Category: Security

The volume of fraudulent texts, fake bank alerts, and counterfeit delivery notices landing on business owners’ phones has increased sharply to start the year, and the timing is not accidental. Scammers operate with the same seasonal awareness that legitimate businesses do, targeting periods when inboxes are full, attention is divided, and the combination of post-holiday […]

Continue Reading

The cybersecurity conversation in most businesses focuses on the perimeter: the defenses that keep attackers from getting in through the front door. What that conversation frequently misses is that modern software does not have a single front door. It has hundreds of them, in the form of third-party libraries, open-source components, cloud services, and automated […]

Continue Reading

Two U.S.-based cybersecurity professionals have pleaded guilty to participating in ransomware attacks carried out under the ALPHV BlackCat affiliate program, including at least one successful extortion and multiple attempted ones. A third individual remains under investigation. These were not outsiders who stumbled into the cybersecurity industry as cover. They were trained practitioners with the kind […]

Continue Reading

Business email servers sit at the center of daily operations, which makes them a high-value target. When a maximum-severity flaw surfaces in widely deployed email software, the window between disclosure and active exploitation can close fast. That is the situation with CVE-2025-52691, a critical remote code execution vulnerability in SmarterMail that earned a perfect 10.0 […]

Continue Reading

Most small businesses have invested something in perimeter security. There is a firewall at the network edge, antivirus software on workstations, and some version of an understanding that the boundary between the internal network and the internet is where threats need to be stopped. That investment is not wasted. But the threat model it addresses […]

Continue Reading

Researchers at Oligo have published findings on critical vulnerabilities in Fluent Bit, an open-source log processing tool deployed across AWS, Google Cloud, and Microsoft Azure, as well as inside container environments and Kubernetes clusters running on those platforms. The vulnerabilities allow attackers to manipulate log data, bypass authentication controls, and execute arbitrary code on affected […]

Continue Reading

ASUS has issued an urgent security advisory and released a firmware patch addressing CVE-2025-593656, a critical authentication bypass vulnerability in its AiCloud remote-access feature. The flaw allows an attacker to access the router without valid credentials and execute operating system level commands remotely. If your organization has an ASUS router with AiCloud enabled and has […]

Continue Reading

Security researchers at Cato Networks have documented a technique called HashJack that allows attackers to embed hidden instructions inside URLs and have those instructions executed silently by AI-assisted browsers. The mechanism is a fragment identifier, the portion of a URL that follows the hashtag symbol, a component that web servers never process and that traditional […]

Continue Reading

The calendar application sitting at the center of your workday has become an active target for a category of attack that most organizations have not incorporated into their threat awareness. Security researchers have identified a pattern of abuse targeting calendar subscription features in Google Calendar, Outlook, and Apple Calendar, where malicious events appear directly in […]

Continue Reading