Cyber Security, Without the Jargon

A proposed US copyright law would let courts order large VPN, broadband, and DNS providers to block access to foreign sites. Here is what the bill says, where collateral damage begins, and what privacy-conscious users should watch.

A China-aligned phishing campaign relayed real Microsoft sign-ins while stealing the resulting sessions. The defence starts with origin-bound authentication, independent verification, and a response plan that revokes more than a password.

An automated intruder chained two Zammad flaws and reached root in seconds at DIVD. The useful lesson is how segmentation, logs, and a fast containment decision kept speed from becoming unlimited reach.

Fortinet says attackers are exploiting a FortiMail flaw before fixed releases are available. The immediate job is to apply a supported workaround, prove the exposed route is closed, and keep watching until the fixed build is running.

GitLab fixed a critical escape from a prompt-template sandbox in its self-hosted AI Gateway. The repair should end with proof of the running image, a review of who could create custom flows, and a decision about exposed credentials.