Blog
Notes from the front line
What we are seeing in the alerts we investigate, and what it means for the teams on the receiving end.
Barracuda ESG: two flaws chain to unauthenticated root
Two Barracuda ESG flaws can be chained for root without a login if Admin UI is reachable. What the CVEs do, who is affected, and what to patch.
When the security update is the attack: OpsShield's cPGuard supply chain breach
Attackers hijacked OpsShield's cPGuard update channel for ~70 minutes, hitting ~2,950 Linux servers as root. What SOCs and hosts should do now.
Supermarket fridge cyber attacks: lock down exposed controllers
The supermarket fridge cyber attacks hit stores across Europe and UK food suppliers through exposed, unpatched controllers. What happened and what to check now.
NCSC State of the Cyber Nation 2026: what AI attacks mean for you
The NCSC State of the Cyber Nation report warns of AI-powered ransomware on UK infrastructure by 2028. What it says and the steps to take now.
Ivanti Connect Secure zero-days: why you need to patch again
Ivanti Connect Secure zero-days gave attackers root on fully patched VPNs. Why the October fix isn't enough, what attackers took, and what to do now.
Compromised developer laptops: lessons from the Binance hack
The $6.3bn Binance hack may have started with a compromised developer laptop. What happened, why engineers' devices matter, and what to check now.
ESXi logging flaw CVE-2026-41709: when your audit trail goes quiet
CVE-2026-41709, a 'low' VMware ESXi logging flaw, was used as a zero-day to hide attackers' tracks. Why the score misled, and what to patch and check now.
Node2Shell: is the Brotli flaw hiding in your Node.js?
Node2Shell (CVE-2026-111497) is a critical Brotli flaw inside Node.js, now actively exploited. How to find exposed systems, patch, and spot attack attempts.
PHP2Shell: patched isn't safe until you check for compromise
PHP2Shell was exploited before the 21 October fix. How to find every PHP install and check for signs of compromise, not just confirm the patch.
Five Security Controls That Would Have Changed 15 Breaches
Five security controls would have changed fifteen major breaches, from Target and Equifax to MOVEit and Change Healthcare. Can you prove yours work today?
ConnectWise Breach: Why Microsoft 365 App Permissions Matter
The ConnectWise Cloud Backup compromise reached Microsoft 365 tenants through already-trusted apps, at machine speed. What happened and what to check now.
Attacker Dwell Time: How Long Do Intruders Go Undetected?
Attacker dwell time is how long intruders go unnoticed. Mandiant's latest median, seven real breach timelines, and how to cut the time from signal to response.