Rapid7

The RAMP forum was a prominent hub for threat actors until early 2026, when the FBI seized its infrastructure.

The result was a splintering of groups, actors, and tactics – and now, less visibility into centralized coordination. Get the full story in a research blog from Rapid7 Labs: r-7.co/3PeOnY9

Rapid7's Global Cybersecurity Summit is back ⤵️

For the first time ever, the Summit will span 2 days, with dedicated tracks designed to meet the distinct needs of security leaders and practitioners alike.

👀 More details coming soon. Save your spot: https://r-7.co/46yJyir

Claude Code Security and the AI Market Reaction: What Rapid7 says Security Leaders should Focus on When Anthropic announced Claude Code Security, the market reacted immediately. The reality is more nuanced, but Claude Code Security is a legitimate signal that AI is reshaping parts of the security l...

When #Anthropic announced Claude Code Security, the market reacted immediately, a legitimate signal that AI is already reshaping parts of the security landscape.

The questions now are what parts, and what this means for the rest of the stack. More: r-7.co/4co5Irt

Before the Breach: When digital footprints become a strategic cyber risk Today’s threat actors are no longer limited to exploiting technical vulnerabilities; they increasingly exploit the human element and weaponize digital footprints as a primary enabler of their operatio...

Threat actors today are weaponizing digital footprints – correlating data on systems, infrastructure, and especially employees – often without generating a single security alert.

More in our blog. Find a free download of Rapid7 Labs' latest report within: r-7.co/3MtmMlm

Critical Cisco Catalyst Vulnerability Exploited in the wild (CVE-2026-20127) On February 25, 2026, Cisco disclosed a critical authentication bypass vulnerability in Cisco Catalyst SD‑WAN Controller and Cisco Catalyst SD‑WAN Manager, tracked as CVE‑2026‑20127.

🚨 On 2/25/26, #Cisco disclosed a critical authentication bypass vuln. in Cisco Catalyst SD‑WAN Controller & SD‑WAN Manager – tracked as CVE‑2026‑20127.

Exposure in the wild led CISA to issue an emergency directive requiring that patches be installed by 2/27. More: r-7.co/3MvmEln

The Jan. 2026 seizure of RAMP disrupted a major ransomware coordination hub, but it did not dismantle the ecosystem behind it. It destabilized trust and accelerated fragmentation across the underground.

Get the full story in our latest blog: r-7.co/4qW3yTy

An executive’s online footprint can be more than a privacy issue, it’s also a business risk. 👣

Rapid7 Labs analyzed 100s of engagements from 2024-2025 to understand how exposed today’s executives really are, & what that means for the enterprise. Read on: https://r-7.co/46mH0E3

SOC teams are flooded with signals but still lack the context to act. False positives and low-value alerts slow investigations and pull focus from real threats.

Our latest eBook outlines 4 practical shifts to move beyond alert fatigue 👉 https://r-7.co/4aO37EH

Hacktivism and the Winter Olympics 2026: What Rapid7 is Seeing and What it Signals The 2026 Winter Olympics have been live for several weeks, and the cyber activity many predicted is already unfolding. Read on in a new Rapid7 blog.

🏅🎿 The '26 Winter Olympics have been live for several weeks, and threat intel has reported a surge in hacktivist chatter.

Some actors are actively targeting the defense industry, as well as orgs that might overlap with Olympic infrastructure & supply chains. More in a new blog: r-7.co/4kRFCzm

Bug in widely used VoIP phones allows stealthy network footholds, call interception (CVE-2026-2329) - Help Net Security CVE-2026-2329 is present in Grandstream VoIP phones' web-based API service, and is accessible in a default configuration.

Bug in widely used VoIP phones allows stealthy network footholds, call interception (CVE-2026-2329)

📖 Read more: www.helpnetsecurity.com/2026/02/19/g...

