Site Index
Every page on this site
Complete human-readable index. The XML sitemap at /sitemap.xml is the machine-readable version for search engines. This page is for humans who want to see the full shape of the site.
Core
Services
Industries
Resources
Topic Hubs
For crawlers and bots
All Blog Posts
197 published posts, most recent first.
2026-05-17cisco SD-WAN CVE-2026-20182: a missing else-if branch gave UAT-8616 god-mode over the corporate WAN fabric of every Catalyst customer that didn't patch in 3 daysCisco Catalyst SD-WAN
2026-05-17langflow CVE-2026-33017: the unauth RCE in your team's AI prototyping tool is exfiltrating your AWS keys in under 20 hours flatLangflow / AI tooling
2026-05-17exchange CVE-2026-42897: every news outlet is calling this "RCE." it isn't. it's OWA XSS — and the threat model is completely different.Microsoft Exchange Server
2026-05-11tanstack npm supply-chain compromise: 84 malicious package versions, a self-spreading worm, and a file-watcher wiper that triggers if you try to revoke your tokensnpm / TanStack ecosystem
2026-05-10ivanti EPMM CVE-2026-6973: the 'RCE' everyone's misreading. it's authenticated admin RCE, and that changes the playbook.Ivanti EPMM
2026-05-10we read 15 vibe-coded apps so you don't have to: 69 vulnerabilities, 5 patterns, one playbookAI-generated web apps
2026-05-10the $2.3 billion phone call: voice-clone scams are hitting elderly americans at industrial scale in 2026Voice cloning / deepfake
2026-05-10cPanel CVE-2026-29201, 29202, 29203: arbitrary file read, Perl code injection, DoS. three bugs in one disclosure, and the perl one is RCE.cPanel / WHM
2026-05-10building a real-time CVE detection-to-broadcast pipeline that hits X's 30-minute algorithmic velocity windowX (Twitter) automation
2026-05-06PAN-OS CVE-2026-0300: an unauthenticated root RCE in the firewall you paid $80K for. Patch order, detection, what to do tonight.Palo Alto Networks
2026-05-06The new phishing campaign weaponizing Google + Outlook calendar invites — credential theft, OTP interception, and RMM in one click.M365 / Google Workspace
2026-05-06Apache HTTP/2 CVE-2026-23918: a double-free in the protocol everyone runs. The patch order, detection, and why CVSS 8.8 understates the risk.Apache HTTP Server
2026-05-06MetInfo CMS CVE-2026-29014: a 9.8 PHP code-injection RCE in a CMS most Western admins have never heard of. The detection runbook for the long tail.MetInfo CMS
2026-05-05The NHS just walled off hundreds of GitHub repos because of Anthropic Mythos. The institutional reaction has started.NHS
2026-05-051 million exposed self-hosted AI services. The 4 most common holes, and what to do tonight.AI/LLM
2026-05-05Weaver E-cology CVE-2026-22679: a 9.8 RCE actively exploited since mid-March. The patch + IR runbook.Weaver
2026-05-05Itron disclosed an internal network breach via SEC 8-K. The utility you've never heard of runs your power meter.OT / Critical Infrastructure
2026-05-04cPanel CVE-2026-41940: 40,000 servers hit by "Sorry" ransomware. The exact patch order to run today.cPanel
2026-05-04ADT got popped because someone called the help desk. 5.5 million records out the door.Identity
2026-05-04CVE-2026-33824: an unauthenticated 9.8 in Windows IKE. The next WannaCry shape, if it gets weaponized.Windows
2026-05-03PyTorch Lightning shipped credential-stealing malware to PyPI for 42 minutes. Every AI/ML team is a target.AI/ML
2026-05-03Copy Fail (CVE-2026-31431): a 732-byte Python script roots every Linux distribution shipped since 2017.Linux Kernel
2026-04-26A login bug where the password "null" works. The Note Mark OIDC bypass and what it teaches every auth team.Application
2026-04-26Traefik shipped three authentication bypasses in 24 hours. The same root cause is in every reverse proxy.Infrastructure
2026-04-26GitPython's command injection (GHSA-rpm5-65cw-6hj4): the multi-options bypass and what it means for your CI runners.Supply Chain
2026-04-23148 security roles across six months of HN Who's Hiring. What the 2026 CISO market actually looks like.Labor Market
2026-04-23Two years of Item 1.05. What Form 8-K cyber filings say, and the seven things they never say.Public Company
2026-04-2298 HIPAA breaches in six weeks, 9.5M patients. What the HHS wall actually shows.Healthcare
2026-04-22OpenAI leaked GPT-5.5, arcanine, and glacier-alpha for a few minutes. Nobody is calling it what it is.AI
