajput
A sophisticated China-linked hacking group known as UNC3569 has discovered a critical zero-day vulnerability in Sogou Input Method, a popular Chinese character input tool used by millions on Windows systems. Through a carefully crafted malicious link, the attackers were able to chain multiple exploitation techniques to install the GRAYRABBIT backdoor, granting them complete control over compromised machines with the same privileges as the logged-in user.
By Gourav Rajput
PaperCut has released new security maintenance releases for versions 26.0.5, 25.0.13, and 24.1.10, replacing all previously issued emergency patches. The update addresses two critical vulnerabilities that were being actively exploited in the wild.
By Gourav Rajput
Cisco has disclosed that three separate threat clusters tied to ransomware operations and state-sponsored campaigns have been actively exploiting two critical vulnerabilities in its Secure Firewall Management Center. The flaws, including a maximum-severity authentication bypass, were used to steal credentials and deploy Qilin ransomware across victim networks.
By Gourav Rajput
A coordinated attack by GoldFactory and Mantax Otax threatens Indonesian bankers through Android app cloning and malware distribution. This sophisticated campaign exploits both system vulnerabilities and user trust to facilitate financial fraud.
By Gourav Rajput
A researcher known as Nightmare-Eclipse has published a new zero-day exploit called ShieldCrash targeting Windows Defender. This marks another escalation in their ongoing vendetta against Microsoft's security ecosystem.
By Gourav Rajput
Google Play's Early Access program, meant for gathering feedback on unreleased apps, is being hijacked by bad actors to push thousands of deceptive Android applications. These apps masquerade as offers of cash, rewards, casino winnings, or premium content, luring users into installing low‑quality or malicious software.
By Gourav Rajput
The Gigabud banking trojan has evolved to exploit Android's work profile feature, creating isolated environments that hide malicious applications from banking security scanners. Group-IB researchers documented this sophisticated evasion technique in their September 9th report.
By Gourav Rajput
_Andriy_Popov_Alamy.png?width=720&quality=80&disable=upscale)
