Category: IT Support

Two U.S.-based cybersecurity professionals have pleaded guilty to participating in ransomware attacks carried out under the ALPHV BlackCat affiliate program, including at least one successful extortion and multiple attempted ones. A third individual remains under investigation. These were not outsiders who stumbled into the cybersecurity industry as cover. They were trained practitioners with the kind […]

Continue Reading

Business email servers sit at the center of daily operations, which makes them a high-value target. When a maximum-severity flaw surfaces in widely deployed email software, the window between disclosure and active exploitation can close fast. That is the situation with CVE-2025-52691, a critical remote code execution vulnerability in SmarterMail that earned a perfect 10.0 […]

Continue Reading

Most small businesses have invested something in perimeter security. There is a firewall at the network edge, antivirus software on workstations, and some version of an understanding that the boundary between the internal network and the internet is where threats need to be stopped. That investment is not wasted. But the threat model it addresses […]

Continue Reading

Researchers at Oligo have published findings on critical vulnerabilities in Fluent Bit, an open-source log processing tool deployed across AWS, Google Cloud, and Microsoft Azure, as well as inside container environments and Kubernetes clusters running on those platforms. The vulnerabilities allow attackers to manipulate log data, bypass authentication controls, and execute arbitrary code on affected […]

Continue Reading

ASUS has issued an urgent security advisory and released a firmware patch addressing CVE-2025-593656, a critical authentication bypass vulnerability in its AiCloud remote-access feature. The flaw allows an attacker to access the router without valid credentials and execute operating system level commands remotely. If your organization has an ASUS router with AiCloud enabled and has […]

Continue Reading

Security researchers at Cato Networks have documented a technique called HashJack that allows attackers to embed hidden instructions inside URLs and have those instructions executed silently by AI-assisted browsers. The mechanism is a fragment identifier, the portion of a URL that follows the hashtag symbol, a component that web servers never process and that traditional […]

Continue Reading

The calendar application sitting at the center of your workday has become an active target for a category of attack that most organizations have not incorporated into their threat awareness. Security researchers have identified a pattern of abuse targeting calendar subscription features in Google Calendar, Outlook, and Apple Calendar, where malicious events appear directly in […]

Continue Reading