Category: Security

Security researchers at Koi Security have documented a campaign called ShadyPanda that represents a meaningful departure from how most malware operations work and why it matters for businesses that have not yet taken browser extension security seriously. More than 100 browser extensions, available through both the Chrome Web Store and the Microsoft Edge Add-ons marketplace, […]

Continue Reading

Cisco has patched a security vulnerability in its Identity Services Engine and ISE Passive Identity Connector that could have allowed attackers with valid administrator credentials to access sensitive data stored within the system. The vulnerability is rated medium severity, which in practical terms means it is not the kind of flaw that allows an unauthenticated […]

Continue Reading

The volume of fraudulent texts, fake bank alerts, and counterfeit delivery notices landing on business owners’ phones has increased sharply to start the year, and the timing is not accidental. Scammers operate with the same seasonal awareness that legitimate businesses do, targeting periods when inboxes are full, attention is divided, and the combination of post-holiday […]

Continue Reading

The cybersecurity conversation in most businesses focuses on the perimeter: the defenses that keep attackers from getting in through the front door. What that conversation frequently misses is that modern software does not have a single front door. It has hundreds of them, in the form of third-party libraries, open-source components, cloud services, and automated […]

Continue Reading

Two U.S.-based cybersecurity professionals have pleaded guilty to participating in ransomware attacks carried out under the ALPHV BlackCat affiliate program, including at least one successful extortion and multiple attempted ones. A third individual remains under investigation. These were not outsiders who stumbled into the cybersecurity industry as cover. They were trained practitioners with the kind […]

Continue Reading

Business email servers sit at the center of daily operations, which makes them a high-value target. When a maximum-severity flaw surfaces in widely deployed email software, the window between disclosure and active exploitation can close fast. That is the situation with CVE-2025-52691, a critical remote code execution vulnerability in SmarterMail that earned a perfect 10.0 […]

Continue Reading

Most small businesses have invested something in perimeter security. There is a firewall at the network edge, antivirus software on workstations, and some version of an understanding that the boundary between the internal network and the internet is where threats need to be stopped. That investment is not wasted. But the threat model it addresses […]

Continue Reading

Researchers at Oligo have published findings on critical vulnerabilities in Fluent Bit, an open-source log processing tool deployed across AWS, Google Cloud, and Microsoft Azure, as well as inside container environments and Kubernetes clusters running on those platforms. The vulnerabilities allow attackers to manipulate log data, bypass authentication controls, and execute arbitrary code on affected […]

Continue Reading

ASUS has issued an urgent security advisory and released a firmware patch addressing CVE-2025-593656, a critical authentication bypass vulnerability in its AiCloud remote-access feature. The flaw allows an attacker to access the router without valid credentials and execute operating system level commands remotely. If your organization has an ASUS router with AiCloud enabled and has […]

Continue Reading