Cybersecurity Blog & News

Analysis, news and plain explanations on cybersecurity, vulnerabilities and compliance, written for the people who have to act on them.

Request a quote

• PHP's Longjmp Bug: Inside CVE-2026-109618 and CVE-2026-109619 — Two critical PHP flaws rated 9.2 allow unauthenticated remote code execution on any web server running the interpreter. Here is how the longjmp memory corruption actually works, who is exposed, and w…
• Moldova Warns Public Institutions of Spear-Phishing Campaign Delivering Disguised .bat Payloads — STISC says attackers are mailing .7z and .zip archives from @mail.ru addresses, hiding executable files behind names like "Payment Order" and "Paid Invoices" — and the malware can clean up after itse…
• DORA Is Live: What Financial Firms Actually Have to Test Now — DORA replaced "do you have security controls?" with "have you proven your critical service survives a real attack?" Here's what the testing regime demands — and where TLPT fits.
• Moldova's Law 48/2023: What the NIS2-Style Cyber Rules Mean for Your Company — Moldova's first mandatory cybersecurity framework is now in force, modelled on the EU's NIS2. Here is who falls under it, what it actually demands, and why two of its obligations cannot be satisfied…
• PCI DSS 4.0 Requirements 11.3 and 11.4: What Actually Gets Tested — PCI DSS is the one framework that says "penetration test" out loud and pins a frequency to it. Here's what 11.3 and 11.4 demand, and what your QSA will ask for.
• ISO 27001 & SOC 2: The Technical Evidence Your Auditor Actually Wants — Neither standard says "run a penetration test every year." Both demand something no document can prove: that your controls actually work. Here's what auditors accept as evidence — and what quietly cr…
• DORA, NIS2 and CRA: A Field Guide to Europe's New Cybersecurity Rulebook — Three overlapping EU regulations are reshaping how companies prove they are secure. Here is what DORA, NIS2 and the Cyber Resilience Act actually demand — and why the deadlines matter.
• NIS2 and GDPR: How Penetration Testing Proves Compliance — NIS2 is an EU directive, yet Moldovan companies keep getting asked to prove their systems were tested. Here is how a penetration test answers that question — and what evidence each framework actually…
• N-Day Is Becoming N-Hour: Why Patching Faster Won't Save You — The window between a vendor's patch and a working exploit has collapsed from weeks to hours, thanks to AI. Here's what defenders need to do instead of just patching faster.
• Top Penetration Testing Companies in Moldova (2026) — An honest, criteria-based comparison of the leading penetration testing providers in Moldova to help you choose the right partner in 2026.
• EU Unveils New AI & Cybersecurity Action Plan: Model Audits, Controlled Access, and Testing for Critical Infrastructure — The European Commission has released a comprehensive Action Plan on AI and cybersecurity, outlining new rules for evaluating advanced AI models, controlled access for critical sectors, and a dedicate…
• Is Threat-Led Penetration Testing the New Penetration Testing? — Deloitte clarifies what TLPT is, how it differs from traditional penetration testing, and its role in EU DORA and other regulatory frameworks.
• Understanding Penetration Testing: A Comprehensive Guide — Penetration testing, or ethical hacking, simulates cyberattacks to identify vulnerabilities before malicious actors exploit them. This guide covers types, techniques, and steps involved.
• Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access — A threat actor tracked as O-UNC-066 is using voice phishing and a custom phishing kit to trick Microsoft 365 users into enrolling an attacker-controlled passkey, enabling account takeover and data ex…
• WP-SHELLSTORM: Exposed Server Reveals Mass WordPress Backdooring Operation — A cybercrime crew left its server open for 22 days, exposing a massive operation that backdoored thousands of WordPress sites using 27 CVEs, including CVE-2026-3844 in Breeze caching plugin.
• Claude Mythos AI Uncovers 10,000+ High-Severity Flaws in Critical Software — Anthropic's Project Glasswing, using Claude Mythos Preview, has identified over 10,000 high- or critical-severity vulnerabilities in widely used software, with patching now the main bottleneck.
• 9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros — Qualys disclosed CVE-2026-46333, a privilege escalation flaw in the Linux kernel's __ptrace_may_access() function, affecting major distributions since 2016. Exploits allow unprivileged users to read…
• Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure — A critical authentication bypass vulnerability (CVE-2026-20896, CVSS 9.8) in Gitea Docker images is being actively probed by threat actors just 13 days after public disclosure. The flaw allows unauth…
• Cisco SD-WAN Critical Flaw Prompts CISA Deadline as AI Browser Vulnerabilities Emerge — U.S. agencies issue urgent CISA deadline for patching critical Cisco SD-WAN vulnerabilities, while researchers uncover PleaseFix flaws in AI browsers that could compromise password managers.
• Qualys WAS Detects Log4Shell (CVE-2021-44228) in Web Applications — Qualys Web Application Scanning (WAS) now detects the critical Log4Shell vulnerability (CVE-2021-44228) using QID 150440 and 150441, leveraging Out-of-Band detection via Qualys Periscope.