Grivyonx Intelligence Hub
Older cybersecurity, AI and cloud security analysis from the Grivyonx research team.
Proofpoint reports the UNK_CondorFiltration campaign compromised seven Microsoft 365 accounts using default passwords. Originating from 1,487 AWS EC2 sources, the threat focused on Chilean retail and financial institutions across 28 tenants.
By Gourav Rajput
Within hours of its public disclosure, attackers have begun exploiting a critical WordPress vulnerability identified as CVE-2026-87902. The flaw, scoring a CVSS rating of 9.2, enables unauthenticated remote code execution by manipulating how page templates are resolved. This rapid exploitation underscores the urgency for site owners to apply patches immediately and monitor for suspicious activity. The vulnerability stems from an issue in the get_page_template() function, which can be tricked into loading arbitrary local PHP files. Attackers can leverage this to execute commands, install backdoors, or exfiltrate data. Security experts warn that the speed at which the exploit spread highlights the need for proactive threat detection and robust update practices.
By Gourav Rajput
A critical design feature in GitLab assigns unique incoming email addresses to users, but these addresses carry highly privileged access tokens. If exposed, these tokens grant attackers extensive control over repositories and pipelines, creating a potent vector for software supply chain compromise. Security researchers have demonstrated how easily these tokens can be harvested from public commits or misconfigured settings. Organizations relying on GitLab for CI/CD must immediately audit email reply handling and token scopes to prevent unauthorized code injection or infrastructure takeover.
By Gourav Rajput
Security researchers have uncovered a novel supply chain attack where threat actors leveraged HashiCorp's official registry to distribute Go-based malware through compromised Terraform providers. This unprecedented campaign marks the first known instance of attackers weaponizing the centralized repository for malicious payload delivery.
By Gourav Rajput
A seemingly harmless feature in GitLab that lets users file issues via email can become a serious security problem if the generated address is exposed. Attackers who obtain this address can impersonate you, push commits to any branch you can access, and trigger CI/CD pipelines under your identity. This article explains the mechanics of the risk, its potential impact, and how to safeguard your projects.
By Gourav Rajput
Security researchers have uncovered a chained vulnerability dubbed MikroTrick that allows attackers to seize complete control of MikroTik routers exposed to the internet without needing a password or SSH key. By combining an SSH state‑machine flaw with an argument‑injection bug in the login process, threat actors can bypass authentication and execute arbitrary commands. This article breaks down the technical details, observed exploitation, and practical defenses.
By Gourav Rajput
OpenAI Academy has reached a significant milestone, marking two years of dedicated service to democratize artificial intelligence education. Since its inception, the initiative has focused on removing traditional barriers to tech learning, ensuring that AI knowledge is not confined to elite institutions or wealthy nations. By expanding its reach into underserved communities worldwide, the program is cultivating a diverse ecosystem of innovators. This expansion represents a crucial shift toward inclusive technology, empowering local leaders with the tools needed to solve regional challenges using advanced machine learning capabilities.
By Gourav Rajput
Adversaries are systematically corrupting the web-scale datasets that power major large language models. By flooding search indexes with malicious URLs and fabricated narratives, they manipulate ChatGPT, Gemini, and Google AI Overviews into surfacing phishing links and disinformation at scale. This emerging attack vector turns the openness of the web into a weapon against the very AI systems that index it.
By Gourav Rajput
A new strain of Windows malware called CLOSEDQUORUM introduces a novel command‑and‑control approach: instead of relying on a single attacker server, it lets up to four artificial intelligence models vote on its next move. Researchers at Cisco Talos first detailed the technique on September 22, noting that the malware can be instructed to harvest credentials, browser passwords, and cryptocurrency wallet data. While the public sample does not currently function end‑to‑end, the concept signals a shift toward more autonomous, AI‑driven threats.
By Gourav Rajput
Security researchers have uncovered a sophisticated supply chain compromise affecting legitimate MemTensor packages distributed through both npm and PyPI repositories. The attack introduces sckit, a cross-platform Go-based implant designed to harvest credentials across Windows, Linux, and macOS environments. Multiple security firms including Aikido, SafeDep, Socket, and StepSecurity have confirmed the malicious activity.
By Gourav Rajput
OpenAI has announced the expansion of its Daybreak cybersecurity initiative to support Ukraine's government in defending critical civilian digital infrastructure. The move comes as cyber threats continue to evolve alongside geopolitical tensions, marking a significant step in leveraging AI for national security purposes.
By Gourav Rajput
Two critical vulnerabilities in cPanel's infrastructure allow malicious actors to execute code with root privileges and manipulate databases belonging to other hosting accounts. The flaws affect CalDAV, CardDAV services, and the WP Toolkit plugin, requiring immediate patching.
By Gourav Rajput
Ringg has announced a major advancement in AI-powered customer service, with its intelligent agents now capable of resolving up to 65% of customer calls autonomously. Leveraging OpenAI's latest GPT-5.6 model, these agents operate across multiple channels including voice, chat, WhatsApp, and web platforms, offering businesses a cost-effective alternative that runs 90% cheaper than previous GPT-4.1 implementations.
By Gourav Rajput
OpenAI CEO Sam Altman delivered landmark remarks to the United Nations Security Council, urging immediate international cooperation on AI governance. He emphasized that maintaining human control over increasingly capable systems requires new global institutions, shared safety standards, and unprecedented coordination between nations and technology leaders.
By Gourav Rajput
Autonomous security agents are getting remarkably good at discovering vulnerabilities — but there has been no reliable way to measure just how good they are. XRanges for AI changes that, offering a structured benchmarking framework that was previously tested by 545 hackers. The platform provides an objective scoring mechanism for AI-driven security agents.
By Gourav Rajput
Artificial intelligence is rapidly evolving, and with each new model release the industry intensifies its focus on safety and alignment. Anthropic and OpenAI recently announced updated AI systems, emphasizing their commitment to reducing risky behavior through rigorous testing and ongoing research. Both companies highlighted improvements in alignment metrics, with Anthropic’s Opus 5.5 achieving the highest scores on its automated behavioral audit, while OpenAI pledged continued investment in safety mechanisms.
By Gourav Rajput
A severe use-after-free flaw in the Linux kernel's AF_UNIX socket subsystem has been exploited in the wild, allowing attackers to break out of containers and escalate privileges to root on the host machine. Despite being patched upstream in August, Ubuntu's Long Term Support releases including 26.04, 24.04, and 22.04 still lack official fixes, leaving millions of deployments exposed.
By Gourav Rajput
Artificial intelligence is rapidly moving into the realm of mental health, offering everything from mood‑tracking chatbots to virtual therapists that provide coping strategies and crisis support. As these tools become more prevalent, the community needs a dependable method to confirm that they respond in a way that is both helpful and safe for individuals navigating sensitive emotional terrain. The benchmark was developed by a panel of mental health clinicians, AI researchers, and ethicists who crafted a series of authentic dialogue scenarios covering a broad spectrum of conditions, including anxiety, depression, trauma, substance use, and suicidal ideation. Each scenario is structured to probe the model’s ability to provide accurate information, demonstrate empathy, avoid harmful advice, and maintain ethical boundaries. By using this standardized set, developers can objectively measure and compare the performance of different AI models on the critical dimensions of helpfulness and safety.
By Gourav Rajput
