Grivyonx Intelligence Hub
Zero-days, ransomware, data breaches and active exploitation, explained with practical defence advice.
Researchers at Citizen Lab have traced infections of Candiru spyware at Al Jazeera to targeted online ads that operated without any user interaction. This zero-click attack highlights a growing threat to media organizations. The spyware, developed by an Israeli firm, activated silently when ads loaded, even in the background, compromising device security in an instant.
By Gourav Rajput
A sophisticated threat actor tracked as Silent Lynx has orchestrated a prolonged espionage campaign against government institutions across the Commonwealth of Independent States. Leveraging four distinct infection chains and a critical WinRAR vulnerability, the group demonstrates advanced tradecraft in payload delivery and persistence. Our analysis reveals how the actor combines legacy document exploits with modern living-off-the-land techniques, creating detection gaps that traditional security controls struggle to address.
By Gourav Rajput
A deep dive into how Help TDS, tied to the Russian affiliate network Hotejka, has deployed malicious PHP code across more than 20,000 Cloudflare Pages domains to hijack visitors and push them toward expensive tech support scams.
By Gourav Rajput
A critical security vulnerability has been identified within the Drupal core's Field UI component, potentially allowing Remote Code Execution (RCE). While the flaw resides in the core, its exploitation relies on specific configurations involving contributed modules, with some paths requiring no user authentication.
By Gourav Rajput
A massive credential-theft operation dubbed GhostAction has compromised approximately 1,900 GitHub accounts, putting over 30,000 repositories at risk across thousands of organizations. Security researchers at GitGuardian detected an unprecedented spike in malicious activity on October 8-9, revealing a coordinated campaign designed to harvest secrets from continuous integration pipelines.
By Gourav Rajput
A newly disclosed authenticated remote code execution flaw in Langflow has drawn the attention of threat actors, with over 1,400 exploit attempts logged in honeypot sensors. The vulnerability, assigned CVE‑2026‑105740 and carrying a CVSS score of 9.9, impacts AI developers building agentic workflows on the open‑source platform. This article breaks down the technical details, the observed attack patterns, and practical steps to mitigate the risk.
By Gourav Rajput
Singapore-based Ahsay Backup has released revised security updates for its AhsayCBS platform after discovering that earlier patches failed to fully address two critical vulnerabilities. Threat actors have been actively chaining these flaws to bypass authentication and deploy web shells alongside XMRig cryptocurrency miners on compromised backup servers.
By Gourav Rajput
A high-severity flaw in Ivanti's industrial control systems, tracked as CVE-2026-104935, combines authentication bypass with remote code execution. The vendor's July patch addressed only part of the attack chain, creating a window of opportunity that threat actors are actively exploiting. This incident underscores the systemic difficulties in securing operational technology environments where downtime is costly and patch validation is complex.
By Gourav Rajput
The United Kingdom has imposed new economic sanctions targeting Cryptomus, a cryptocurrency platform suspected of facilitating Russian money laundering through ransomware payments, darknet market transactions, and other illegal activities. This move reflects broader efforts to disrupt illicit digital economies and protect global financial systems from cyber-enabled crimes.
By Gourav Rajput
A sophisticated Russian-led disinformation operation is actively targeting schools across Peru and Ecuador through spoofed emails, fake official documents, and the establishment of covert organizations. This AI-powered campaign seeks to destabilize educational systems and spread false narratives.
By Gourav Rajput
CISA warns of active exploitation of Ivanti Connect Secure vulnerabilities (CVE-2026-104935). Organizations must immediately update their systems to the latest version to prevent potential attacks via authentication bypass flaws.
By Gourav Rajput
A new Android banking trojan known as Hirudo has been discovered by ThreatFabric, which replaces genuine banking applications with maliciously patched versions. These trojans use internal vulnerabilities to evade standard security checks, representing a sophisticated evolution in mobile financial crime.
By Gourav Rajput
A critical flaw in the Linux vhost subsystem, dubbed Vghost, allows local users to read and write kernel memory at will, effectively granting root access across nearly a decade of kernel releases. In certain virtualization configurations, the same bug enables an untrusted virtual machine to escape to the host and hijack the hypervisor process.
By Gourav Rajput
Block is integrating OpenAI's advanced language models into its security operations, enabling its team to analyze threats at unprecedented speed. By automating the early stages of incident response, Block can propose and deploy patches within minutes, dramatically reducing exposure windows.
By Gourav Rajput
A growing number of reports indicate that ransomware operators are moving beyond data encryption to target the personal lives of employees, including family members. Incidents of stalking, physical assault, and even abduction are being cited, though verification remains challenging. The shift underscores a dangerous evolution in cyber‑criminal tactics, forcing companies to broaden their protective measures beyond traditional IT defenses.
By Gourav Rajput
Microsoft’s latest Patch Tuesday shattered previous records by delivering fixes for an unprecedented 1,413 security flaws. The massive update wave includes critical patches for Windows, Office, SharePoint, SQL Server, and developer tools, with one Windows Shell vulnerability already under active attack.
By Gourav Rajput
A Saudi national working at OpenAI has been taken into custody after authorities discovered a concealed recording device inside a high-level meeting space at the company's San Francisco headquarters. The incident underscores the growing risk of insider threats targeting proprietary AI research and strategic discussions. Prosecutors allege the employee attempted to intercept confidential oral communications, a federal offense that carries significant penalties. The case highlights how physical security gaps can undermine even the most advanced digital defenses.
By Gourav Rajput
Microsoft's October 2024 Patch Tuesday has arrived as the largest security update in the company's history, addressing 117 vulnerabilities across its ecosystem. Five of these flaws are confirmed zero-days actively exploited in the wild, including critical remote code execution bugs in Microsoft Office and Windows components. This unprecedented volume signals a shifting threat landscape where attackers are targeting core productivity and cloud infrastructure with increasing precision.
By Gourav Rajput
