News
Cisco, Palo Alto and Ahsay flaws under attack: fix by October 17
One email can give an attacker root on an exposed Cisco gateway. The PAN-OS bug needs a login, and Ahsay's first fix for its backup console did not hold.
Security
Breaches, vulnerabilities and attacks that affect enterprise IT, and the fixes to install first.
News
Microsoft seizes phishing kits behind 1 billion messages this year
A Florida court order let Microsoft take over the domains. Its threat report shows how one group took over Microsoft 365 tenants and resold them to phishers.
Patch priority
October Patch Tuesday: 1,411 fixes and one exploited Windows flaw
A Mark of the Web bypass is under attack, Exchange and Active Directory have high-risk fixes, and an Ivanti VPN zero-day arrived the same day.
News
FBI raids 40 Texas laptop farms tied to North Korean IT workers
An Ohio indictment says one network placed workers at more than 70 US companies. The FBI's new alert says the schemes now use more facilitators and smaller farms.
News
Ahold Delhaize cyber incident takes US grocery sites and apps offline
Websites, apps and online ordering stopped at Food Lion, Stop & Shop, Giant Food and Hannaford, and Albert Heijn distribution centers in the Netherlands went quiet.
News
FBI warns FortiBleed attackers are locking companies out of their own FortiGate firewalls
A joint advisory issued on October 6 says the operators sell network access to ransomware groups. No CVE is involved, so a firmware update will not evict them.
Patch priority
NetScaler patch priority: a third Citrix bulletin in two weeks fixes a critical SAML flaw
Two of the September flaws were exploited before a fix existed, and a SAML bug was used against appliances last week. One upgrade now covers all three bulletins.
Explainer
AI in cyberattacks and cyber defense: what threat reports actually show
Attackers are using AI to work faster, not to invent new attacks. That's the consistent finding from threat reports so far, and it shapes where defenders should spend.
Explainer
Ransomware protection: what a mid-size IT team should have in place
FBI ransomware complaints rose to 3,611 in 2025. The controls that stop most attacks are well known, and most of them are cheap. Here is what to check first.
Explainer
Cloud security best practices: the NSA's ten mitigations, translated for IT teams
Most cloud breaches come from settings the customer controls, not from the provider. The NSA's list of ten mitigations is the clearest guide to which settings matter.
Explainer
Securing the AI pipeline: data poisoning, model supply chain and prompt injection
An AI system can be attacked through its training data, the models it downloads and the text it reads. Each stage of the pipeline needs its own controls.
Guide
Multi-cloud security: NSA's ten mitigation strategies applied across providers
Each cloud has its own identity system, logs and defaults. Securing several at once comes down to applying one set of rules everywhere, and the NSA has published a good starting list.
Guide
The cyber threats hitting businesses most in 2026, and the defense for each
Software vulnerabilities have overtaken stolen passwords as the top way attackers get in, according to Verizon's 2026 breach report. Ransomware shows up in almost half of breaches.
Explainer
OT incident response: how it differs from IT, and what NIST SP 800-82 recommends
In a factory or utility, the first question in an incident isn't what data was stolen. It's whether the physical process is still safe.
Explainer
Intrusion detection systems: how IDS and IPS work, and where they fit now
An intrusion detection system watches traffic or hosts for signs of attack. It's an old idea that still catches what endpoint tools miss, especially on devices that can't run an agent.
Explainer
Cybersecurity is now a board disclosure issue: what the SEC rules require
Since December 2023, a material cyber incident at a US-listed company has a four-business-day disclosure clock. That has moved security from an IT budget line to a board agenda item.
Guide
Application security in 2026: the new OWASP Top 10 and how to act on it
OWASP's 2025 Top 10 keeps broken access control at number one and moves software supply chain failures to third. Here is the list, and what to do about it.
Guide
A cyber defense baseline for mid-size companies: the CIS Controls IG1 safeguards
Most attacks on mid-size companies use well-known methods. CIS's Implementation Group 1 is a list of 56 safeguards built to stop them.
Explainer
Why SIEM projects stall, and what CISA's 2025 guidance says to do about it
A SIEM is only as good as the logs it gets and the people tuning it. CISA's guidance reads like a list of the reasons so many deployments disappoint.
Explainer
Static application security testing (SAST): what it catches, what it misses
SAST tools scan source code for security flaws before it runs. OWASP's own assessment is that they catch a useful slice of problems, and miss a lot.
Explainer
Incident response steps: what NIST's 2025 update changed, and how to use it
NIST's incident response guide went 13 years without an update. The new version treats response as part of everyday risk management, not a separate plan in a drawer.
Explainer
Endpoint security in 2026: EDR, device management and the devices left out
Laptops and servers are better protected than ever. Attackers have moved to the devices around them: phones, edge appliances and machines no one manages.
Guide
Mobile app security: building to the OWASP MASVS standard
Mobile apps put company code and data on devices you don't control. OWASP's mobile standard breaks the problem into eight areas to test against.
Explainer
SASE explained: what single-vendor platforms offer, and how to choose one
SASE combines networking and security into one cloud service. Gartner expects most companies buying SD-WAN to get it as part of a single-vendor platform within a few years.
Guide
Securing a cloud migration: what to set up before, during and after the move
Migrations create security gaps: temporary access that becomes permanent, test data copied without controls, and old systems left running. Most of the risk can be planned out.
Explainer
Identity and access management: why MFA type matters as much as MFA itself
Most attacks now start with a stolen login. CISA's guidance is blunt: SMS codes and push approvals can be beaten, and only phishing-resistant MFA closes the gap.
Explainer
What is SIEM? Security information and event management explained
A SIEM gathers security logs in one place and looks for signs of attack. Whether you need your own depends on who will watch it.