EASM vs Penetration Testing: Why Continuous Asset Visibility Matters
Blog EASM vs Penetration Testing: Why Continuous Asset Visibility Matters An organisation can only assess the security of the systems it knows about. Internet-facing assets change as new applications go live and cloud services are reconfigured, and older systems often keep running after the project that needed them has ended. When those changes go unnoticed, […]
NHS, Samsung, CIA and More: Inside the Latest Dark Web Breach Claims
Blog NHS, Samsung, CIA and More: Inside the Latest Dark Web Breach Claims Executive Summary Dark web breach claims do not all carry the same level of risk. In recent listings involving NHS England, China Railway 12306, Turkey’s IYS, Samsung, Argentina’s Ministry of Health and RENAPER, and alleged CIA and FBI data, the available evidence […]
The NetScaler Zero-Day Siege and Pre-Auth RCE Chains : Technical Analysis and Exposure Assessment
Blog The NetScaler Zero-Day Siege and Pre-Auth RCE Chains: Technical Analysis and Exposure Assessment On September 27, 2026, Citrix published bulletin CTX697096 with eight NetScaler ADC and Gateway vulnerabilities. Two of them, CVE-2026-88771 and CVE-2026-88772, were already being exploited before fixed builds existed. Both give remote code execution to an unauthenticated attacker. CISA added both […]
An Open Server, an Exposed Toolkit Inside a Viva Aerobus-Linked Intrusion
Blog An Open Server, an Exposed Toolkit Inside a Viva Aerobus-Linked Intrusion On September 25, 2026, an attacker-controlled staging server used to host tools and stolen material was left exposed to the public internet with no authentication. At 16:20, a victim-side Microsoft SQL Server retrieved a payload from the infrastructure. Within minutes, an unrelated external […]
ShinyHunters Claims FBIJobs.gov Breach: New Zero-Day, CVE-2026-35273 Bypass, or Third-Party Failure?
Blog ShinyHunters Claims FBIJobs.gov Breach: New Zero-Day, CVE-2026-35273 Bypass, or Third-Party Failure? On September 22, 2026, the ShinyHunters extortion group claimed it had compromised FBIJobs.gov, the FBI’s recruitment portal, and defaced apply.fbijobs.gov with a fake seizure banner. The group says it walked away with roughly 2 to 3 TB of data on FBI agents, staff […]
16,415 Stolen Passwords, One Open Door: How Blackhatsect0r & DXQRTXX Exposed Themselves
Blog 16,415 Stolen Passwords, One Open Door: How Blackhatsect0r & DXQRTXX Exposed Themselves On July 28, 2026, someone posting as DXQRTXX told their own Telegram channel to tighten up their operational security. Weeks earlier, on the other side of that same channel, the crew had shared a report about a phishing operation that got caught […]
Port Scanning vs Service Detection: What an Open Port Really Means
Blog Port Scanning vs Service Detection: What an Open Port Really Means A port scan is often the first step in understanding what a host exposes to the network. You find an open port, identify the service behind it, and continue from there. The problem is that these two steps are not always as closely […]
Tracking Nightmare Eclipse: Exploits, PoCs, and Endpoint Security Risks
Blog Tracking Nightmare Eclipse: Exploits, PoCs, and Endpoint Security Risks TL;DR / Key Findings Identity: Abdelhamid Naceri’s vulnerability research predates the Nightmare Eclipse releases. Earlier disclosures identify him as halov and halove23; his 2026 proof-of-concept projects are published through MSNightmare. Employment dispute: Naceri links his public disclosures to his dispute with Microsoft. His account distinguishes […]
1,067 Victims in 30 Days: Inside August 2026’s Global Ransomware Wave
Blog 1,067 Victims in 30 Days: Inside August 2026’s Global Ransomware Wave A US federal law enforcement agency. A $10 billion wealth management firm. A children’s school system. A Turkish hospital. In August 2026 alone, ThreatMon tracked 1,067 ransomware victims worldwide and dug into 11 of the most damaging cases by hand. The data provides […]
Top API Security Vulnerabilities: Risks and Mitigation Strategies
Blog Top API Security Vulnerabilities: Risks and Mitigation Strategies Application Programming Interfaces (APIs) have become a core part of modern digital environments, connecting microservices, mobile applications, cloud infrastructure, and automated workflows. They allow developers to integrate systems more efficiently, reduce development effort, and speed up the delivery of new applications and services. At the same […]