Articles 25 to 48 of 77 in this category. To search by keyword, go back to the blog hub.
UNC6671 calls employees on their personal phones, steals the MFA token with AiTM infrastructure and negotiates under four separate brands. What it reveals about defending financial firms.
By Daniel O'Grady · CIO y socio fundador
Progress patched the flaw on 4 June and attacks began on the 29th, the day the analysis went public. CISA added it to KEV on 7 August. What that timeline teaches about your patching deadlines.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
An unauthenticated CVSS 10.0 flaw in Metabase, exploited since 3 August, handed attackers the credentials for connected databases. What to check, how to detect it and who to notify.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Edge devices went from 3% to 22% of exploitation breaches in a year. Why EDR cannot reach firewalls, VPNs and routers, and how to regain visibility without an agent.
By Adrián González · CEO y socio fundador
At Black Hat 2026 an AI system found attack techniques no human had catalogued first. Signature and known-TTP defence now has a much shorter shelf life.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Two North Korea-linked npm packages resolve their command server by reading a blank Ethereum transfer. NullReceiver defeats domain takedown — here is what changes for defenders.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Unit 42 documented an actor who wired DeepSeek into an agent and automated a 460-target exploitation campaign. What it really showed, and how to defend against it.
By Adrián González · CEO y socio fundador
A worm started in keyv@6.0.0 and spread on its own to hundreds of npm packages in half an hour: it steals dev and CI secrets and plants hooks that run when the project opens in Claude Code or VS Code.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Broadcom patches three critical VMware vCenter and ESXi flaws (CVSS up to 9.8): auth bypass, RCE and a VM escape. What to prioritise, no workaround.
By Adrián González · CEO y socio fundador
The Pink campaign phones employees posing as IT support, walks them through a fake passkey page and registers its own credential in the real Microsoft 365 account. What breaks and how to close it.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Microsoft maps a year of ShinyHunters attacks on Salesforce: no platform exploit, just OAuth abuse, connected apps and stolen vendor tokens. What to review in your SaaS.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Fastjson 1.x has a critical remote code execution flaw under active exploitation, and no 1.x patch is coming. How to find it in your stack —even transitively— and shut the path down.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
CISA, the FBI and the EPA have updated advisory AA26-097A: Iran-linked actors are manipulating internet-exposed PLCs across water, energy and government. What it means for your OT.
By Adrián González · CEO y socio fundador
Google disclosed that Gemini was questioned over a hundred thousand times to clone its reasoning. No intrusion, no malware: the IP walked out through the front door.
By Adrián González · CEO y socio fundador
Three chained FortiSandbox flaws allow unauthenticated remote code execution as root. CISA has already put the CVE on its KEV catalogue. What it means when your security appliance is the way in.
By Adrián González · CEO y socio fundador
On 11 July 2026 trojanised jscrambler releases hit npm with a Rust infostealer that loots cloud credentials, wallets and the secrets behind Cursor, Windsurf, Claude Desktop and MCP servers.
By Adrián González · CEO y socio fundador
Qualys has disclosed RefluXFS, a root privilege escalation in the XFS filesystem that affects default RHEL, Fedora and Amazon Linux installs and leaves no trace in the kernel logs.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
ClickFix is now the second most common initial access vector: a fake CAPTCHA convinces the user to run a command that installs ACR Stealer and steals session tokens and Microsoft 365 files.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
On 18 July the first attacks hit CVE-2026-6875, five days after the patch: a ServiceNow AI Platform sandbox escape giving unauthenticated RCE. What to watch and how to contain it.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
An incompletely rotated token compromised Trivy, KICS and LiteLLM in March. Four months on, those credentials feed Vect ransomware that destroys data beyond recovery.
By Adrián González · CEO y socio fundador
A deepfake of the CFO cost one firm 25.6m dollars. Why voice no longer proves identity and how to protect your payments against AI-driven CEO fraud.
By Adrián González · CEO y socio fundador
A 16-year-old flaw in the KVM hypervisor lets a guest virtual machine break out to the host on Intel and AMD. What Januscape is and how to protect your virtualisation.
By Adrián González · CEO y socio fundador
A flaw in the Microsoft Defender engine spawns a SYSTEM shell on fully patched Windows 10 and 11. What RoguePlanet is, how to check your engine version and how to detect and defend against it.
By Adrián González · CEO y socio fundador
Stealing AI compute is now an industry: stolen cloud credentials and exposed inference servers that hand you the bill and fuel further attacks.
By Adrián González · CEO y socio fundador
Before you leave…
Quick 15-minute assessment and we'll tell you what to prioritise first: Microsoft 365, pentesting, vulnerability management, SOC, DORA, NIS2, ENS or ISO 27001.
No spam. Reply within 24h.
