blog

ESET researchers have caught the China-aligned threat actor FamousSparrow deploying a previously undocumented backdoor called SparroWocky against government targets across Latin America, with activity dating back to at least August 2025. Confirmed targets span…

The Internet Systems Consortium has patched 14 vulnerabilities in BIND 9, the software running a large share of the internet’s authoritative and recursive DNS servers. Seven are rated high severity and can be triggered…

CISA has added a critical ConnectWise ScreenConnect vulnerability, CVE-2026-84869 (CVSS 9.9), to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw lets an attacker transfer a file to a device and execute…

Attackers bypass 2FA without stealing your password — via app passwords, OAuth consent and messenger linking. How the techniques work and how to defend.

CVE-2026-27540 (CVSS 9.0) lets anyone upload a PHP webshell to WooCommerce stores via the Wholesale Lead Capture plugin. A GDPR and PCI problem for EU stores.

If an AI agent on your server hacks something, who is liable? A breakdown for the US and EU (CFAA, EU AI Act, GDPR) and why incident logging can save you.