Articles 25 to 48 of 66 in this category. To search by keyword, go back to the blog hub.
Fastjson 1.x has a critical remote code execution flaw under active exploitation, and no 1.x patch is coming. How to find it in your stack —even transitively— and shut the path down.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
CISA, the FBI and the EPA have updated advisory AA26-097A: Iran-linked actors are manipulating internet-exposed PLCs across water, energy and government. What it means for your OT.
By Adrián González · CEO y socio fundador
Google disclosed that Gemini was questioned over a hundred thousand times to clone its reasoning. No intrusion, no malware: the IP walked out through the front door.
By Adrián González · CEO y socio fundador
Three chained FortiSandbox flaws allow unauthenticated remote code execution as root. CISA has already put the CVE on its KEV catalogue. What it means when your security appliance is the way in.
By Adrián González · CEO y socio fundador
On 11 July 2026 trojanised jscrambler releases hit npm with a Rust infostealer that loots cloud credentials, wallets and the secrets behind Cursor, Windsurf, Claude Desktop and MCP servers.
By Adrián González · CEO y socio fundador
Qualys has disclosed RefluXFS, a root privilege escalation in the XFS filesystem that affects default RHEL, Fedora and Amazon Linux installs and leaves no trace in the kernel logs.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
ClickFix is now the second most common initial access vector: a fake CAPTCHA convinces the user to run a command that installs ACR Stealer and steals session tokens and Microsoft 365 files.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
On 18 July the first attacks hit CVE-2026-6875, five days after the patch: a ServiceNow AI Platform sandbox escape giving unauthenticated RCE. What to watch and how to contain it.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
An incompletely rotated token compromised Trivy, KICS and LiteLLM in March. Four months on, those credentials feed Vect ransomware that destroys data beyond recovery.
By Adrián González · CEO y socio fundador
A deepfake of the CFO cost one firm 25.6m dollars. Why voice no longer proves identity and how to protect your payments against AI-driven CEO fraud.
By Adrián González · CEO y socio fundador
A 16-year-old flaw in the KVM hypervisor lets a guest virtual machine break out to the host on Intel and AMD. What Januscape is and how to protect your virtualisation.
By Adrián González · CEO y socio fundador
A flaw in the Microsoft Defender engine spawns a SYSTEM shell on fully patched Windows 10 and 11. What RoguePlanet is, how to check your engine version and how to detect and defend against it.
By Adrián González · CEO y socio fundador
Stealing AI compute is now an industry: stolen cloud credentials and exposed inference servers that hand you the bill and fuel further attacks.
By Adrián González · CEO y socio fundador
Anubis ransomware has claimed 91 victims by exploiting Citrix Bleed 2: it leaks NetScaler memory, steals session tokens and walks in with no password and no MFA. What to detect before encryption.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
LLMs, copilots and vibe coding are already in companies, faster than their controls. The real risks to data, code and governance, plus the shadow-AI controls to put in place.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
How recent conflicts in Ukraine and Iran shape European cybersecurity: resilience, critical infrastructure, third parties, spillover and the lessons for businesses.
By Adrián González · CEO y socio fundador
What a breach linked to the European Commission reveals about supply chain, API keys, third parties, cloud, monitoring and compliance under NIS2, DORA, ENS and ISO 27001.
By Adrián González · CEO y socio fundador
A practical model to prioritise OT/IT risk for European manufacturers: critical processes, remote access, NIS2, IEC 62443, metrics and a realistic roadmap.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
A Microsoft 365 security audit checklist for businesses: Entra ID, MFA, Conditional Access, email, permissions, tenant hardening and the risks that most often appear.
By Adrián González · CEO y socio fundador
Vulnerability management does not fail for lack of scanners, but for poor prioritisation. What to fix first, using exploitation, exposure, asset criticality and compromised credentials.
By Adrián González · CEO y socio fundador
What malware analysis is, how it is performed, the techniques it uses and what it can reveal in a real incident: persistence, credential theft, exfiltration and more.
By Adrián González · CEO y socio fundador
Langflow's IDOR (CVE-2026-55255) landed on CISA's KEV list on 7 July. Attackers abuse it to harvest LLM keys, cloud credentials and database secrets embedded in AI flows.
By Adrián González · CEO y socio fundador
An executive guide for boards on what to communicate, to whom and at what cadence during the first 24 hours of a cyber incident, aligning business, legal and technical response.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
In 2026 most incidents combine credential theft, abuse of privileged access and resilience gaps. A practical guide to prioritising measures and aligning with NIS2 and DORA.
By Adrián González · CEO y socio fundador
Before you leave…
Quick 15-minute assessment and we'll tell you what to prioritise first: Microsoft 365, pentesting, vulnerability management, SOC, DORA, NIS2, ENS or ISO 27001.
No spam. Reply within 24h.
