CVE-2026-64638, "XSS2Shell", is a WordPress core vulnerability that turns an unauthenticated XSS on the login screen into PHP code execution on the server. The root cause is a disagreement between two sanitization filters. What it is, why it is serious (core, pre-auth, around 43% of the web) and what to do: update to 7.0.3 and escape correctly at output.
Read the article
Named pipes are a normal Windows IPC mechanism and a two-sided attack surface: vulnerabilities you build yourself (pipe squatting, confused deputy) and a classic privilege-escalation primitive to SYSTEM (named pipe impersonation), plus stealth C2 over pipes. How it works and how to defend, at the code and detection level.
Read the article
ShieldBreak is a PoC that bypasses Microsoft's patch for RoguePlanet (CVE-2026-50656) and escalates to SYSTEM on Windows 10/11 and Server 2025 with Defender enabled. It is not a remote attack: the attacker already has a local foothold and only climbs to SYSTEM. No patch yet, no confirmed exploitation. What it means for a managed fleet and what to do until the fix lands.
Read the article
Automated traffic has already overtaken human traffic, measured independently by three providers. What it means for a CISO in financial services: APIs as the attack surface, cryptographic attribution (Web Bot Auth), the friction with DORA/PSD2/AI Act, and a controls plan across 0-90-180 days — beyond the Cloudflare headline about "humans, a rounding error".
Read the article
Same summer, two cyberattacks in Romania: one at the national land registry, one at a bank. We are not comparing severity — we are comparing the reflex, to disclose or to reassure. And why, in the end, cyber hygiene is a form of care for the citizen, especially the elderly, who cannot simply "reset" their property records.
Read the article
When ransomware reaches the VMware ESXi hypervisor, it does not encrypt one server — it encrypts them all at once, because every virtual machine lives on it. It is the most feared scenario in virtualized infrastructure, and the financial sector is a prime target. How attackers reach ESXi (CVE-2024-37085, CVE-2021-21974), why EDR does not see you there, and what actually saves you.
Read the article
Romania's DNSC was notified on 2 August 2026 of a ransomware attack at Techventures Bank S.A. (the former Banca Comercială Feroviară) and is supporting mitigation and investigation. Everything else — systems affected, data exfiltration, customer impact, the group behind it — remains officially unknown. What we know for certain, what we do not, and why it matters for any DORA/NIS2-regulated entity.
Read the article
CISA added three actively exploited vulnerabilities to its KEV catalog: CVE-2026-9198 in IBM Langflow (unauthenticated RCE, CVSS 9.8), CVE-2026-18576 in N-able N-central (authentication bypass, admin account takeover) and CVE-2026-34486 in Apache Tomcat (incomplete fix, CVSS 7.5). Public PoC for Langflow, an emergency hotfix for N-central. What they are, who is affected, and what to do now.
Read the article
Attackers took over 200+ packages in the Arch User Repository (AUR) by adopting orphaned packages and injecting malicious code into build files — an anti-analysis loader plus a Rust infostealer delivered over Tor that steals SSH keys, cloud secrets and API keys. Arch temporarily disabled adoption. How it worked, and the supply-chain lesson.
Read the article
Broadcom has shipped patches for three critical VMware flaws: a vCenter authentication bypass (CVE-2026-59309) and code execution (CVE-2026-59310), both CVSS 9.8 and unauthenticated, plus a virtual-machine escape (CVE-2026-47876, CVSS 9.3). Not yet exploited — but there is no workaround. What to update, and in what order.
Read the article
Attackers don't steal data the moment they get in — they settle in, create backdoors, disable detection. The anatomy of the post-breach phase and why fixing the entry point matters as much as removing the malware.
Read the article
Drone autopilot maker CubePilot was hit by DNS hijacking: attackers took over the domain DNS, obtained fraudulent TLS certificates for all subdomains and intercepted traffic. Why it matters and what to do.
Read the article
Over 24,000 internet-exposed BMC/IPMI management interfaces leak password hashes through a ~20-year-old protocol weakness. Why it matters and how to protect your servers.
Read the article
The official DNSC technical analysis of the ANCPI attack: double-extortion ransomware, the attack chain step by step, the root causes and concrete lessons for any company.
Read the article
ANCPI cyberattack, July 2026: the timeline of the cadastre and land-registry outage (e-Terra) and the facts confirmed by ANCPI and DNSC. What is confirmed, what is not, and what the attacker claimed.
Read the article
What Cloud Computing is, advantages, types of Cloud and Technologies.
Read the article
What are the best practices for securing networks and critical infrastructure, such as those in the energy or healthcare sectors?
Read the article