Close Menu

Security

DEFENCE

Security

EDR, Zero Trust, MFA, patching, IR, what actually works against modern threats.

Defensive coverage for people who have to hold the line: the controls that actually move the needle, the vulnerabilities worth patching first, and the attacks they are meant to stop. Cornerstones include the state of endpoint defence, zero trust beyond the buzzword, phishing-resistant MFA and defending Active Directory.

Check your own exposure with the free website security check and the FortiBleed checker.

Start here

Latest security coverage

  • Best VirusTotal alternatives 2026 for threat hunters, ransomnews.com
    Best VirusTotal alternatives 2026: what threat hunters run
    The VirusTotal alternatives threat hunters run in 2026: MetaDefender, ANY.RUN, CAPE, Intezer and MalwareBazaar, compared by job, upload privacy and API.
  • SOAR vs SIEM 2026: SIEM decides what is happening, SOAR decides what to do about it
    SOAR vs SIEM 2026: tune before you automate
    SOAR vs SIEM in 2026: they were never alternatives. Gartner marked standalone SOAR obsolete, and the automation now ships inside your SIEM or XDR.
  • SIEM vs XDR 2026: which platform wins on detection speed, retention, audit reporting and custom analytics
    SIEM vs XDR 2026: retention is the deciding factor
    SIEM vs XDR in 2026: XDR wins on detection speed, SIEM wins on retention and audit. Which one you can drop comes down to your compliance obligations.
  • wp2shell pre-authentication RCE in WordPress core, CVE-2026-63030 chained with CVE-2026-60137, patched in WordPress 7.0.2, ransomnews.com
    wp2shell: pre-auth RCE in WordPress core (CVE-2026-63030)
    wp2shell chains a REST batch-route bypass and a SQL injection into pre-auth RCE on WordPress core. WordPress shipped forced auto-updates in 7.0.2, 6.9.5 and 6.8.6.
  • GodDamn ransomware blinds EDR with a Microsoft-signed driver, ransomnews.com
    GodDamn ransomware blinds EDR with a Microsoft-signed driver
    Symantec detailed GodDamn ransomware using PoisonX, a kernel driver with a valid Microsoft signature, to terminate EDR before it encrypts.
  • macOS.Gaslight: malware that prompt-injects your SOC, ransomnews.com
    macOS.Gaslight: malware that prompt-injects your SOC
    SentinelLABS found macOS.Gaslight, a DPRK-linked Rust backdoor that embeds 38 fake system messages to make AI malware-triage agents abort. It is the first implant built to attack the analyst’s LLM, not the sandbox.
  • 292 fake GitHub repos push a hash-dodging infostealer, ransomnews.com
    292 fake GitHub repos push a hash-dodging infostealer
    Arctic Wolf found 292+ fake GitHub repositories impersonating security and fintech brands to deliver a BoryptGrab-lineage infostealer, with payloads that rotate every 60 seconds.
  • July Patch Tuesday: 570 flaws, two zero-days exploited, ransomnews.com
    570 flaws, 2 exploited: July Patch Tuesday hits identity
    Microsoft’s July 2026 Patch Tuesday fixed a record 570 flaws and three zero-days, two already exploited in AD FS and SharePoint identity infrastructure.
  • The Gentlemen weaponised a Kontron driver to kill EDR, ransomnews.com
    The Gentlemen weaponised a Kontron driver to kill EDR
    The Gentlemen ransomware weaponised a zero-day in Kontron’s ktapi.sys driver to gain kernel access and kill EDR from Microsoft, ESET, Palo Alto, and SentinelOne, researchers found.
  • Neon poster of a cracked bleeding network firewall leaking passwords, title FortiBleed 75,000 firewalls, cracked admin passwords across 194 countries
    FortiBleed: 75,000 cracked Fortinet firewalls, no zero-day needed
    FortiBleed exposed cracked admin passwords for around 75,000 Fortinet firewalls across 194 countries, roughly half the internet-facing fleet. There is no new zero-day. It is config exports, weak hashing, and recycled credentials, packaged as a sales catalog.
  • Synthwave cover for the Registrų centras 2026 breach: 600,000 records exposed from two state registers, neon perspective grid, floating registry document and broken padlock
    Registrų centras breach: 600,000 records exposed
    Lithuania’s Centre of Registers (Registrų centras) disclosed a May 2026 breach exposing roughly 600,000 records. Attackers reused credentials of authorised institutions, queried from abroad. Alerts.bar data shows 117 stealer-log accounts tied to the agency and 60+ live infected staff endpoints across the wider Lithuanian institutional ecosystem.
  • RDP Attack Landscape 2026 — Ransomnews cover
    RDP attacks 2026: ransomware’s #1 entry vector
    Remote Desktop Protocol remains the single most-abused initial-access vector for ransomware operators in 2026. We break down the current attack patterns (credential stuffing, broker-sold access, BlueKeep-era CVE echoes, and weaponised RDS misconfigurations) and the controls that actually move the needle.
