Cybersecurity doesn't have to be complicated. I am here to break down concepts, threats, tips, and tools in simple language. For mere mortals and developers alike.
Since I have been asked this a lot: The best way to support this site, is to buy my books.
ConnectWise suspended Cloud Backup after application identities were used for unauthorised Microsoft 365 access. Here is how a vendor credential crosses tenants, what revocation cannot undo, and how to investigate without guessing.
Authorities disrupted two tools used in China-linked intrusions. Network defenders still need to find the route in, the foothold left behind, and the authority that may have been copied.
A China-aligned phishing campaign relayed real Microsoft sign-ins while stealing the resulting sessions. The defence starts with origin-bound authentication, independent verification, and a response plan that revokes more than a password.
A Storm-3168 attack used stolen Azure application identities to map a tenant and delete cloud resources in minutes. The useful lesson is how to limit machine authority before fast automation turns one credential into a wide outage.
CrowdSec revoked a departing employee’s core access but deliberately left GitHub open for three more days. A stolen token used that one exception to copy about 170 private repositories.
Cisco fixed an actively exploited flaw in Identity Services Engine. The hard part is proving whether the system that records network access can still be trusted.
CISA used similar red-team methods against two critical-infrastructure organisations. One security team acted within minutes while another lost the real warnings among routine noise.
miniOrange fixed two WordPress login flaws, but six paid editions sat outside the public advisory. Here is how to find the real version, patch it, and check what happened before the fix.