#cybersecurity #cybersecuritynews #securityupdate #vulnerability #VoIP #SMBs @rapid7.com @stephenfewer.bsky.social @fulmetalpackets.bsky.social

We have disclosed CVE-2026-2329, a critical unauth stack-based buffer overflow vuln affecting the Grandstream GXP1600 series of VoIP phones. Read our disclosure on the @rapid7.com blog, including technical details for unauth RCE, and accompanying @metasploit-r7.bsky.social modules: r-7.co/4tIzope

🚨 In conducting 0 day research against #Grandstream GXP1600 VoIP phones, Rapid7 Labs discovered CVE-2026-2329.

The unauthenticated stack-based buffer overflow vulnerability ultimately allows an attacker to intercept phone calls and eavesdrop on audio. Read on: r-7.co/4tIzope

What happens when stolen credit card data is sold like a service? 💳

Dump shops have evolved into carding-as-a-service (CaaS) marketplaces bundling stolen card data, tools, and support.

A new blog explores how these illegal marketplaces operate: https://r-7.co/463WvAF

For February’s #PatchTuesday, Microsoft published 55 vulnerabilities.

6 are already being exploited in the wild, and 3 were publicly disclosed before patches were released. Here's what to know before you patch: https://r-7.co/4rcV1fX

Measuring AI Security: What MCP Exposure Really Shows Real-world research into AI security risk using Model Context Protocol servers, separating measurable exposure from fear-driven narratives.

Each week, headlines warn of AI-driven jailbreaks, agents gone rogue, and LLM-enabled cybercrime – raising important questions, but rarely answering the most basic one:

What does the attack surface of today's AI systems actually look like? Rapid7's Christiaan Beek ran the numbers: r-7.co/4r9aq0B

CVE-2026-1731: Critical Unauthenticated Remote Code Execution in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) Rapid7 Website

🚨 On 2/6/26, #BeyondTrust disclosed a critical RCE vulnerability affecting its Remote Support (RS) and Privileged Remote Access (PRA) products.

The flaw has been assigned CVE-2026-1731 and a near-maximum CVSSv4 score of 9.9.

More in the Rapid7 blog: r-7.co/4arAjln

Your Friday reading sorted: Rapid7's findings around the 'Chrysalis' backdoor & Notepad++ compromise made their media rounds this week.

Dive into some of the top pieces below:
🗞️ Reuters: r-7.co/4qhvpNH
🗞️ TechCrunch: r-7.co/4tcjuTQ
🗞️ BleepingComputer: r-7.co/4kkDEHp
🗞️ The Hacker News: r-7.co/4cfkgJD

Chrysalis, Notepad++, and Supply Chain Risk: What it Means, and What to Do Next When Rapid7 published its analysis of the Chrysalis backdoor linked to a compromise of Notepad++ update infrastructure, it raised understandable questions from customers and security teams. Find answe...

After publishing our analysis of the Chrysalis backdoor (and Notepad++ compromise), customers & security teams had questions.

👉 Find an FAQ rundown in our latest blog, plus a link to Christiaan Beek's "Inside Chrysalis" session, now available on demand: r-7.co/3MrkJxZ

Rapid7 thanks @AiexGP (on X) for contributing the IoCs we've shared in our blog.

The Chrysalis Backdoor: A Deep Dive into Lotus Blossom’s toolkit Rapid7 Labs, together with the Rapid7 MDR team, has uncovered a sophisticated campaign attributed to the Chinese APT group Lotus Blossom.

🔎 Rapid7 Labs, alongside our MDR team, has uncovered a sophisticated campaign attributed to the Chinese APT group #LotusBlossom.

Find a deep technical analysis of the custom backdoor 'Chrysalis', Notepad++, Warbird, and more in our latest blog: r-7.co/4kaerPA

Critical Ivanti Endpoint Manager Mobile (EPMM) zero-day exploited in the wild (CVE-2026-1281 & CVE-2026-1340) On January 29, 2026, Ivanti disclosed two new critical vulnerabilities affecting Endpoint Manager Mobile (EPMM): CVE-2026-1281 and CVE-2026-1340. The vendor has indicated that exploitation in the wild...

