PwnKit: The 12-Year Local Root in Every Linux
CVE-2021-4034 gave instant root on default Linux installs via pure logic flaw. Why setuid code still deserves emergency attention.
Lapsus$ Rising: Identity-Driven Extortion’s Breakout
No zero-days, no malware — just MFA fatigue, SIM swaps, and help-desk social engineering. How Lapsus$ broke every assumption.
Crypto.com’s $34M Lesson: The 2FA Bypass Blueprint
Attackers defeated the second factor, not the vault, draining $34M from 483 accounts before a platform-wide withdrawal halt stopped them.
Apache httpd CVE-2021-44790: The RCE After Log4Shell
A mod_lua multipart buffer overflow announced ten days after Log4Shell. Narrow exposure, but a masterclass in triage under fatigue.
Kronos Ransomware: When Payroll SaaS Went Dark
UKG's Kronos Private Cloud ransomware outage forced thousands of employers onto paper time cards. The definitive SaaS continuity case.
Log4Shell (CVE-2021-44228): How One Logging Library
A single JNDI lookup string turned every Java logger into a front door. The anatomy, response, and lasting lessons of Log4Shell.
AWS us-east-1 Outage: When Multi-Region Wasn’t
A DYNOMITE autoscaler impairment cascaded through AWS's busiest region and its own consoles. The dependency-concentration landmark.
Emotet Resurgence: TrickBot Delivers the Loader Back
Ten months after its takedown, Emotet returned via a TrickBot module. The lesson: criminal franchises rebuild through partners.
Fake FBI Warnings: The 2021 fbi.gov Email Spoofing
Attackers abused a misconfigured FBI notification system to spam fake cyber-warnings from the real fbi.gov address, exposing the limits of email trust.
GoDaddy Breach: One Phished Password, 1.2 Million Sites Exposed
Two months of undetected access to managed WordPress hosting, wholesale sFTP and database credential harvesting, and SSL keys in the bargain.
npm Hijacking Wave: coa, rc, node-ipc and Stolen Maintainers
Popular packages with dormant maintainers pushed info-stealers through postinstall scripts. The registry was fine; the accounts were not.
Nobelium’s Password Spray: The Channel Becomes the Supply Chain
The SolarWinds actor returned with no implant at all — sprayed passwords, replayed tokens, and delegated partner admin rights over 609 channel companies.
- Go to the previous page
- 1
- …
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- …
- 28
- Go to the next page