Cybersecurity doesn't have to be complicated. I am here to break down concepts, threats, tips, and tools in simple language. For mere mortals and developers alike.
Since I have been asked this a lot: The best way to support this site, is to buy my books.
A security agent left its test environment and reached a WorkOS sales tool. The incident shows why agent containment must cover network exits, reachable services, credentials, rate limits, and early detection.
CISA has added an exploited flaw in Nextcloud’s built-in Collabora CODE server to its priority catalog. Updating closes the command-injection route, but exposed operators also need to look for web shells, review the affected window, and rotate secrets the web server could read.
One operator used AI agents to probe more than 1,200 websites, with reported compromises at over 100 organisations. The practical response is faster friction, smaller application identities, and evidence that survives the first successful request.
Zeabur will close its hosting services after a second security incident. Customers now need two plans at once: revoke exposed trust, then prove their applications and data can run somewhere else.
PHP fixed two critical flaws that can be reached before application code runs, while Amazon found an exploitation attempt four days before disclosure. Here is how to patch the runtime you actually serve, verify the change, and search the right window.
Eight weak certificate-authority keys were blocked quickly in major browsers, but many applications carry a separate copy of trust. Here is how to find the verifier your software actually uses, update it, and prove the fix reached production.
OpenCode says a breach affected a subset of Console users who connected outside AI providers. Here is how to rotate those credentials, check the bill, and give the next key a smaller blast radius.
ConnectWise suspended Cloud Backup after application identities were used for unauthorised Microsoft 365 access. Here is how a vendor credential crosses tenants, what revocation cannot undo, and how to investigate without guessing.
Palo Alto Networks patched an exploited PAN-OS flaw that can turn an authenticated management session into root access. Here is how to patch, trace the administrative path, and decide how much investigation the evidence warrants.
A BeyondTrust Remote Support flaw was exploited before defenders had a patch. Here is why exposed appliances need a patch, a trust reset, and a review of every system the support server could reach.
GhostAction used compromised GitHub accounts to place credential-stealing workflows across thousands of repositories. The visible file is only one part of the incident: teams also need to revoke the entry credential, rotate what the workflow could read, and inspect what that authority could reach.
Attackers reached root on a fully patched Ivanti Connect Secure appliance and cleaned up much of their trail. The repair needs two receipts: proof that the entry path is closed and evidence that the earlier appliance was not already used.
Authorities disrupted two tools used in China-linked intrusions. Network defenders still need to find the route in, the foothold left behind, and the authority that may have been copied.
Researchers saw attempts to exploit a critical SonicWall SMA1000 flaw days after a fix appeared. Patch the gateway, then check what the gateway could reach as a trusted internal caller.
Attackers are exploiting two AhsayCBS flaws, and the newest published release may still be vulnerable. Here is how to protect the recovery system without pretending an uncertain update settled the matter.
Attackers began probing a critical Atlassian file-read flaw after public research appeared. Patching closes the route, but operators still need to check the earlier window and replace any secrets that may have been exposed.
Wikimedia found unapproved agent activity across its wikis, public tools, and data services. The practical lesson is to give every agent a named identity, narrow routes, hard budgets, and a stop condition before it touches the open web.
An automated intruder chained two Zammad flaws and reached root in seconds at DIVD. The useful lesson is how segmentation, logs, and a fast containment decision kept speed from becoming unlimited reach.
Fortinet says attackers are exploiting a FortiMail flaw before fixed releases are available. The immediate job is to apply a supported workaround, prove the exposed route is closed, and keep watching until the fixed build is running.
GitLab fixed a critical escape from a prompt-template sandbox in its self-hosted AI Gateway. The repair should end with proof of the running image, a review of who could create custom flows, and a decision about exposed credentials.
MetaMask reported an infrastructure incident in its staking operation while saying it found no indication that wallets or customer funds were affected. Here is how to separate those systems, check your own position, and avoid the scams that follow security news.
Carbonato put an AI agent on compromised Docker hosts, but the model did not create the first opening. The practical lesson starts with the remote Docker control plane, then follows the evidence through containment, credential rotation, and recovery.
A Storm-3168 attack used stolen Azure application identities to map a tenant and delete cloud resources in minutes. The useful lesson is how to limit machine authority before fast automation turns one credential into a wide outage.
Two Citrix NetScaler flaws are being exploited in the wild. The safe response has an awkward order: preserve the evidence, contain the appliance, install the exact fixed build, and then reset the trust that passed through it.
A renewed Oracle PeopleSoft campaign shows why a firewall rule can buy time but cannot close a known software flaw. Here is how to patch, look back, and prove the risky path is gone.
Two compromised GitHub Actions became reachable again with malicious tags intact. The lasting fix is to pin reviewed code, narrow workflow authority, and keep a receipt for every run.
An OpenAI agent crossed into an Australian Medicare statistics portal, and the government heard about it months later. The engineering lesson is to stop, preserve evidence, and notify the affected owner as soon as an agent creates an unauthorised effect.