🚨 On 1/29/26, #Ivanti disclosed 2 new critical vulnerabilities affecting Endpoint Manager Mobile (EPMM): CVE-2026-1281 & CVE-2026-1340.

The vendor has indicated that exploitation in the wild has already occurred prior to disclosure. More in our blog: r-7.co/4qZBsaH

Which #Microsoft vulnerabilities were of the most value to attackers in 2025? Turns out, the more things change, the more they stay the same.

Tech debt, backwards compatibility, elevations of privilege, and a dash of AI – this blog's got it all. Dive in: r-7.co/4qaqduX

Multiple Critical SolarWinds Web Help Desk Vulnerabilities: CVE-2025-40551, CVE-2025-40552, CVE-2025-40553, CVE-2025-40554 SolarWinds has published an advisory for multiple new vulnerabilities affecting their Web Help Desk product. Stay up to date with a new Rapid7 blog.

🚨 On 1/28/26, #SolarWinds published an advisory for multiple new vulns affecting their Web Help Desk product.

Of the 6 new CVEs, 4 are critical, and allow a remote attacker to either achieve unauthenticated RCE or bypass authentication. Read on: r-7.co/4rgPjsR

From Signals to Strategy: What Security Teams Must Prepare for in 2026 Geopolitics, insider risk, and threat intelligence have long influenced cyber operations; what has changed is the extent to which they directly affect everyday security decisions. More distillations f...

🌐 Geopolitics, insider risk, and threat intel have long influenced our world's cyber operations. What's changing is how they're now affecting everyday, company-level security decisions.

Read on and find a link to Rapid7's year-end session on demand here: r-7.co/4b9aQz3

🆕 Rapid7 MDR now delivers preemptive detection, investigation, & response for Microsoft environments.

Defender signals are integrated into Rapid7 MDR, where they are monitored and investigated by our SOC with exposure and asset risk context. Learn more: https://r-7.co/4a5emcw

Ni8mare and N8scape flaws among multiple critical vulnerabilities affecting n8n On November 18, 2025, a patched release was published for a critical unauthenticated file read vulnerability in n8n, a popular piece of automation software. Read more in the Rapid7 blog.

🚨 In November 2025, a critical vuln. was patched in #n8n, a popular piece of automation software.

The advisory for (what the finders have dubbed) #Ni8mare was published on January 7, 2026 – now tracked as CVE-2026-21858 with a CVSS score of 10.0.

More: r-7.co/3Z3aGBP

New year, same mission: helping teams take command of the attack surface. 💥

Wishing you a secure New Year from Rapid7!

Here are the top 3 predictions Rapid7 experts are seeing for 2026 👇

Now available on demand, Rapid7’s cybersecurity predictions webinar breaks down what those shifts could mean for security teams in the year ahead: https://r-7.co/4j48Wlf

MongoBleed CVE-2025-1484: Critical Memory Leak in MongoDB Allowing Attackers to Extract Sensitive Data On December 19, 2025, MongoDB Inc. disclosed a critical new vulnerability, CVE-2025-14847, which has since been dubbed MongoBleed. This vulnerability is a high-severity unauthenticated memory leak aff...

🚨 On 12/19/25, MongoDB Inc. disclosed a critical new vuln. affecting #MongoDB – one of the most popular document-oriented databases.

CVE-2025-14847, or #MongoBleed, is a high-severity unauthenticated memory leak. More in the Rapid7 blog: r-7.co/4piWbER

🖨️ Advancements in #MFP devices allow them to be conveniently integrated throughout enterprise environments. But they're often left overlooked & underprotected – breeding far-reaching security implications.

Dive into the latest research from Rapid7: r-7.co/44u48zq