HermeticWiper: Cyber Arson on Invasion Eve
Hours before tanks rolled, a signed wiper shredded hundreds of Ukrainian networks. The anatomy of the first invasion-synced destructive campaign.
Blog
PwnKit: The 12-Year Local Root in Every Linux
CVE-2021-4034 gave instant root on default Linux installs via pure logic flaw. Why setuid code still deserves emergency attention.
Twitch Leak: 125GB of Source Code and Payouts on 4chan
No malware, no zero-day — one exposed internal endpoint handed over Twitch’s entire codebase and three years of creator earnings.
DST Root CA X3 Expiry: The Scheduled Outage That Mostly Wasn’t
Five years of notice, one expired root, and a clever cross-sign that kept old Android trusting Let’s Encrypt. The rehearsal for every future trust migration.
WD My Book Live Mass Wipe: The EOL IoT Disaster
Tens of thousands of abandoned Western Digital NAS drives got factory-reset by strangers through a decade-old unpatched flaw. The definitive end-of-life IoT case study.
Facebook 533M Leak: Old Scraped Data Never Stops Burning
A 2019 contact-import scrape of 533M users hit every phone number to profile, free-dumped in 2021 and still fueling vishing and SIM-swaps today. Why data age barely dents attacker value.
The Ship Is a Floating OT Network: Maritime Cyber Rules Got Teeth in 2024
Since January 2024, ships manage cyber risk under IMO-derived requirements enforced by flag and port-state control, IACS E26 and E27 give class societies assessment criteria, and the US Coast Guard can detain deficient vessels. Bridge, cargo, propulsion, SATCOM and crew IT share one hull: treat the vessel as an OT estate.
NIS2 shield checklist inside 12 star circle
NIS2 Is Not Just for Banks: The Compliance Clock
Food plants, logistics firms, waste management, research labs: 18 sectors are in scope, plus everyone their covered customers drag in via contracts. The duties read like an incident-readiness program — 24-hour early warning, 72-hour notification, personal accountability for executives — and the basics were overdue anyway.
Living Off Trusted Infrastructure: C2 via Legitimate Services
DragonForce’s Backdoor.Turn routes ransomware C2 through Microsoft Teams TURN relays using anonymous visitor tokens — LOTI, living off trusted infrastructure. Why network detection dies and what still works.
Ensuring Robust Security in Login and Registration Systems
Comprehensive guide to securing login and registration systems. Covers authentication vulnerabilities, brute-force protection, session management, CAPTCHA implementation, and security best practices.
Prompt injection is the new SQL injection — featured image
Prompt Injection Is the New SQL Injection: The 20-Year-Old Mistake AI Is Repeating in 2026
SQL injection stayed in the OWASP Top 10 for 20+ years. Prompt injection is the same bug with worse permissions — here’s the history, real examples, and the defense playbook.
hero-efb-part2
EFB Hardware Explained: Class 1, Class 2, Class 3 and Portable vs Installed
Class 1, 2, 3 EFB hardware explained — plus how AC 120-76E replaced classes with portable vs installed. Displays, AIDs, buses, power, mounting.
- Go to the previous page
- 1
- …
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- …
- 33
- Go to the next page