2026-04-19Salesforce Guest User Enumeration: How Attackers Pull 45M Records ShinyHunters-StyleSalesforce
2026-04-17SMB EDR Buyer Guide 2026: Microsoft Defender vs SentinelOne vs CrowdStrike vs Huntress vs SophosEDR
2026-04-10Active Directory Tier Zero in 2026: The Privilege Boundary Every AD Audit Must CheckActive Directory
2026-04-09PowerShell Security for Enterprises in 2026: The Configuration Every Windows Shop NeedsWindows
2026-04-08Scattered Spider / UNC3944: The English-Speaking Crew Still Running The Casino PlaybookEnterprise Identity
2026-04-06RAG Security: The Attacks Against Vector Databases Nobody Is Testing ForRAG / Vector Databases
2026-04-02The Claude Code Source Leak: How Anthropic Shipped Their Own Crown Jewels via npmnpm / Build Pipeline
2026-03-20Your Kid's School Is Monitoring Everything: Gaggle, Bark, GoGuardian ExplainedEdTech Surveillance
2026-03-18Phishing Defense 2026: Why the Old Controls Stopped Working and What Replaces ThemEmail Security
2026-03-14AirTag Stalking in 2026: What Apple Fixed, What They Didn't, How to Detect One on YouApple AirTag
2026-03-13Data Broker Opt-Out Guide 2026: Removing Your Personal Information From the IndustryData Brokers
2026-03-12Incident Response Plan: The Complete Template + Implementation Guide for 2026Incident Response
2026-03-11Crypto Wallet Security in 2026: Hardware Wallets, Seed Phrases, and the $6.75B LessonCryptocurrency
2026-03-10BCP + DR Complete Guide: Testing, RTO/RPO, and What Breaks in Real IncidentsBusiness Continuity
2026-03-06US State Data Privacy Laws 2026: The Complete Matrix Every Business NeedsState Privacy Law
2026-03-02Directus Headless CMS: Role Escalation, File Library Exposure, and the Defaults That BiteDirectus
2026-03-02HashiCorp Vault Sidecars: When Your Secret Manager Becomes the Attack VectorHashiCorp Vault
2026-03-01Strapi CMS Security: JWT Forgery, Plugin Vulnerabilities, and the Default Admin ProblemStrapi
2026-03-01DevSecOps 2026: The Complete Implementation Guide for Mid-Market Engineering OrgsDevSecOps
2026-02-28Encrypted Messengers Ranked: Signal vs WhatsApp vs iMessage vs Telegram vs MatrixMessaging
2026-02-27Appwrite Attack Surface: Anonymous Sessions, Bucket Enumeration, and the Mistakes Developers MakeAppwrite
2026-02-27Security Awareness Training Buyer Guide 2026: KnowBe4 vs Hoxhunt vs Curricula vs ProofpointSecurity Awareness Training
2026-02-24The Zero-Day Broker Market: How Governments Buy the Exploits That Spy on YouZero-Day Market
2026-02-24Vulnerability Management Buyer Guide 2026: Tenable vs Qualys vs Rapid7 vs Wiz vs SnykVulnerability Management
2026-02-16Docker Registry Security: Anonymous Pulls, Image Tampering, and the Default Nobody Should UseContainer Security
2026-02-13Webhook Forgery: Stripe, Twilio, SendGrid, and the Signature Verification Developers Always Get WrongPublic Company
2026-02-13Building a Bug Bounty Program in 2026: From Zero to Paying Researchers Without Ruining Your WeekBug Bounty
2026-02-12Identity Provider Buyer Guide 2026: Okta vs Entra ID vs Google vs JumpCloud vs PingIdentity Providers
2026-02-11SPF, DKIM, and DMARC in 2026: The Email Security Stack That Still Actually WorksPublic Company
2026-02-10CSPM Tools in 2026: Wiz, Prisma, Orca, Lacework, and the Cloud-Native ChoiceCloud Security
2026-02-09GRC Platform Buyer Guide 2026: Vanta vs Drata vs Secureframe vs Thoropass vs SprintoGRC Platforms
2026-02-06Why Your Cyber Insurance Won't Pay: The Denial Patterns You Need to Know AboutCyber Insurance
2026-02-06SAST vs DAST vs IAST vs SCA in 2026: What Actually Catches Bugs in Modern CodebasesAppSec Tooling
2026-02-01Texas SB 2610: The Safe Harbor Most Texas Businesses Don't Know They Qualify ForPublic Company
2026-01-29ISO 27001 vs SOC 2 in 2026: Which Certification Wins Deals, and When You Need BothCompliance
2026-01-23Secrets Management 2026: The Complete Guide to Vaults, Rotation, and Leaked-Credential ResponseSecrets Management
2026-01-18Cloud Security Incident Response: The Complete Playbook for AWS, Azure, and GCPCloud Security
2026-01-15ISO 27001:2022 Complete Implementation Guide for US Companies Going InternationalISO 27001:2022
2026-01-09Penetration Testing Methodology: The Complete Guide for Buyers and TestersPenetration Testing
2026-01-06Small Business Cybersecurity: The Complete Guide for Under-100 Employee CompaniesSmall Business
2026-01-04Penetration Testing in Dallas-Fort Worth: The Complete Guide for DFW BusinessesDallas-Fort Worth