Security
Everything I’ve written on Security, newest first.
New
- Security · 27 October 2026
File uploads: the door we keep leaving open
Why “upload a file” is still one of the easiest ways into a web application, and a short checklist that actually holds.
- Security · 16 October 2026
BeyondTrust Remote Support was exploited since August
A remote support zero-day was used by suspected espionage actors for weeks before the patch. Self-hosted appliances need patching and checking.
- Security · 6 October 2026
Phishing tests that teach, not trap
Phishing simulations that shame people make them hide mistakes. Run them to practise reporting, not to catch people out.
- Security · 2 October 2026
FortiMail zero-day: lock down the admin interface
A critical FortiMail bug is being exploited and fixed releases aren’t all out yet. Disable IBE or restrict management access now.
- Security · 29 September 2026
Security awareness month: skip the posters
October is awareness month. Instead of posters and a quiz, do three things that change how people act.
- Security · 22 September 2026
When someone leaves: the offboarding checklist
Most access problems start with a departure nobody fully processed. One checklist, run on the last day, fixes it.
- Security · 18 August 2026
Give your data warehouse your strongest login
Extortion groups again claim big thefts from cloud data platforms this month, reportedly after phoning staff. Lock those logins down.
- Security · 4 August 2026
Stolen sessions skip your MFA
Infostealers grab browser cookies, so attackers log in as you without a password or MFA. Shorter sessions and device checks help.
- Security · 21 July 2026
A CAPTCHA that asks you to run a command is malware
Fake “verify you’re human” pages tell visitors to press Win+R and paste a command. It installs malware. Teach people this one rule.
- Security · 2 July 2026
Who’s on call while everyone is on holiday?
Attackers like holidays because nobody is watching. Agree now who answers the phone in July and August.
- Security · 16 June 2026
Travelling with a work laptop this summer
Airports, hotels and borders are where laptops get lost, stolen or inspected. A few steps before you leave make each of those boring.
- Security · 4 June 2026
A one-hour incident exercise
You don’t need a consultant or a full day. One hour, one scenario and the right five people show where your plan breaks.
- Security · 26 May 2026
Who can export your whole CRM?
Extortion groups keep phoning staff and walking out with SaaS exports. Limit and watch bulk exports.
- Security · 7 May 2026
Passkeys for your staff, not just customers
Most phishing that works today gets past passwords and push MFA. Passkeys on staff accounts stop it.
- Security · 28 April 2026
Remote support tools are a favourite way in
CISA added more remote management and support tools to its exploited list this month. If your IT provider uses one, ask about it.
- Security · 23 April 2026
Don’t read email with your admin account
If the account you browse and read email with is also a domain or cloud admin, one bad click hands over everything.
- Security · 21 April 2026
Attackers want your developers’ laptops
Poisoned packages and extensions keep targeting developers for their tokens. A developer machine often has the keys to production.
- Security · 14 April 2026
Too many updates? Patch in this order
Patch Tuesday keeps getting bigger. You can’t do everything on day one, so do the right things first.
- Security · 7 April 2026
Shared passwords belong in a shared vault
Teams still share logins in spreadsheets and chat messages. A team password manager is cheaper than the cleanup.
- Security · 25 March 2026
Voice phishing is how SaaS data leaves now
This month’s breaches at Crunchyroll and Aura reportedly started with phone calls and phished support staff. Your help desk and vendors are the target.
- Security · 13 March 2026
Stryker: device management used to wipe the company
Attackers took over an Intune admin account at Stryker and used it to wipe devices across the company. Your MDM can do the same.
- Security · 26 February 2026
When the hospital goes back to paper
Ransomware closed a US medical centre’s clinics across a whole state this month. Every organisation needs a plan for working without systems.
- Security · 17 February 2026
Keep an emergency admin account, and lock it away
If your single sign-on or MFA breaks, you need a way back in. A break-glass account is that way, if it’s protected properly.
