Opening the Email Was Enough. OWAReaper Stayed After the Password Changed.
Laundry Bear exploited Exchange OWA to deploy a browser implant whose mailbox access could survive password changes and endpoint rebuilding.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
Romania’s Cadastre Attack Made Cyber Recovery a Property-Market Problem
A cyberattack against Romania’s land and cadastre agency disrupted national property services. The incident shows why recovery must restore legal confidence as well as technical availability. Romania’s National Agency for Cadastre and Land Registration, ANCPI, suffered a major cyberattack on…
The Exploit Was Unpatchable. A Court Order Took the Original Research Offline.
The usbliter8 exploit exposed an immutable Apple SecureROM flaw. A court order removed the original research, but it could not remove the vulnerability or copies already distributed.
The PDF Extension Could Read WhatsApp. The Browser’s Same-Origin Wall Did Not Apply.
A malicious page could use Adobe's Acrobat Chrome extension to read WhatsApp Web content across the browser's same-origin boundary. Adobe patched the chain quickly.
Cloudflare Precursor Moves Bot Detection from a Request to a Session
Cloudflare’s Precursor analyses behaviour across a browsing session before a sensitive action occurs. The technique may catch modern automation, but it also raises privacy, accessibility and failure-mode questions. Cloudflare made Precursor generally available on 13 July as an optional capability…
CISA Confirmed Two FortiSandbox Exploits. A Third Was Reported a Month Earlier.
Two FortiSandbox command-injection flaws are in CISA's exploited catalogue, while a related authentication bypass was reported under attack one month earlier.
The Gambia Assented to a Modern Privacy Law. The Next Step Is Operational.
The Gambia has assented to a modern privacy framework covering extraterritorial processing, data rights, security, breaches and transfers.
July 2026 Patch Tuesday: what Security and IT teams should prioritise
July 2026 Patch Tuesday covers 135 approved patch records and 682 unique CVEs across Microsoft, Adobe and SAP.
SonicWall Patched Two Zero-Days. Then the Replacement Builds Were Exploited Too.
SonicWall confirmed exploitation of two SMA1000 vulnerabilities. If compromise indicators are present, defenders must rebuild the appliance and reset credentials, not merely install the hotfix.
Mean Time to Exploit Just Went Negative: The Patch Window Is Gone
Mandiant’s M-Trends 2026 report, published 23 March 2026, puts a number on something defenders have felt for a while: the mean time to exploit (MTTE) a vulnerability is now an estimated -7 days. Exploitation is routinely happening before a patch…