Prabhu Kalyan Samal

CDK Global Ransomware: US Car Dealerships Run on Pen and Paper

Post author:Prabhu Kalyan Samal
Post published:September 4, 2026
Post category:Emerging Tech & Architecture Ransomware & Malware Security

On June 19, 2024, ransomware hit CDK Global’s dealer management platform — the operational nervous system of ~15,000 North American dealerships — and a second strike during recovery extended the outage for weeks while finance desks, service bays and OEM ordering reverted to paper and fax. This account covers the June 19/22 double-hit timeline, the billion-dollar industry loss estimates, why DMS lock-in made fallback manual rather than competitive, and the concentration-risk docket the incident left for every regulator to cite.

Squarespace Domain Hijackings: The 2024 GoDaddy Migration Aftermath

Post author:Prabhu Kalyan Samal
Post published:September 4, 2026
Post category:Cloud & Infrastructure Security Supply Chain Security

After Squarespace absorbed roughly 10 million domains from Google Domains in mid-2024, attackers discovered a seam: legacy Google-account login flows stopped being enforced, and formerly eNom-transferred .dev/.us domains could be taken over by re-registering then-unlinked accounts. From late June through July, crypto-draining hijacks of high-value domains — including Matomo founder trust abusing Squarespace lock states — left registry operators and site owners scrambling. This account traces the migration mechanics, the attack window, and the DNS tenure lessons.

What Is an Electronic Flight Bag (EFB)? — hero

What Is an Electronic Flight Bag (EFB)? The Complete 2026 Guide

Post author:Prabhu Kalyan Samal
Post published:September 4, 2026
Post category:Aviation and Aerospace Security Technology

An Electronic Flight Bag replaces 40+ lbs of paper charts and manuals with certified apps - how EFBs work, their classes, and their security risks.

10 Essential Tips for Aspiring Ethical Hackers

Post author:Prabhu Kalyan Samal
Post published:September 4, 2026
Post category:Career & Learning Security

10 essential tips for aspiring ethical hackers. Build your cybersecurity career with practical advice on certifications, tool proficiency, lab environments, bug bounty programs, and continuous learning strategies.

Quantum-Resistant Encryption: The Race Before Q-Day

Post author:Prabhu Kalyan Samal
Post published:September 4, 2026
Post category:Security

Quantum computers will eventually break RSA and ECC. Here are the finalized NIST post-quantum standards, how harvest-now-decrypt-later attacks make it today's problem, and the 5 steps to take before Q-Day.

Text4Shell: The 9.8 Severity Score That Wasn’t Log4Shell

Post author:Prabhu Kalyan Samal
Post published:September 4, 2026
Post category:Security Supply Chain Security

CVE-2022-42889 in Apache Commons Text scored CVSS 9.8 but needed apps to interpolate attacker strings — most never did. The reachability-triage lesson.

Medibank 2022: The Ransom Refusal That Published Patients

Post author:Prabhu Kalyan Samal
Post published:September 4, 2026
Post category:Emerging Tech & Architecture Ransomware & Malware Security

Criminals entered Medibank via a contractor’s VPN credentials on a gateway without MFA, then dumped 9.7M customers’ health data after the ransom refusal.

Fortinet CVE-2022-40684: Admin Access Without a Password

Post author:Prabhu Kalyan Samal
Post published:September 4, 2026
Post category:Cloud & Infrastructure Security Web & API Security

A CVSS 9.8 authentication bypass let attackers add their own SSH keys to FortiOS admin accounts via crafted HTTPS requests. Exploited at disclosure.

WhatsApp’s 2022 Ring-Phase RCE: Code Execution Before You Answer

Post author:Prabhu Kalyan Samal
Post published:September 4, 2026
Post category:Security Web & API Security

CVE-2022-36934 gave WhatsApp a CVSS 9.8 integer-overflow RCE that could execute during the video-call ring — before the victim answered. Zero interaction.

GTA VI Leak: When Your Slack Workspace Is the Vault

Post author:Prabhu Kalyan Samal
Post published:September 4, 2026
Post category:Identity & Phishing Security Supply Chain Security

A Lapsus$-linked teenager allegedly reached Rockstar’s Slack via helpdesk social engineering and posted 90+ GTA VI dev clips. The collaboration suite was the vault.

Optus 2022: 9.8M Records, One Unauthenticated API, Zero Exploits

Post author:Prabhu Kalyan Samal
Post published:September 4, 2026
Post category:Identity & Phishing Security Web & API Security

Australia’s second-largest telco exposed ~9.8M customer records via an API left unauthenticated in production. No zero-day, no phishing — just enumeration.

Magecart’s 2024 Resurgence: Skimming in the Polyfill.io Aftermath

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Identity & Phishing Security Supply Chain Security

Through 2024, digital skimming returned to threat reports’ front pages: Magecart-style attacks compromised hundreds of storefronts via compromised third-party JavaScript, supply-chain infections like polyfill.io’s June domain takeover injected malicious scripts into vast numbers of pages, and PCI DSS 4.0’s script-integrity requirements (6.4.3 and 11.6.2) approached their March 2025 enforcement deadline. This survey digests the modern skimming kill chain — injection, exfiltration, and evasion — the major 2024 campaigns, and the compliance clock turning client-side risk into boardroom math.

Hmmnm