Srestha Roy Srestha is a cybersecurity expert and passionate writer with a keen eye for detail and a knack for simplifying intricate concepts. She crafts engaging content and her ability to bridge the gap between technical expertise and accessible language… Read More "Proactive vs. Reactive Asset Risk Mitigation: Using Deception to Lower the Risk"
Michael Sampson, principal analyst at Osterman Research, said it is “very easy” to hardcode credentials, and the practice is threatening integration options at large due to mounting third-party vulnerabilities. “The mindset is first and foremost speed to market, not security,”… Read More "From hardcoded credentials to auth gone wrong: Old bugs continue to break modern systems"
Our ‘computers on wheels’ are more connected than ever, but the features that enhance our convenience often come with privacy risks in tow 13 Dec 2024 • , 3 min. read A presentation that includes in its title ‘Compromise of… Read More "Hacking a car – or rather, its infotainment system"
A new investigation into counterfeit receipt scams has uncovered a growing fraud ecosystem centered around tools like MaisonReceipts, which enable users to fabricate receipts from major retail brands with startling realism. MaisonReceipts, a subscription-based platform, is one of the largest… Read More "Fake Receipt Generators Fuel Rise in Online Fraud"
By 2025, Zero Trust has evolved from a conceptual framework into an essential pillar of modern security. No longer merely theoretical, it’s now a requirement that organizations must adopt. A robust, defensible architecture built on Zero Trust principles does more… Read More "Assessing the Role of AI in Zero Trust"
As part of the exploitation, attackers upload a file named “spinstall0.aspx,” which is used to steal the Microsoft SharePoint server’s MachineKey configuration, including the ValidationKey and DecryptionKey, security researchers reported. “Once this cryptographic material is leaked, the attacker can craft… Read More "Microsoft SharePoint zero-day breach hits on-prem servers"
ESET Research Threat Reports A view of the H2 2024 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts 16 Dec 2024 • , 3 min. read In the usual cat-and-mouse… Read More "ESET Threat Report H2 2024"
At least 10,000 CrushFTP instances are vulnerable to a critical flaw, which is currently being exploited by attackers, affecting the file transfer solution, according to cybersecurity experts. The vulnerability, tracked as CVE-2025-54309, involves a mishandling of AS2 validation in all… Read More "New CrushFTP Critical Vulnerability Exploited in the Wild"
Even in well-secured environments, attackers are getting in—not with flashy exploits, but by quietly taking advantage of weak settings, outdated encryption, and trusted tools left unprotected. These attacks don’t depend on zero-days. They work by staying unnoticed—slipping through the cracks… Read More "SharePoint 0-Day, Chrome Exploit, macOS Spyware, NVIDIA Toolkit RCE and More"
“If a user whose account is protected by a FIDO key enters their username and password into the phishing page, their credentials will be stolen, just as any other user,” Expel researchers in a blog post. “But with a FIDO… Read More "PoisonSeed outsmarts FIDO keys without touching them"
