Current analysis, technical guidance and reporting across security, infrastructure, automation and artificial intelligence.
Business intelligence platforms are rarely treated like privileged infrastructure. They sit behind dashboards, charts and reports. They are used by analysts, managers and finance teams. They do not look like identity systems, hypervisors or database servers, so they are often…
For much of the post-war era, Germany deliberately kept its intelligence services on a comparatively short leash. That was not accidental. The country’s history made extensive state surveillance politically and legally sensitive, and German intelligence agencies developed under far tighter…
Most security teams are trained to look for attackers entering an organisation. Malware arrives. Credentials are stolen. A vulnerability is exploited. A suspicious login appears. The North Korean remote IT worker programme takes a different route. The attacker applies for…
The most important cybersecurity feature in a new AI model may not be how well it performs. It may be who can run it. Chinese AI company Z.ai says its GLM-5.3 model achieved 84.5% on CyberGym, slightly above Anthropic Mythos…
For years, the basic IoT botnet model was easy to understand. Compromise thousands of weakly protected devices. Combine their bandwidth. Point them at a target. Launch a denial-of-service attack. Mirai made that model famous. The next generation of edge-device malware…
A vCenter compromise turns patching into incident response. Patch CVE-2026-59310, hunt reverse_ssh persistence and re-establish control-plane trust.
The LiteLLM supply chain attack began upstream in Trivy. Trusted security tooling, stolen secrets and automated CI/CD turned one breach into a wider exposure graph.
Attackers probed the GeoServer SQL injection before urgent fixes arrived. Patch 3.0.1, 2.28.5 or 2.27.6, then investigate the pre-patch exposure window.
Apple patched CVE-2026-65400, but attackers were already exploiting internet-exposed macOS Screen Sharing services. The reported compromises reached root and installed Monero miners, turning a patching story into an attack-surface and incident-response problem.
Exploit attempts hit SAP Commerce Cloud honeypots three days after patch day, before any public proof of concept. CVE-2026-58231 shows why internet-facing enterprise systems need an incident path, not a routine patch window.
ShieldBreak is now CVE-2026-69414, a Microsoft Defender elevation-of-privilege vulnerability assessed as exploitation more likely and still awaiting a verifiable fix. This update separates it from RoguePlanet CVE-2026-50656, explains the different CFAPI attack path, conflicting Windows 11 reproduction results, affected-build uncertainty, and the operational controls security teams should use instead of treating patch deployment as proof that exposure is fixed.
France has described three DGFiP data leaks involving tax correspondence, cadastral records and inheritance-related requests. The attack also shows how low-rate extraction can stay below detection thresholds.
