34 articles
The Vastaamo case was not just a Finnish hacker story. It showed how exposed databases, weak governance, poor logging, and delayed breach response can turn clinical records into direct extortion against patients.
Inside the 2026 Sality disruption: peer-to-peer trust failures, the limits of botnet takedowns, and practical detection and recovery for Windows defenders.
An exploited LiteLLM MCP authentication bypass, unsafe defaults, code-executing guardrails, and unrestricted pass-through routes show why AI gateways must be isolated and operated as Tier-1 infrastructure.
CISA lists GitLab CVE-2026-85706 as exploited. Self-managed administrators must upgrade to 19.3.2, 19.2.6, or 19.1.8 or later, hunt the repository commits API, and treat readable secrets as potentially compromised.
Berlin's published data, exploited SonicWall gateways, a Chrome zero-day, AI-accelerated intrusion, payment-system abuse, and PostGREShell all point to the same task: identify and revoke inherited trust.
Unit 42 reports that a human attacker used AI agents to move from an exposed API to cloud, identity, source code, secrets, and CI/CD control in under ten hours. The evidence shows acceleration, not a magical new exploit.
CVE-2026-83548 and CVE-2026-83549 are being exploited against SonicWall SMA1000 appliances. Patching closes the flaws, but exposed gateways still need compromise assessment and credential recovery.
Berlin's stolen government data has been released after an extortion deadline expired. The next phase is credential rotation, exposure analysis, victim notification, and long-term fraud monitoring.
CISA added an old ownCloud WebDAV authentication bypass to KEV after reported exploitation against Philippine research and defense-linked targets. The lesson is not novelty. It is exposed file infrastructure.
Berlin isolated two state ministries after a cyberattack on the Landesnetz. The incident is a practical lesson in public-sector segmentation, crisis communications, and data-theft triage.
KrebsOnSecurity reports that the FBI is investigating a dark web service selling more than 153 million driver's license scans. The lesson is not just identity theft. It is vendor concentration around identity proofing.
PaperCut NG/MF has an actively exploited authentication-bypass and unsafe class-loading chain. Patch Release 2 matters, but exposed servers also need immediate compromise triage.
Australian and U.S. authorities have charged alleged TeamPCP operators after a software supply chain campaign that authorities say hit more than 1,000 organizations. The defensive lesson is about tokens, publishing rights, and update speed.
Attackers are exploiting a Zimbra SNMP command injection flaw after a fixed version was already available. The real work is not only patching, but compromise triage.
Cisco says attackers are exploiting a remote denial-of-service flaw in ASA and FTD VPN services. Here is how to prioritize, detect, and contain it.
Attackers are exploiting a macOS Screen Sharing authentication flaw against exposed Macs. Patch, remove VNC exposure, and investigate before treating it as a routine update.
Two critical vCenter flaws threaten authentication and code execution. Use this practical plan to patch, isolate, detect, and recover safely.
An incomplete Tomcat fix allowed EncryptInterceptor bypass and is now exploited. Learn which exact versions are exposed and how to contain clusters.
Default Langflow deployments exposed a two-step path from no account to remote code execution. Learn how to patch, isolate, hunt, and rotate secrets.
An unauthenticated command-injection flaw turned a perimeter appliance into an entry point. Here is how to patch, contain, hunt, and recover.
Russian-aligned espionage groups exploited stored XSS flaws in Zimbra, SOGo, Roundcube, MDaemon, and Kerio. Opening a message was enough to lose credentials, email, and persistent access.
A CVSS 10.0 path traversal in Adobe ColdFusion's Remote Development Services lets unauthenticated attackers write a webshell straight into the web root. Attackers were probing it before most admins finished reading the advisory.
A zero-day in unnamed third-party software let attackers sit inside KDDI's shared ISP email platform for a month, exposing email addresses and passwords used by @nifty, BIGLOBE, J:COM, and three other providers. Here's what's confirmed and what isn't.
Sysdig caught an LLM agent breaking into a Langflow server, pivoting to a production database, and extorting the victim — with no human at the keyboard between steps. Here's what actually happened, and what's still unproven.
SOCRadar says the FortiBleed credential campaign feeds directly into INC Ransom and Lynx ransomware operations, with 430,000 FortiGate devices targeted. Here's what's confirmed, what's one vendor's assessment, and what it means for your firewall.
CISA says attackers are exploiting a critical SharePoint deserialization flaw. Patching closes the bug, but exposed servers also need a focused compromise assessment.
A reported FortiGate credential-harvesting campaign is a reminder that patched edge appliances can still be compromised. Here is how to verify exposure, contain access, and hunt for follow-on activity.
A new Go-based ransomware family prioritizes recently modified files, uses RDP and legitimate remote-management tooling, and leaves no ransom note on disk. Here's what to hunt and harden.
Memory forensics, Windows event artifacts, and IR methodology — from initial alert to post-incident report. Tools, commands, and playbooks included.
Discover the real skills, mindset, and strategies needed to become a genuine SOC professional—from technical mastery to standing out in job hunts.
Canary tokens are digital tripwires that alert you the moment an attacker touches something they shouldn't. Free, no-install, and zero false positives.
Managed Detection and Response (MDR) delivers 24/7 expert-led threat hunting and active remediation that tools alone can't provide — and solves the SOC talent shortage at a fraction of the cost.
93% of ransomware victims who pay still discover data theft. Only 29% use multi-layer backup protection. Learn immutability, validation, and org readiness strategies.
A practical workflow for the first 10 minutes after a suspected breach — commands with explanations for Linux and Windows triage, red flags, and when to escalate.