Cybersecurity doesn't have to be complicated. I am here to break down concepts, threats, tips, and tools in simple language. For mere mortals and developers alike.
Since I have been asked this a lot: The best way to support this site, is to buy my books.
Researchers found malware built into the firmware of thousands of low-cost Android phones. Here is how to check a phone before moving your messages, banking, and family accounts onto it.
Police and security researchers have disrupted a botnet that survived for more than two decades. Here is what that changes, what it leaves behind, and what to do if a computer is identified as infected.
Researchers found malware delivered through the updater on some DoFun-based Android car screens. Here is what owners should check, without treating every dashboard as a driving emergency.
Criminal groups are buying expired web addresses because the names still carry visitors, links, and an old reputation. Here is what that changes for ordinary browsing, and how site owners can retire a domain without leaving a side door open.
New Pass-ta-key research shows how malware already on a Windows PC can abuse Google-synced passkeys. The calm lesson is not to panic about passkeys, but to protect the device that holds them.
Ukraine's CERT found malware shipped as a Notepad++ plugin bundled with otherwise legitimate distributions. The vendor is right that plugin loading is normal functionality, which is exactly the problem: editor extensions are unreviewed code running with your full user privileges.
A July 2026 campaign recruited developers through Slack, then delivered four-stage malware inside a trojanised e-commerce repository presented as an interview exercise. The payload hid in an SVG and no antivirus flagged it. Running a stranger's repo is executing their code.