- Security · 13 February 2026
Apple’s first exploited zero-day of 2026
iOS 26.3 fixes a bug Apple says was used in an extremely sophisticated attack on specific people. Update your devices.
- Security · 10 February 2026
The European Commission was hacked through its MDM
Attackers used Ivanti mobile management zero-days against EU and Dutch government bodies. The server that manages your phones is a crown jewel.
- Security · 29 January 2026
Check your mailbox for forwarding rules
After a mailbox is broken into, attackers often leave a quiet forwarding rule. Changing the password doesn’t remove it.
- Security · 8 January 2026
Start the year by removing access
January is the easiest month to clean up accounts: people who left, contractors who finished, apps nobody uses.
- Security · 16 December 2025
A year-end security checklist
Quiet weeks are good for boring jobs. Eight things to close before January.
- Security · 4 November 2025
The logs you’ll wish you had
When something goes wrong, the first question is “what happened?”. Keep these logs before you need them.
- Security · 23 September 2025
When the phishing page looks exactly like your login
Modern phishing pages are perfect copies. Your password manager is the best detector you have.
- Security · 15 July 2025
Five security basics for a small business
No security team needed. Five things, in the order I’d do them.
- Security · 17 June 2025
MFA fatigue: when “Approve” becomes the attack
Someone with your password spams login prompts until you tap Approve. Four settings stop it.
- Security · 13 May 2025
Security headers in an afternoon
Six response headers, copy-paste values, and the one to roll out slowly.
- Security · 15 April 2025
Secrets in Git: how they leak and how to stop it
Deleting the file doesn’t remove the key. What to do first, and how to stop the next leak.
- Security · 14 January 2025
Passkeys: what they fix, and what they don’t
Passkeys kill password phishing. They don’t fix account recovery or stolen sessions.
- Security · 10 December 2024
Even the FBI now says: use encrypted messaging
After the telecom hacks, US agencies told people to use end-to-end encrypted apps. Normal SMS and calls aren’t private.
- Security · 5 November 2024
Fake delivery texts before the holidays
“Your parcel is waiting, pay the small fee.” The busiest shopping weeks are the busiest for this scam too.
- Security · 22 October 2024
Internet Archive: the token nobody rotated
31 million accounts leaked, then attackers came back. Reports point to an access token left unrotated for almost two years.
- Security · 24 September 2024
Your antivirus can change owners overnight
Kaspersky users in the US woke up to a different antivirus. A reminder to know who runs your most trusted software.
- Security · 10 September 2024
NIST says: stop forcing password changes
The new NIST draft drops forced resets and “one symbol, one number” rules. Here’s what to do instead.
- Security · 20 August 2024
Post-quantum cryptography: what to do now
NIST published its first post-quantum standards this week. You don’t need to panic, but you do need a list.
- Security · 9 July 2024
regreSSHion: update OpenSSH on your Linux servers
A critical OpenSSH bug can give root without a password on many Linux servers. Check your version.
- Security · 11 June 2024
Infostealers: one infected laptop, one data breach
The Snowflake customer breaches started with passwords stolen by malware, some of them years old. How to break that chain.
- Security · 7 May 2024
One remote portal without MFA
Change Healthcare’s attackers walked in through a remote-access portal with no MFA. Check every login page you expose.
- Security · 2 April 2024
The xz backdoor, in plain words
A backdoor nearly reached millions of Linux servers through a compression library. What to check, and what it teaches.
- Security · 6 February 2024
Old test accounts are open doors
Microsoft’s own email was read through a forgotten test account without MFA. Go find yours.
- Security · 23 January 2024
Your VPN box is now the front door
The Ivanti attacks are another reminder: firewalls and VPN appliances are a favourite way in. Treat them like that.
- Security · 12 December 2023
14,000 reused passwords, 6.9 million people affected
23andMe’s breach started with credential stuffing on a small number of accounts. A sharing feature did the rest.
