Insights on vulnerabilities, cloud security, API testing, compliance, and penetration testing - written by the consultants who do the work.
An unauthenticated attacker can obtain a valid SmartConsole login token and sign in to Check Point Security Management with full administrative privileges. It's being exploited as a zero-day and CISA added it to the KEV catalog on 22 July 2026. Here's the briefing, the exposure test, and the action list.
Read article
Microsoft disclosed a critical unauthenticated-looking RCE in on-premises SharePoint Server on 14 July 2026 - a deserialization flaw exploited in the wild before patches shipped, now on CISA's KEV list with a 19 July remediation deadline. Here's the briefing, the compromise-hunt, and the action list.
SonicWall disclosed two zero-days in its Secure Mobile Access 1000 appliances on 15 July 2026 - a CVSS 10.0 unauthenticated SSRF and a post-auth command injection in the management console. Both are being exploited in the wild. Here's the briefing, the IoCs to hunt for, and the action list.
An unauthenticated path-traversal flaw in ColdFusion's Remote Development Services turns a single crafted HTTP request into full remote code execution as the service account. Disclosed 30 June 2026 (APSB26-68), weaponised within hours, and being exploited in the wild right now. Here's the five-minute briefing and the to-do list.
Three years on from CVE-2023-34362 (MOVEit Transfer SQLi) and the Cl0p mass-exploitation campaign that defined modern data-exfiltration ransomware. Plus the 2024-2025 ransomware retrospective: LockBit takedown, BlackCat exit-scam, and what survives them.
Two years after regreSSHion (CVE-2024-6387), the OpenSSH CVE that didn't quite weaponise globally - plus what CUPS, OpenSSL, and the rest of the critical OSS stack look like in April 2026.
It's been a year since CVE-2025-30066 (the tj-actions/changed-files compromise) and the XZ Utils backdoor (CVE-2024-3094) is two years old this month. Where supply-chain defence stands, what changed, and what most teams still haven't done.
Microsoft shipped fixes for more in-the-wild zero-days in 2024 than in any prior year - and the Windows MSHTML, TCP/IP, and Task Scheduler issues remain pre-prevalent on unpatched estate. A February inventory of the Microsoft CVEs you still need to verify are gone.
Two years after Snowflake, the credential-theft + SaaS-misconfiguration pattern is the most consistent breach vector we triage. A digest of the real incidents and CVEs that should anchor your January retrospective.
tj-actions/changed-files was compromised in March 2025 and used to leak CI secrets across thousands of repositories. Plus Q1 2025's other actively-exploited zero-days, what was chained with what, and what defenders should patch first.