Lately, you may have come across posts online where people offer to “use” your LLC for a short period of time, often promising to send you…

For decades, we’ve been told the same thing:

This is the Career & Certification Roadmap You Need

How I chased a simulated adversary up the Pyramid of Pain from TryHackMe

“Cloud security isn’t just about protecting data — it’s about building trust, resilience, and accountability.”

Intro

In cybersecurity, the worst-case sometimes is a simple one: a trusted internal system (the one you rely on to push updates ) is turned…

ISC warned of a High-severity DoS flaw (CVE-2025-11232) in Kea DHCPv4. A crafted DHCP packet can crash the server due to improper hostname validation, disrupting IP assignment. Patch to v3.0.2/3.1.3.

Urgent patch for WP Freeio plugin (v.< 1.2.22). Unauthenticated attackers can gain admin control instantly via a registration flaw. Update immediately to v.1.2.22.

Google Chrome 142 desktop update fixes 20 security flaws, including critical V8 Type Confusion (CVE-2025-12428) and Race conditions. Update your browser now.

Socket exposed an npm typosquat campaign using 10 fake packages (Netherеum.All). The malicious postinstall script deploys a 24MB PyInstaller stealer after prompting a fake CAPTCHA.

WSO2 patched three Critical flaws (CVSS 9.8) in API Manager/Identity Server. Flaws in regex access control and case-sensitive HTTP methods allow unauthenticated administrative takeover.

A critical hardware attack, TEE.fail, uses low-cost DDR5 memory bus interposition to extract root attestation keys from Intel TDX and AMD SEV-SNP. The flaw affects core server-grade TEEs.

ASEC exposed Trigona RaaS attacking exposed MS-SQL servers via brute-force. The group uses CLR Shell, a new Rust-based scanner, and the BCP utility to store and execute malware from database tables.

IIJ exposed a novel loader that simultaneously deploys TorNet (TOR C2) and PureHVNC (RAT) via DLL sideloading. It uses MurmurHash2 for API hashing and injects into jsc.exe for stealth.

A Babuk successor, Midnight ransomware, contains a critical flaw in its RSA key handling. Gen researchers created a free decryptor that bypasses the encryption, allowing victims to recover files.

HelixGuard exposed a VSCode supply chain attack using 12 malicious extensions. They steal source code, capture screenshots, and open reverse shells via Ngrok and AWS EC2 to compromise developers.

Google announced Chrome 154 (Oct 2026) will automatically enable “Always Use Secure Connections,” marking a major security push to combat MitM attacks by warning users before visiting unencrypted HTTP sites.

BitSight uncovered a Lampion banking Trojan campaign using ClickFix lures and a 700MB bloatware DLL to evade AV. The VBScript loader establishes persistence via the Windows Startup folder.

There are two truths I live by: one, always keep coffee within arm’s reach; two, curiosity + an API = bad decisions that turn into CVEs…