Articles 97 to 120 of 168. To search by keyword, go back to the blog hub.
Three chained FortiSandbox flaws allow unauthenticated remote code execution as root. CISA has already put the CVE on its KEV catalogue. What it means when your security appliance is the way in.
By Adrián González · CEO y socio fundador
On 11 July 2026 trojanised jscrambler releases hit npm with a Rust infostealer that loots cloud credentials, wallets and the secrets behind Cursor, Windsurf, Claude Desktop and MCP servers.
By Adrián González · CEO y socio fundador
Qualys has disclosed RefluXFS, a root privilege escalation in the XFS filesystem that affects default RHEL, Fedora and Amazon Linux installs and leaves no trace in the kernel logs.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
ClickFix is now the second most common initial access vector: a fake CAPTCHA convinces the user to run a command that installs ACR Stealer and steals session tokens and Microsoft 365 files.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
On 18 July the first attacks hit CVE-2026-6875, five days after the patch: a ServiceNow AI Platform sandbox escape giving unauthenticated RCE. What to watch and how to contain it.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
NIS2 makes the board personally accountable: approve, oversee, answer. What directors must approve and document to protect themselves, article by article.
By Adrián González · CEO y socio fundador
The European Commission has referred Ireland, Spain, France and the Netherlands to the CJEU over NIS2. What already binds organisations, and what to build now.
By Adrián González · CEO y socio fundador
Brussels did not pass a law. It published an execution policy linking the AI Act to NIS2, DORA and the CRA. The nine actions, the deadlines and the operating shift it demands of CISOs.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
An incompletely rotated token compromised Trivy, KICS and LiteLLM in March. Four months on, those credentials feed Vect ransomware that destroys data beyond recovery.
By Adrián González · CEO y socio fundador
A deepfake of the CFO cost one firm 25.6m dollars. Why voice no longer proves identity and how to protect your payments against AI-driven CEO fraud.
By Adrián González · CEO y socio fundador
A penetration testing report is not read by the number of findings. Real severity, CVSS v4.0, EPSS, false positives, prioritisation and what to demand from your provider to fix what matters.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
A professional penetration test has no single price. Realistic market ranges, day rates, the factors that move the budget and how to buy penetration testing well.
By Adrián González · CEO y socio fundador
Shadow AI already drives 20% of breaches and adds up to 670,000 dollars per incident. What it is, why you cannot see it and how to govern it without slowing your team.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
A 16-year-old flaw in the KVM hypervisor lets a guest virtual machine break out to the host on Intel and AMD. What Januscape is and how to protect your virtualisation.
By Adrián González · CEO y socio fundador
A flaw in the Microsoft Defender engine spawns a SYSTEM shell on fully patched Windows 10 and 11. What RoguePlanet is, how to check your engine version and how to detect and defend against it.
By Adrián González · CEO y socio fundador
OWASP, PTES, OSSTMM, NIST SP 800-115 and MITRE ATT&CK: what each penetration testing methodology contributes, how they differ and how they combine in a serious test.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Stealing AI compute is now an industry: stolen cloud credentials and exposed inference servers that hand you the bill and fuel further attacks.
By Adrián González · CEO y socio fundador
Nmap, Burp Suite, BloodHound, NetExec, Impacket, Hashcat: a penetration tester's real toolkit by phase, what each family validates, how it chains together and the trace it leaves.
By Adrián González · CEO y socio fundador
Anubis ransomware has claimed 91 victims by exploiting Citrix Bleed 2: it leaks NetScaler memory, steals session tokens and walks in with no password and no MFA. What to detect before encryption.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
An operational guide to turning NIS2 obligations into executable controls, with audit-ready evidence and reporting that is genuinely useful to leadership.
By Irene Ocando · Directora de Cumplimiento Normativo Hard2bit
The 93 Annex A controls are not implemented all at once. These four remove the most risk per hour invested and leave auditable evidence within weeks.
By Irene Ocando · Directora de Cumplimiento Normativo Hard2bit
What to automate in an ISMS and what must stay human, with the control design step that stops you ending up with data nobody reviews.
By Adrián González · CEO y socio fundador
NIS2 does not only affect large operators: many supplier SMEs will have to demonstrate controls, incident response and third-party management, often through their larger customers.
By Irene Ocando · Directora de Cumplimiento Normativo Hard2bit
What an AI compliance platform must actually deliver, how to evaluate one, and the question about model governance that almost nobody asks the vendor.
By Adrián González · CEO y socio fundador
Before you leave…
Quick 15-minute assessment and we'll tell you what to prioritise first: Microsoft 365, pentesting, vulnerability management, SOC, DORA, NIS2, ENS or ISO 27001.
No spam. Reply within 24h.