  • Editorial cover image with large ALERTS.BAR REVIEW typography over an alert-beacon and credential-cards illustration
    Alerts.bar review 2026: dark-web monitoring tested
    Alerts.bar is a continuously-updated dark-web monitoring and stealer-log intelligence platform. We’ve used it in production to power Ransomnews’s free Stealercheck tool. Here’s our independent review: features, pricing, real-world testing, and how it stacks up against HIBP, SpyCloud, Constella, and Hudson Rock.
  • Stylised official document and glowing countdown timer, dark editorial illustration
    SEC 4-day cyber rule: 2.5 years in, what CISOs learned
    A 2026 retrospective on Item 1.05 of Form 8-K, the SEC’s four-day cyber-incident disclosure rule. How filings have actually played out, what the enforcement signals look like, and the practical playbook the better-prepared CISOs now run.
  • Central control hub with thin connection lines radiating to many small building silhouettes, dark editorial illustration
    MSPs: ransomware’s #1 target of 2026 [Field Report]
    Managed service providers entered 2026 as the single highest-leverage target class in the ransomware economy. Why the channel is now the front line, which TTPs operators are running against MSPs specifically, and what the better-run shops have already changed.
  • Fragmented padlock with shadow figures dispersing in different directions, dark editorial illustration
    LockBit, 2 years after Operation Cronos: where are they now?
    A 2026 retrospective on the international takedown that displaced LockBit at the top of the ransomware ecosystem: what stuck, what reverted, where the affiliate workforce migrated, and what the next coordinated action should learn from the playbook.
  • Stylised cookie slipping past a glowing security barrier, dark editorial illustration
    MFA bypass via cookie theft: the #1 breach vector of 2026
    Through 2024 and 2025 a quiet rebalancing happened: password-phishing fell, session-cookie theft via infostealers surged, and “we have MFA” stopped meaning what defenders thought it meant. A 2026 field guide to the technique and the controls that actually answer it.
  • Stylised dashboard with bar charts and world-map silhouette, dark editorial illustration
    2026 ransomware victim toll: countries, sectors, operators
    A data-led snapshot of who’s actually being ransomed in 2026: which sectors are losing ground, which operators are pulling away from the pack, and which national-level patterns the leak-site economy reveals.
  • Opened archive box with abstract data cards spilling out, dark editorial illustration
    What’s inside an infostealer log? A 2026 walkthrough
    A 2026 walkthrough of the typical infostealer-log archive: what files it contains, what each one means, and how defenders parse them with Python and jq for downstream incident response.
  • Concentric defensive rings around a glowing core with server-rack outlines, dark editorial illustration
    Active Directory hardening 2026: Tier 0, DSRM, PRT theft
    A 2026 practitioner walkthrough of Active Directory hardening against the lateral-movement, credential-theft, and persistence techniques that modern ransomware operators rely on: Tier 0 isolation, DSRM rotation, PRT theft mitigation, and AD audit baselines.
  • Abstract emergency control console with phase indicators glowing in green, dark editorial illustration
    Ransomware IR runbook 2026: NIST 800-61 r3 + CISA templates
    A practitioner walkthrough of building a ransomware-specific incident response runbook in 2026, combining NIST SP 800-61 r3, CISA’s #StopRansomware playbook, and the lessons from named incidents on the Ransomtracker leak feed.
  • Network of nodes radiating from a central building outline, dark technical illustration
    Attack-surface mapping 2026: Shodan, Censys, FOFA, Nuclei
    A 2026 OSINT workflow for mapping the external attack surface of any organisation using only public data: internet-scan engines, certificate transparency, and authenticated vulnerability templates.
  • Stylised email envelope being scanned by a green beam, abstract data flow on dark background
    Detecting AI-generated phishing in 2026: a header-forensics, classifier, and DKIM workflow
    A 2026 workflow for telling AI-generated phishing apart from real correspondence, combining email-header forensics, public LLM-detection classifiers, and DKIM/SPF replay analysis.
  • A hardware security key being inserted into a laptop with account icons flowing toward it
    How to set up YubiKey on every account that matters: a 2026 step-by-step tutorial
    A practitioner’s step-by-step tutorial for hardware-key MFA in 2026. Which YubiKey to buy, how to enroll it on Google, Microsoft, GitHub, AWS, and your password manager, plus the recovery-key gotcha that locks people out.

Every security article

Every article we have published in this section, newest first.