- Security · 7 November 2023
Don’t send live session tokens to support
The Okta support breach worked because customers uploaded HAR files with valid sessions inside. Clean them first.
- Security · 31 October 2023
Citrix Bleed: patch, then kill the sessions
The NetScaler bug leaks session tokens. If you patched without ending sessions, attackers may still be logged in.
- Security · 26 September 2023
One image library, hundreds of apps to update
The WebP bug was fixed in Chrome in days. The same code sits inside Slack, Teams and many other apps.
- Security · 19 September 2023
Your help desk can reset anyone’s MFA
The MGM attack reportedly began with a phone call to the IT help desk. Fix how resets are verified.
- Security · 25 July 2023
The log that caught Storm-0558 was a paid extra
Attackers read government email using forged Microsoft tokens. It was spotted thanks to a premium log most customers didn’t have.
- Security · 23 May 2023
When “invoice.zip” is a website, not a file
The new .zip and .mov domains make links that look like file names. Teach people to check where a link really goes.
- Security · 9 May 2023
Google accounts now take passkeys. Set one up
Since last week you can sign in to Google with a passkey instead of a password. Two minutes, and phishing stops working.
- Security · 25 April 2023
Google Authenticator now syncs: turn it on?
Losing your phone no longer means losing your 2FA codes. But your Google account now holds them.
- Security · 21 March 2023
The Outlook bug that needs no click
A calendar reminder can leak your Windows password hash before you open anything. Patch now.
- Security · 14 March 2023
After SVB: beware of “new bank details”
Bank news creates the perfect cover for invoice fraud. One rule stops it.
- Security · 21 February 2023
The best part of Reddit’s breach: someone spoke up
An employee fell for a fake login page, then reported it right away. That’s the culture to build.
- Security · 10 January 2023
The LastPass breach: what to do now
Attackers copied encrypted LastPass vaults. How safe yours is depends on one thing: your master password.
- Security · 27 December 2022
Next year’s security plan: one thing a month
Big security programmes stall. Twelve small, finished improvements beat one big plan that never starts.
- Security · 20 December 2022
Fortinet SSL-VPN bug: patch, then hunt
A pre-login bug in FortiOS SSL-VPN is being exploited. Update, and look for the signs Fortinet published.
- Security · 29 November 2022
Moving to Mastodon? Three settings first
Millions are trying Mastodon this month. Turn on 2FA, choose your server with care, and verify your identity.
- Security · 22 November 2022
After FTX: beware “we can recover your money”
When an exchange collapses, scammers target its customers twice. Recovery offers are the second hit.
- Security · 15 November 2022
A blue tick isn’t identity
Paid verification on Twitter led straight to fake brand accounts. Check who you’re dealing with another way.
- Security · 8 November 2022
Medibank won’t pay the ransom. Good
Medibank refused the ransom for its stolen customer data. Paying doesn’t guarantee the data gets deleted.
- Security · 11 October 2022
Four things everyone should do this month
October is Cybersecurity Awareness Month. Skip the posters. These four habits stop most attacks on people.
- Security · 4 October 2022
ProxyNotShell: Exchange zero-days, no patch
On-premises Exchange servers are under attack again. Apply the mitigation, and plan your way off on-prem mail.
- Security · 20 September 2022
Uber’s breach: MFA spam and a password in a script
A teenager got deep into Uber with stolen credentials, repeated MFA prompts and an admin password in a PowerShell file.
- Security · 13 September 2022
iOS 16 Lockdown Mode: who should turn it on
Apple’s new Lockdown Mode blocks the features spyware abuses. Most people don’t need it. Some really do.
- Security · 6 September 2022
Ransomware loves a long weekend
LA’s school district was hit over the Labor Day weekend. Attackers pick the days nobody is watching.
- Security · 30 August 2022
LastPass source code stolen: what it means for you
LastPass says attackers took source code but no vaults. A good moment to check the one password that protects all the others.