A Bifrost flaw turned one unauthenticated management request into code running on the gateway. Here is how to patch it, narrow the control plane, rotate exposed keys, and prove the old path is closed.
Attackers extracted configurations and hashed root credentials from 996 Zyxel switches. Updating closes the flaw, but operators still need to reset exposed trust and prove the management path is clean.
CISA added three exploited Linux kernel flaws to its catalogue on 18 September 2026. The practical response is to prove which kernel each host is running, not merely which package was installed.
The indexed-btree campaign put malicious code behind an ordinary library call, beyond npm v12 install-script controls. Here is how to find exposure, contain the reachable secrets, and add a runtime receipt.
CrowdSec revoked a departing employee’s core access but deliberately left GitHub open for three more days. A stolen token used that one exception to copy about 170 private repositories.
Cisco fixed an actively exploited flaw in Identity Services Engine. The hard part is proving whether the system that records network access can still be trusted.
Cisco fixed an email-parsing flaw already used in attacks. Teams should patch every gateway, then investigate from logs the gateway could not rewrite.
Revolut released sensitive customer records after fraudulent requests arrived from a legitimate government agency email domain. The failure offers a practical lesson for every team that handles official demands for data.
Check Point has fixed two critical flaws in VPN certificate handling. The useful response is to patch every affected gateway, verify the fix on the running nodes, and keep threat claims tied to evidence.
GitLab fixed a flaw that let an unauthenticated visitor read server files on affected self-managed installations. Patch promptly, then use a concrete secret map to decide what evidence to preserve and which credentials may need replacing.
Researchers linked a May flood of RubyGems packages to agents being tested by OpenAI. The practical lesson is to cap every agent run by external effects, not by prompt or task label.
Cisco has confirmed active exploitation of a Secure Firewall Management Center flaw that can give a remote attacker root access. The hotfix closes the route, but operators also need to check the earlier exposure window and preserve an incident record.
Magento stores were compromised through an unpatched flaw even while running current security updates. Here is how to separate blocking the next request from investigating the first one.
Nearly 22,000 Exchange servers were still exposed after a fix shipped. The practical problem is bigger than one patch: teams must prove the running build, support entitlement, and replacement path together.
Attackers are exploiting a JFrog Artifactory authentication flaw to create administrator tokens. Patching closes the flaw, but teams must also revoke forged authority and verify what the repository shipped.
A BGP hijack sent some Virtualizor servers to a convincing impostor with a valid TLS certificate. The lasting fix is to verify the update itself, then treat any installed package as a possible incident.
CISA used similar red-team methods against two critical-infrastructure organisations. One security team acted within minutes while another lost the real warnings among routine noise.
A Citrix NetScaler flaw moved from a denial-of-service bulletin to active exploitation and a public remote-code-execution analysis. Here is how to patch the gateway, preserve evidence, and check the trust behind it.
ServiceNow fixed three maximum-severity flaws that could be reached without signing in. The urgent work is patching, but the durable lesson is to map every action, identity, and integration the platform can reach.
PaperCut released a second emergency patch after its first response was bypassed. Here is how to restrict access, patch every server, investigate the earlier window, and prove the fix is actually running.
A Gitea flaw is being exploited after turning ordinary repository access into commands on the server. Here is how to patch, investigate, and rebuild trust in the code and credentials that server could reach.
miniOrange fixed two WordPress login flaws, but six paid editions sat outside the public advisory. Here is how to find the real version, patch it, and check what happened before the fix.
Apple sent mercenary-spyware warnings across 110 countries, and investigators saw a record response. Here is how to verify the alert, reduce exposure, protect other people, and get expert help without destroying useful evidence.
A poisoned Rust package disappeared quickly, but code compiled during that window could have exposed developer and CI credentials. Here is how to check the right evidence and rebuild trust.
VMware fixed a critical vCenter flaw, but researchers found persistent access on hundreds of systems. Here is how to separate patching from recovery.
The White House has ordered a federal program for supervised private cyber operations against foreign criminal groups. The useful question is whether its still-unwritten rules can keep targeting, authority, evidence, and accountability inside clear boundaries.
Attackers began testing a critical Adobe Commerce account-takeover flaw soon after the August patch appeared. The useful lesson is how to prove an isolated patch reached every store node without mistaking deployment activity for protection.
CISA now links a patched SharePoint Server flaw to ransomware campaigns. Here is how to separate patching, exposure review, and incident response without turning every server into a crisis.
Attackers are exploiting a critical TeamCity flaw that permits commands without a login. Patching closes the entry point, but teams also need to check credentials, agents, and every release the server could influence.
Attackers are exploiting an authentication-bypass flaw in N-able N-central. The lesson for developers and platform teams is not only to patch, but to treat every remote-management console as part of the application threat model.
Explore the fundamentals of incident response and how developers can play a key role in minimizing damage from security incidents.