Articles 25 to 48 of 168. To search by keyword, go back to the blog hub.
Ivanti fixed CVE-2026-104935, a Connect Secure zero-day used to steal Active Directory credentials, on 13 October 2026. The root privilege escalation is still unpatched.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
On 11 and 12 October 2026, an attack on Danfoss refrigeration controllers heated cold rooms in hundreds of French supermarkets to 50°C. What failed and how to monitor them.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Windows Server 2012 gets its last ESU patches on 13 October 2026, and Exchange 2016 and 2019 at the end of the month. How to inventory, isolate and document the servers that stay.
By Adrián González · CEO y socio fundador
Attackers who seized the .gh, .sl and .as registries obtained twelve valid Let's Encrypt and ZeroSSL certificates for Google and YouTube. Why CAA and DNSSEC failed, and how CT monitoring helps.
By Adrián González · CEO y socio fundador
On 24 June 2026 the DGFiP reset the password of a compromised account and the open session went on extracting data for almost 16 hours, according to ANSSI's report.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
The FortiMail vulnerability CVE-2026-104286 lets an unauthenticated attacker write files and was exploited as a zero-day. Affected versions, patch status, IoCs and mitigation.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
We requested security.txt from 219 large Spanish companies: 19 of the 197 that responded publish it and 12 have it in order. What it is, what NIS2 and the CRA say, and how to set one up.
By Adrián González · CEO y socio fundador
One of the two NetScaler zero-days had been exploited for over three weeks when the fix shipped. Upgrading neither deletes the web shells left behind nor invalidates what was stolen.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
In Sophos's 2024 survey, 94% of ransomware victims saw attackers try to compromise their backups. How to protect backups from ransomware with the 3-2-1-1-0 rule and immutable storage.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
UpGuard found 16,326 Supabase databases with readable tables. The 30 October change will not close existing tables: what to check in RLS, keys and logs.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Hard2bit was a Silver sponsor at CyberMadrid's SME congress. The themes we took to the panel on the human factor and suppliers, and what SMEs can apply now.
By Adrián González · CEO y socio fundador
Twenty-five years of cybersecurity in five eras: from mass worms to ransomware and supply chain attacks, and from antivirus to 24/7 SOCs, EU regulation and board accountability.
By Daniel O'Grady · CIO y socio fundador
Years before Morse, France ran a state data network, and two Bordeaux speculators paid insiders to hide market signals inside it. They were acquitted. The story, and what it means for insider risk.
By Adrián González · CEO y socio fundador
Spain's data protection authority has received its first breach notification involving an AI agent and is calling for GDPR risk assessments to cover AI-executed attacks explicitly.
By Adrián González · CEO y socio fundador
Renfe says attackers reached its customer data through Adif servers linked to its systems. What is confirmed, what is not, and what to check in your organisation.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Half of the 8,257 incidents in ENISA's Threat Landscape 2026 are DDoS. Set that noise aside and the report points to exploited vulnerabilities, suppliers and data-theft extortion.
By Adrián González · CEO y socio fundador
A flat internal network lets an intruder reach the domain and the backups within minutes. What to separate first, which flows to cut and how to check it holds.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Microsoft and a coalition of partners have dismantled EvilTokens, the device code phishing kit whose AI analysed stolen mailboxes to set up fraud. What the data shows and which controls work.
By Adrián González · CEO y socio fundador
Four AI coding agents pinned every plugin to a reviewed commit and none of them checked where the checkout landed. What breaks, who has a patch and what to control in the enterprise.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
What changed in the OWASP Top 10 2025, why two categories come from a survey rather than the data, what a pentester tests in each one and what to add to the scope of your next web audit.
By Adrián González · CEO y socio fundador
A guide to honeytokens: fake-SPN accounts, accounts that never sign in, credentials planted in SYSVOL and cloud tokens. How to build them, watch them and stop them becoming a risk.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
What tiered administration is, what belongs in Tier 0, why so many organisations skip it, and which controls and evidence prove the model exists.
By Adrián González · CEO y socio fundador
Proofpoint and Volexity separately document Chinese groups exploiting three Chrome and Windows zero-days in the gap between the Chromium fix and the browser release.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
On 29 September we will have a stand at Digitaliza Madrid and Thilina Manana joins the panel on the human factor and the supply chain.
By Adrián González · CEO y socio fundador
Before you leave…
Quick 15-minute assessment and we'll tell you what to prioritise first: Microsoft 365, pentesting, vulnerability management, SOC, DORA, NIS2, ENS or ISO 27001.
No spam. Reply within 24h.