- Security · 16 August 2022
Same phishing texts, two different endings
Twilio and Cloudflare were hit by the same SMS phishing campaign. Hardware security keys made the difference.
- Security · 31 May 2022
Follina: a Word file that runs code, no macros needed
A new Office zero-day abuses the Windows support tool. There’s no patch yet, but there is a workaround.
- Security · 10 May 2022
Big Tech promises to drop the password
The three giants agreed to support passwordless sign-in across devices. What it means, and what to do while we wait.
- Security · 29 March 2022
Lapsus$: no zero-days, just people
The group that hit Nvidia, Samsung, Microsoft and Okta used MFA spam, SIM swaps and paid insiders. Defend those.
- Security · 1 March 2022
“Shields Up”: a small company’s week
Security agencies are warning of more cyber attacks. The checklist is short, and it’s the same basics as always.
- Security · 15 February 2022
Office will block internet macros. Get ready
Office will soon block VBA macros in files from the internet by default. Good news, if you plan for the files that break.
- Security · 25 January 2022
That QR code on the parking meter might be a sticker
Fake QR stickers on parking meters are sending people to payment scams. QR codes are links you can’t read.
- Security · 11 January 2022
Log4Shell, one month on: where it still hides
You patched the obvious Java apps in December. Log4j also hides in vendor products, fat JARs and old containers.
- Security · 14 December 2021
Log4Shell: what to do this week
A bug in the Log4j logging library lets attackers run code with a single line of text. Find every Java app you have.
- Security · 7 December 2021
Before the holidays, check your checkout page
Card skimmers hide in online shops’ checkout code. A short list to make sure yours only runs what you expect.
- Security · 23 November 2021
GoDaddy’s WordPress breach: change those passwords
Data on up to 1.2 million Managed WordPress customers was exposed, including some passwords in plain text.
- Security · 10 August 2021
ProxyShell: the Exchange patches came months ago
Attackers are scanning for Exchange servers missing the April and May updates. If you’re behind, you’re a target now.
- Security · 27 July 2021
Pegasus: what normal phone users can do
The Pegasus investigation showed zero-click spyware on fully updated phones. Most people aren’t targets, but a few habits help.
- Security · 13 July 2021
Kaseya: when your IT provider’s tool is the way in
Ransomware spread to around 1,500 businesses through their IT providers’ remote management software.
- Security · 6 July 2021
PrintNightmare: switch off the Print Spooler
A Windows print spooler bug lets attackers run code as SYSTEM, even on domain controllers. Disable it where nothing prints.
- Security · 22 June 2021
RockYou2021: 8 billion leaked passwords in one file
A huge password list is circulating online. It’s mostly old leaks, which is exactly why unique passwords matter.
- Security · 15 June 2021
The password that shut down a pipeline
Colonial’s CEO says attackers used an old VPN account with no MFA. One leaked password was enough.
- Security · 25 May 2021
The US cyber executive order, for vendors
Biden’s order on cybersecurity sets new rules for software sold to the US government. Expect them to spread.
- Security · 22 April 2021
Pulse Secure zero-day: VPNs under attack again
A new Pulse Connect Secure bug is being exploited before a patch exists. Apply the workaround and check the integrity tool.
- Security · 30 March 2021
Turn off legacy authentication in Microsoft 365
Old mail protocols skip MFA, and password-spraying attacks love them. Most companies can block them in an afternoon.
- Security · 9 March 2021
ProxyLogon: patch Exchange, then look for web shells
Four Exchange zero-days are being mass-exploited. Patching closes the door but doesn’t remove anyone already inside.
- Security · 2 February 2021
Emotet is down. Its habits aren’t
Police took over Emotet’s servers last week. The tactics it made popular, like reply-chain phishing, will continue.
- Security · 12 January 2021
Ubiquiti says change your password. Do more
Ubiquiti asked customers to reset passwords after unauthorised access. Your router account deserves MFA too.
