Security Insights
Breaches, ransomware and regulation — analysed the day they break, with the practical lessons your team can act on. Free to read, no account required.
RoguePlanet: Microsoft Patches Defender Zero-Day After Researcher Goes Public in Disclosure Feud
A privilege-escalation flaw tracked as CVE-2026-50656 gave attackers full SYSTEM access on fully patched Windows 10 and Windows 11 machines, and a working exploit was already on the internet before Microsoft shipped the fix.
A £5 Million Crypto Gift to Nigel Farage Triggered a Formal Money-Laundering Alert to the UK's National Crime Agency
Banks that processed the payment filed a Suspicious Activity Report. The Reform UK leader now faces scrutiny from two separate official bodies at the same time.
17 Fake Payment SDKs on npm and PyPI Stole API Keys and Cloud Credentials from Developers
A single attacker planted 17 counterfeit packages impersonating Paysafe, Skrill and Neteller on the two largest public code registries, silently harvesting secrets from any developer who installed them.
CISA Orders Patch for Critical Adobe ColdFusion Flaw and Three Other Actively Exploited Bugs
A perfect-10 severity vulnerability in Adobe ColdFusion is among four flaws now confirmed as actively exploited, putting federal agencies and private organisations on a tight patching deadline.
Fake DoorDash Calls Are Draining Gig Workers' Earnings in Australia
Criminals posing as platform support staff are using vishing and brute-force account takeover to steal wages from delivery drivers. The Transport Workers Union has already recovered more than $50,000 in stolen pay.
UAT-7810: How Chinese Hackers Are Turning Unpatched Routers Into a Spy Network
Cisco Talos has exposed a China-linked group that hijacks Ruckus and ASUS routers through known, unpatched vulnerabilities to build a hidden relay network for multiple state-aligned spying operations.
BeyondTrust Patches Two Critical Pre-Authentication Flaws in Remote Support and Privileged Access Tools
Attackers need no password to exploit CVE-2026-40138, rated 9.2 out of 10. Every self-hosted BeyondTrust appliance is exposed until patched.
FTC Warns: Fake Party Invitations Are the Latest Phishing Hook
Criminals are disguising phishing attacks as wedding and birthday RSVPs. The Federal Trade Commission says victims are handing over passwords and payment details without realising the invitation was never real.
Fake IT Support Calls on Microsoft Teams Are Dropping EtherRAT Malware on Corporate PCs
Palo Alto Networks' Unit 42 has documented an active attack chain where criminals call employees over Teams, impersonate the IT helpdesk, and install a Node.js trojan that hides its command server inside an Ethereum blockchain.
Convicted Fraudster Gave Undeclared Staff and Property to UK Politician, Investigation Claims
Reform UK leader Nigel Farage is under parliamentary scrutiny after a newspaper investigation alleged he accepted security staff, social media workers, and use of a London property from George Cottrell, who pleaded guilty to US wire fraud in 2017, without registering the support with Parliament.
Undeclared Gifts and Political Influence: What the Farage-Cottrell Affair Tells Us About Transparency Failures
Reform UK's Robert Jenrick confirmed that party leader Nigel Farage accepted gifts including staff, security, and accommodation from George Cottrell, a convicted fraudster, without registering them in the parliamentary interests register.
108 Poisoned Packages: North Korea's PolinRider Campaign Targets Developer Supply Chains
The Contagious Interview crew has seeded npm, Packagist, Go, and the Chrome Web Store with 108 malicious packages and extensions — all aimed at the developers who build software for crypto firms, banks, and tech companies.
Ready to Reduce Your Human Cyber Risk?
Sign up and start training your team in minutes. No sales calls, no demos — just pick a plan and go. Phishing simulations, video courses, and certificates from day one.
