CVE-2026-94127 is a patching emergency, but the real lesson is what happens when perimeter appliances quietly become identity providers nobody tested.
-
-
MFA blocks the vast majority of account takeovers, but attackers now have working playbooks against weaker forms of it. Here is how MFA works, how it gets bypassed, and a …
-
Fixing what a pen test found is only half the job. Here’s how to prioritise remediation, and why retesting is what actually proves the fix worked.
-
Phishing simulation testing shows exactly who clicks and who reports, but NCSC and UK GDPR both set limits on how to run it fairly. Here is how the process works.
-
A buyer’s checklist for vetting a mobile app penetration testing quote, covering what should be in scope, what questions to ask, and what a useful report looks like.
-
From scoping to retesting, here’s where the time actually goes in a penetration test and why the total is longer than the days you’re quoted.
-
Third party plugin risk, not clever malware, is why a critical WooCommerce flaw patched in February is still being exploited in September.
-
A web application firewall filters attack traffic in real time, but the vulnerability behind a blocked request is still there tomorrow. What it stops, why it can be bypassed, and …
-
The Cisco ISE patch for CVE-2026-76460 isn’t optional. A step-by-step plan for checking versions, patching, and spotting prior compromise.
-
EvilTokens compromised over 12,000 Microsoft 365 inboxes using device code phishing before Microsoft’s Digital Crimes Unit shut it down. Here is how the attack works and a five-point check for …