Active campaigns, emerging techniques and high-impact CVEs: vector, exploitation chain, indicators of compromise and the controls that block them in production.
Active campaigns, emerging techniques and CVE analyses with real impact. Not headline coverage — vector breakdown, exploitation chain, indicators of compromise and the controls that block the technique in production.
We write about what we see: ClickFix and fake CAPTCHA, device code phishing in Microsoft 365, Signal and WhatsApp account hijacking, hidden C2 over Teams, npm supply-chain attacks, KEV CVEs with observed exploitation. Each post answers: how are teams already dealing with it.
What a modern cybersecurity company should really offer: audit, pen testing, managed SOC, cloud and Microsoft 365, identity, incident response and compliance — with a practical, risk-led approach.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
Microsoft has confirmed active exploitation of CVE-2026-42897, an XSS flaw in on-premises Exchange OWA that runs JavaScript the moment a crafted email is opened. What it means and how to contain it.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
An incompletely rotated token compromised Trivy, KICS and LiteLLM in March. Four months on, those credentials feed Vect ransomware that destroys data beyond recovery.
By Adrián González · CEO
A deepfake of the CFO cost one firm 25.6m dollars. Why voice no longer proves identity and how to protect your payments against AI-driven CEO fraud.
By Adrián González · CEO
A 16-year-old flaw in the KVM hypervisor lets a guest virtual machine break out to the host on Intel and AMD. What Januscape is and how to protect your virtualisation.
By Adrián González · CEO
A flaw in the Microsoft Defender engine spawns a SYSTEM shell on fully patched Windows 10 and 11. What RoguePlanet is, how to check your engine version and how to detect and defend against it.
By Adrián González · CEO
Stealing AI compute is now an industry: stolen cloud credentials and exposed inference servers that hand you the bill and fuel further attacks.
By Adrián González · CEO
Anubis ransomware has claimed 91 victims by exploiting Citrix Bleed 2: it leaks NetScaler memory, steals session tokens and walks in with no password and no MFA. What to detect before encryption.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
LLMs, copilots and vibe coding are already in companies, faster than their controls. The real risks to data, code and governance, plus the shadow-AI controls to put in place.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
How recent conflicts in Ukraine and Iran shape European cybersecurity: resilience, critical infrastructure, third parties, spillover and the lessons for businesses.
By Adrián González · CEO
What a breach linked to the European Commission reveals about supply chain, API keys, third parties, cloud, monitoring and compliance under NIS2, DORA, ENS and ISO 27001.
By Adrián González · CEO
A practical model to prioritise OT/IT risk for European manufacturers: critical processes, remote access, NIS2, IEC 62443, metrics and a realistic roadmap.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
A Microsoft 365 security audit checklist for businesses: Entra ID, MFA, Conditional Access, email, permissions, tenant hardening and the risks that most often appear.
By Adrián González · CEO
Vulnerability management does not fail for lack of scanners, but for poor prioritisation. What to fix first, using exploitation, exposure, asset criticality and compromised credentials.
By Adrián González · CEO
What malware analysis is, how it is performed, the techniques it uses and what it can reveal in a real incident: persistence, credential theft, exfiltration and more.
By Adrián González · CEO
Langflow's IDOR (CVE-2026-55255) landed on CISA's KEV list on 7 July. Attackers abuse it to harvest LLM keys, cloud credentials and database secrets embedded in AI flows.
By Adrián González · CEO
An executive guide for boards on what to communicate, to whom and at what cadence during the first 24 hours of a cyber incident, aligning business, legal and technical response.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
In 2026 most incidents combine credential theft, abuse of privileged access and resilience gaps. A practical guide to prioritising measures and aligning with NIS2 and DORA.
By Adrián González · CEO
A practical set of questions for evaluating a cybersecurity provider, MSSP or software product in 2026. Reduce hidden risk and buy with more judgement, operation and control.
By Adrián González · CEO
What a Security Operations Centre really is, the service levels it should offer and how it maps to NIS2, DORA and ENS: monitoring, managed security and forensic investigation.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
Vulnerability management is not just running a scanner. It includes inventory, detection, risk-based prioritisation, remediation, verification, exceptions, reporting and continuous follow-up.
By Adrián González · CEO
Healthcare is Europe's most ransomware-hit sector and an essential entity under NIS2. What ENISA's data shows, what the law demands and how to protect a hospital group without disrupting care.
By Adrián González · CEO
CVE-2026-12569 gives unauthenticated remote code execution on PTC Windchill and FlexPLM, already exploited with JSP web shells. Why your PLM is an attack surface almost no one inventories.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
A CVSS 10.0 flaw in SimpleHelp lets attackers forge OIDC tokens and gain technician sessions without credentials. Now on CISA's KEV list, exploited to deploy TaskWeaver and Djinn Stealer.
By Adrián González · CEO
CISA added CVE-2026-45659 to KEV on 1 July: a SharePoint on-premises RCE that Storm-2603 abuses to deploy Warlock ransomware. What to detect and how to respond.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
Sysdig documents JADEPUFFER, the first agentic ransomware: an AI model that entered through Langflow, stole credentials and destroyed a database. Read from the defender's side.
By Adrián González · CEO
Two critical Cursor flaws (DuneSlide) turn indirect prompt injection into code execution. What it means for the AI editors your developers use, and how to defend.
By Adrián González · CEO
The US is offering up to $10 million for information on Russian-linked groups that compromised Signal and WhatsApp accounts. What companies and executives should do next.
By Adrián González · CEO
On 23 June 2026 CISA added four UniFi OS and Lantronix EDS5000 flaws to its KEV catalogue. Chained, three of them give unauthenticated remote code execution on the box that manages your network.
By Adrián González · CEO
An unauthenticated endpoint in Splunk Enterprise's PostgreSQL service allows remote code execution. CISA added it to the KEV catalogue on 18 June. What breaks and how to contain it.
By Adrián González · CEO
DragonForce hid its command and control inside Microsoft Teams TURN relays and stayed undetected for nearly two months. How Backdoor.Turn works and how to hunt it on your network.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
On 17 June 2026 an attacker pushed more than 140 @mastra npm packages carrying a malicious dependency that runs a trojan during postinstall. What happened, and how to defend against it.
By Irene Ocando · Directora de Cumplimiento Normativo Hard2bit
We ran a 100% passive OSINT scan against 24 well-known brands and found 591 live typosquatting domains. 48% can send email. Anonymised aggregate data, June 2026.
By Adrián González · CEO
ClickFix tricks users into running PowerShell by pasting a command. 517% growth in 2025. Anatomy, operational detection and defences that genuinely work.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
SPIFFE/SPIRE for workload identity and OAuth for machine-to-machine: how each works, where each fits, and the hybrid pattern that scales for cloud-native enterprises.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
Technical playbook for SOC and IR teams: how to detect, contain and reduce Active Directory abuse in hybrid environments — Kerberoasting, AD CS misconfigurations, Golden Ticket and Entra ID.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
Before you leave…
Quick 15-minute assessment and we'll tell you what to prioritise first: Microsoft 365, pentesting, vulnerability management, SOC, DORA, NIS2, ENS or ISO 27001.
No spam. Reply within 24h.
