Citrix published CTX697096, a critical vulnerability already exploited, with no workaround and no published indicators of compromise. The correct order is not ”patch”, but inventory, then a compromise check, then patch. How the Braincap team works with clients running NetScaler ADC and Gateway, what it looks for on the appliances, and what it finds almost every time.
Read the article
The CRA distinction is not open source or not, but commercial activity or not. If you sell plugins and themes or build sites and shops commercially for EU clients, the CRA can make you the manufacturer of what you ship. The most exposed case: those who modify the core. When you become a manufacturer, what is required and why Romania is exposed.
Read the article
The Cyber Resilience Act (Regulation (EU) 2024/2847) makes security mandatory by design for any product with digital elements placed on the EU market. It is not just for big tech: it catches you if you sell connected software or hardware. The first obligation, reporting, has applied since 11 September 2026; the bulk arrives on 11 December 2027. What it requires, who it catches and what to do now.
Read the article
CVE-2026-87902, an unauthenticated path traversal in WordPress core (CVSS 9.2), leads to local PHP file inclusion and, on common setups like the official PHP Docker image or default cPanel, to code execution. Exploited at scale within hours of the patch and already on CISA KEV. What it is, who is exposed and what to do now: 7.1.2 plus two stopgaps.
Read the article
CVE-2026-64638, "XSS2Shell", is a WordPress core vulnerability that turns an unauthenticated XSS on the login screen into PHP code execution on the server. The root cause is a disagreement between two sanitization filters. What it is, why it is serious (core, pre-auth, around 43% of the web) and what to do: update to 7.0.3 and escape correctly at output.
Read the article
Named pipes are a normal Windows IPC mechanism and a two-sided attack surface: vulnerabilities you build yourself (pipe squatting, confused deputy) and a classic privilege-escalation primitive to SYSTEM (named pipe impersonation), plus stealth C2 over pipes. How it works and how to defend, at the code and detection level.
Read the article
ShieldBreak is a PoC that bypasses Microsoft's patch for RoguePlanet (CVE-2026-50656) and escalates to SYSTEM on Windows 10/11 and Server 2025 with Defender enabled. It is not a remote attack: the attacker already has a local foothold and only climbs to SYSTEM. No patch yet, no confirmed exploitation. What it means for a managed fleet and what to do until the fix lands.
Read the article
Automated traffic has already overtaken human traffic, measured independently by three providers. What it means for a CISO in financial services: APIs as the attack surface, cryptographic attribution (Web Bot Auth), the friction with DORA/PSD2/AI Act, and a controls plan across 0-90-180 days — beyond the Cloudflare headline about "humans, a rounding error".
Read the article
Same summer, two cyberattacks in Romania: one at the national land registry, one at a bank. We are not comparing severity — we are comparing the reflex, to disclose or to reassure. And why, in the end, cyber hygiene is a form of care for the citizen, especially the elderly, who cannot simply "reset" their property records.
Read the article
When ransomware reaches the VMware ESXi hypervisor, it does not encrypt one server — it encrypts them all at once, because every virtual machine lives on it. It is the most feared scenario in virtualized infrastructure, and the financial sector is a prime target. How attackers reach ESXi (CVE-2024-37085, CVE-2021-21974), why EDR does not see you there, and what actually saves you.
Read the article
Romania's DNSC was notified on 2 August 2026 of a ransomware attack at Techventures Bank S.A. (the former Banca Comercială Feroviară) and is supporting mitigation and investigation. Everything else — systems affected, data exfiltration, customer impact, the group behind it — remains officially unknown. What we know for certain, what we do not, and why it matters for any DORA/NIS2-regulated entity.
Read the article
CISA added three actively exploited vulnerabilities to its KEV catalog: CVE-2026-9198 in IBM Langflow (unauthenticated RCE, CVSS 9.8), CVE-2026-18576 in N-able N-central (authentication bypass, admin account takeover) and CVE-2026-34486 in Apache Tomcat (incomplete fix, CVSS 7.5). Public PoC for Langflow, an emergency hotfix for N-central. What they are, who is affected, and what to do now.
Read the article
Attackers took over 200+ packages in the Arch User Repository (AUR) by adopting orphaned packages and injecting malicious code into build files — an anti-analysis loader plus a Rust infostealer delivered over Tor that steals SSH keys, cloud secrets and API keys. Arch temporarily disabled adoption. How it worked, and the supply-chain lesson.
Read the article
Broadcom has shipped patches for three critical VMware flaws: a vCenter authentication bypass (CVE-2026-59309) and code execution (CVE-2026-59310), both CVSS 9.8 and unauthenticated, plus a virtual-machine escape (CVE-2026-47876, CVSS 9.3). Not yet exploited — but there is no workaround. What to update, and in what order.
Read the article
Attackers don't steal data the moment they get in — they settle in, create backdoors, disable detection. The anatomy of the post-breach phase and why fixing the entry point matters as much as removing the malware.
Read the article
Drone autopilot maker CubePilot was hit by DNS hijacking: attackers took over the domain DNS, obtained fraudulent TLS certificates for all subdomains and intercepted traffic. Why it matters and what to do.
Read the article
Over 24,000 internet-exposed BMC/IPMI management interfaces leak password hashes through a ~20-year-old protocol weakness. Why it matters and how to protect your servers.
Read the article
The official DNSC technical analysis of the ANCPI attack: double-extortion ransomware, the attack chain step by step, the root causes and concrete lessons for any company.
Read the article
ANCPI cyberattack, July 2026: the timeline of the cadastre and land-registry outage (e-Terra) and the facts confirmed by ANCPI and DNSC. What is confirmed, what is not, and what the attacker claimed.
Read the article
What Cloud Computing is, advantages, types of Cloud and Technologies.
Read the article
What are the best practices for securing networks and critical infrastructure, such as those in the energy or healthcare sectors?
Read the article