- Security · 5 January 2021
SolarWinds: when the update is the attack
Trojanised Orion updates reached thousands of networks. What to check if you run it, and what it means for everyone else.
- Security · 22 December 2020
A year of remote work: what to keep
2020 forced a huge experiment in working from anywhere. What worked for security, and what to fix in 2021.
- Security · 15 December 2020
Running SolarWinds Orion? Act today
Some Orion updates from this year contain a backdoor. US agencies were told to disconnect it. Here’s what to do.
- Security · 10 December 2020
FireEye was hacked, and its tools are out
A state-backed attacker stole FireEye’s red-team tools. FireEye published rules to detect them. Use them.
- Security · 24 November 2020
Holiday shopping: watch out for fake shops
With shops closed, everyone is buying online, and fake stores are everywhere. How to check before you pay.
- Security · 10 November 2020
Capcom: ransomware that steals before it encrypts
The games company was hit by ransomware, and the group says it took data too. Backups don’t solve the leak.
- Security · 27 October 2020
Browser zero-days: update, then restart
Chrome fixed a font-library bug already used in attacks. The update only works after the browser restarts.
- Security · 13 October 2020
Microsoft goes after TrickBot
Microsoft and partners used a court order to disrupt TrickBot’s servers. The malware will try to come back.
- Security · 15 September 2020
Zerologon: patch your domain controllers now
A bug in Netlogon lets anyone on the network become domain admin in seconds. The August patch fixes it.
- Security · 21 July 2020
The Twitter hack: social engineering and admin tools
Famous accounts tweeted a bitcoin scam after attackers fooled employees with access to internal tools.
- Security · 16 July 2020
SIGRed: patch your Windows DNS servers
A 17-year-old bug in Windows DNS Server is rated 10/10 and wormable. Domain controllers are usually DNS servers too.
- Security · 7 July 2020
F5 BIG-IP bug: patch and hide the admin page
A critical bug in the BIG-IP management interface is being exploited. It should never have been on the internet.
- Security · 12 May 2020
Thunderspy: physical access still matters
A researcher showed how a Thunderbolt port can unlock a laptop in minutes. Encryption and settings decide the damage.
- Security · 14 April 2020
Relief payment scams are everywhere
Governments are sending emergency money, and scammers are sending fake “claim your payment” messages.
- Security · 31 March 2020
Zoombombing: lock your meetings
Uninvited guests are crashing video calls, from classes to company meetings. A few settings stop most of it.
- Security · 17 March 2020
Everyone works from home now. A quick checklist
Offices are closing overnight. Here’s what to sort out first so remote work doesn’t become remote risk.
- Security · 12 March 2020
SMBGhost: patch Windows 10 file sharing today
A wormable bug in Windows 10’s SMBv3 compression leaked before a fix. Microsoft has now released the patch.
- Security · 11 February 2020
Phishing follows the news: coronavirus emails
Fake health warnings and “WHO” emails carrying malware are spreading as fast as the news. How to spot them.
- Security · 28 January 2020
Travelex: a month offline after ransomware
A currency exchange giant has been running on pen and paper since New Year’s Eve. Reports point to an unpatched VPN.
- Security · 21 January 2020
CurveBall: the Windows bug the NSA reported
A flaw in how Windows checks certificates could let fake software and websites look trusted. Patch it this week.
- Security · 14 January 2020
Citrix ADC bug: apply the mitigation tonight
Exploit code for the Citrix ADC and Gateway bug is public, and attacks have started. Patches are still days away.
- Security · 19 November 2019
Disney+ accounts sold within days of launch
Thousands of new Disney+ accounts appeared for sale. The likely cause: passwords reused from other leaks.
- Security · 5 November 2019
BlueKeep is now being exploited
The Remote Desktop bug from May is being used to install crypto miners. Unpatched machines are also crashing.
