Vulnerabilities
Secure Code Review: Nine Practices for Finding Hidden Flaws
Manual inspection catches logic errors that automated scanners miss, but only if you review the data flow rather than just the syntax.
Malware Brief
Cloud Security
Cloud data exfiltration: how it works and how to stop it
Data leaves your cloud environment through legitimate application logic, not just broken firewalls, making traditional perimeter defence largely ineffective against modern theft.
Cyber Attacks
Formjacking Mechanics: How Data Theft Bypasses Browser Security
Formjacking succeeds by injecting malicious scripts that intercept keystrokes before the browser encrypts them, rendering standard HTTPS protection insufficient for the input phase.
Vulnerabilities
Software Composition Analysis Checklist for Secure Dependencies
Most application vulnerabilities originate in third-party libraries rather than your own source code, making dependency tracking the primary defence against supply chain attacks.
Cloud Security
Policy as Code for Small Teams: Automate Cloud Rules
Translating security rules into machine-readable scripts prevents configuration drift and removes human error from cloud deployments.
Cyber Attacks
Phishing vs Spear Phishing: Key Differences and Detection Tactics
Spear phishing trades the low cost of mass spraying for high yield by exploiting specific social connections and professional roles within your organisation.
Vulnerabilities
Detect End-of-Life Software: Signals, Tools and Blind Spots
End-of-life software leaves distinct forensic traces in dependency chains and version mismatches, often hiding in plain sight within legacy infrastructure.
Cloud Security
Cloud Logging Gaps: Response and Recovery Steps
Missing logs destroy forensic timelines, forcing teams to reconstruct attacker movements from incomplete network traces and memory dumps rather than audit trails.
Cyber Attacks
Slowloris Attacks: How Low-Bandwidth Denial of Service Works
A single computer can hold thousands of connections open simultaneously, exhausting server resources without sending large amounts of data or crashing the system.
Threat Intelligence
Threat Actors Explained: Motives, Methods and Misconceptions
Most attackers are not state-sponsored villains; they are automated scripts or opportunistic individuals seeking low-effort gains with minimal risk.
Data Breaches
Employee Data Breaches: Causes, Impacts and Prevention
Most employee data breaches stem from routine operational errors rather than targeted attacks, making procedural controls more effective than technical barriers alone.
Vulnerabilities
Organisations Risk Remote Code Execution via Critical Command Injection in @enmaso/node-convert Library
A critical command injection flaw in @enmaso/node-convert allows remote execution of system commands through unsanitized inputs.
Vulnerabilities
Skyeye TTS Vulnerability Enables Unauth PowerShell Execution on Windows Servers
A critical unauthenticated command injection in Dromara Skyeye allows remote attackers to execute PowerShell code on Windows servers via a text-to-speech endpoint.
Cyber Attacks
Organizations urged to check SSL certs after hackers hijacked .gh, .sl, .as to forge Google HTTPS
Attackers hijacked three country-code top-level domains to issue unauthorised HTTPS certificates for Google properties, though core systems remained secure.
Vulnerabilities
Open-source maintainers receive automated AI vulnerability reports from Anthropic's new free scanner
The AI firm offers opt-in vulnerability scans for open-source code, delivering automated reports generated by its strongest models without human review.
Vulnerabilities
Critical Unauth SQLi in PHPNuxBill FreeRADIUS Puts Orgs at Risk, Enabling Credential Theft via Blind Injection
A critical flaw in PHPNuxBill’s FreeRADIUS module allows attackers to extract credentials via blind SQL injection without authentication.
Vulnerabilities
Organisations urged to patch IBM Guardium 12.1/12.2.2 to stop unauthenticated container hijack and cluster takeover
A critical vulnerability in IBM Guardium allows unauthenticated attackers to execute arbitrary container images and seize control of managed edge clusters.
Vulnerabilities
Organisations urged to patch IBM Guardium 12.0-12.2 after critical unauthenticated RCE flaw exposed
A critical path traversal flaw in IBM Guardium versions 12.0 to 12.2 allows remote attackers to execute arbitrary code without credentials.
Vulnerabilities
IBM access software flaw lets attackers run code without credentials, hitting versions up to 10.0.9.2 and 11.0.3
A deserialization flaw in IBM access management software lets attackers run arbitrary code without credentials, affecting versions up to 10.0.9.2 and 11.0.3.
Vulnerabilities
Service Outages Loom as CISA Orders Federal BIND TKEY Fixes by Oct 11
CISA added an old but active BIND vulnerability to its critical catalog, demanding federal action within three days to prevent service outages.
Threat Intelligence
How Indicators of Compromise Work: From Detection to Remediation
You will learn how to transform raw data fragments into actionable security decisions, avoiding the common trap of treating every alert as a confirmed breach.
Cyber Attacks
Asos customers face data exposure after hackers claim full cloud compromise
The fashion retailer confirms a breach after attackers sent push notifications alleging they had fully compromised the company’s cloud storage infrastructure.
Cloud Security
Cloudflare Radar Redesign Helps Orgs Access Real-Time Traffic Data Without Technical Skills
The updated platform introduces interactive maps and standardised components to help journalists access traffic metrics without deep technical expertise.
Vulnerabilities
Handlebars RCE flaw allows server compromise via prototype bypass
A critical vulnerability in the Handlebars templating engine enables remote code execution by bypassing security controls, affecting versions up to 4.7.9.