- Security · 22 October 2019
Avast: a forgotten VPN profile without MFA
Avast was breached through a temporary VPN profile that was left enabled and didn’t require two-factor authentication.
- Security · 10 September 2019
Hacked websites were infecting iPhones
Google Project Zero found sites that silently attacked every iPhone visitor for two years. Keep iOS updated.
- Security · 3 September 2019
SIM swapping: why SMS codes aren’t enough
Twitter’s CEO lost control of their account after the phone number was taken over. Move important accounts off SMS.
- Security · 27 August 2019
Your VPN is being scanned: Pulse and Fortinet
Attackers are scanning for Pulse Secure and Fortinet VPN bugs that leak passwords. The patches have been out for months.
- Security · 20 August 2019
22 Texas towns hit through one provider
A coordinated ransomware attack hit 22 local governments in Texas. Reports point to a shared IT provider.
- Security · 16 July 2019
Zoom’s hidden web server on Macs
A website could switch on your Mac’s camera through Zoom’s local web server. Apple removed it. Check what your apps install.
- Security · 25 June 2019
A Florida city paid 600,000 dollars in ransom
Riviera Beach voted to pay attackers after an employee opened an email. Paying is a decision best made before an attack.
- Security · 28 May 2019
Baltimore: three weeks without city systems
Ransomware stopped Baltimore’s email, payments and property sales. The city refused to pay, and is rebuilding.
- Security · 21 May 2019
BlueKeep: patch Remote Desktop, even on Windows XP
Microsoft says this Remote Desktop bug is wormable, and patched even Windows XP. Close RDP to the internet now.
- Security · 14 May 2019
WhatsApp: a missed call could install spyware
A WhatsApp bug let attackers install spyware just by calling, even if nobody answered. Update now.
- Security · 16 April 2019
Wipro: when your IT outsourcer is the way in
Attackers phished their way into one of India’s largest IT firms and used it to reach its clients.
- Security · 2 April 2019
ShadowHammer: ASUS’s updater shipped a backdoor
Attackers pushed a signed, trojanised ASUS Live Update to many PCs, targeting a few hundred. Update tools are prime targets.
- Security · 28 March 2019
Facebook kept passwords in plain text logs
Hundreds of millions of passwords were readable in internal logs. Logs need the same care as databases.
- Security · 26 March 2019
Norsk Hydro: how to handle ransomware in public
The aluminium maker switched to manual operations and gave daily updates. It shows how to respond with honesty.
- Security · 12 March 2019
Citrix was breached through password spraying
The FBI told Citrix attackers got in by trying common passwords against many accounts. Simple attack, simple defences.
- Security · 26 February 2019
WinRAR’s 19-year-old bug: update or uninstall
A flaw in WinRAR’s ACE support lets a crafted archive drop malware into your Startup folder. WinRAR doesn’t update itself.
- Security · 5 February 2019
QuadrigaCX: when only one person has the keys
A crypto exchange says it can’t reach most of its customers’ funds after its founder died. A lesson in key management.
- Security · 22 January 2019
Collection #1: 773 million emails and their passwords
A huge list of leaked emails and passwords is circulating. Check yours, and stop reusing passwords for good.
From the archive
Notes from my old blog on mohamedsharaf.net (2010–2018), rewritten and checked. Some are dated; the dates tell you how much.
- Security · 18 May 2017
How Russia faced the WannaCry ransomware that scared the world
From the archive (2017): Russia’s unusual answer to the ransomware that stopped companies around the world for days.
- Security · 21 June 2016
Is that phone genuine? Check its IMEI
Two quick checks before buying a phone: its IMEI and its warranty status with the manufacturer.
- Security · 11 January 2014
The 10 Immutable Laws of Security, still true
Microsoft’s famous list of security truths that no software update can fix, and why they still hold.
- Security · 25 January 2012
PHP security: the basics that still matter
XSS, SQL injection, CSRF, file uploads, includes and passwords: the short list every PHP developer needs.