Cybersecurity has an urgency problem. Brotli and PHP2Shell are real threats, but CVSS, KEV, exposure, and business impact answer different risk questions.
Emergency Brotli patches, a poisoned LiteLLM release, PHP2Shell exploitation, and AI-assisted attacks in South Korea—plus what defenders should do next.
Nearly 25 years ago, I mapped early Wi-Fi networks in Pennsylvania. More than 80% did not appear to be using WEP encryption—and WEP itself was already broken.
Two critical PHP flaws meet forgotten systems, a 16-year-old Broadcom Wi-Fi bug, AI agents attacking 1,200 sites for about $5,000, and certificate-authority keys that were practically guessable. This week’s lesson: understand the real-world risk behind the headline.
Microsoft's record Patch Tuesday, North Korean laptop farms in Texas, cryptocurrency hardware tampering, and an alleged listening device at OpenAI. Here's what caught my attention in cybersecurity this week.
Attackers remotely manipulated refrigeration systems at hundreds of French supermarkets, pushing temperatures as high as 50°C (122°F) and spoiling food. The incident is a stark reminder that critical management interfaces should never be exposed directly to the Internet.
Twenty-five years after September 11, 2001, I look back on the helplessness I felt watching the attacks unfold, and how ten days later I found a small way to help through my work in cybersecurity.
A fake $499.99 PayPal charge appeared on my son’s calendar exactly one year after I documented a similar attack. Here is how calendar invite phishing works, what it means, and what to do when one appears.
North Korean IT worker schemes are back in the spotlight with Season 2 of To Catch a Thief. But this isn't just a story about North Korea. It's a reminder that in an era of remote work and AI-generated identities, your next cyberattack could begin with a job application. Here's why hiring has become part of your security perimeter.
AI doesn’t need to be malicious to become dangerous. It only needs an objective. Here’s what the OpenAI and Hugging Face incident teaches us about the future of cybersecurity.
After nearly three decades in cybersecurity, hundreds of interviews, and building global security teams, here are the lessons I wish someone had shared when I was starting out.
A fake CAPTCHA on a trusted website tried to trick me into opening Terminal and executing a malicious command. That experience led to a deeper investigation into ClickFix, a rapidly growing social engineering technique that exploits trust instead of software vulnerabilities, and why attackers are increasingly impersonating security itself.
Enterprise security has spent decades answering two questions: Who are you? and What are you allowed to do? As AI agents become digital workers, identity and governance remain essential, but they may no longer be enough. This article explores the overlooked question that could define the next generation of AI security: What influences behavior?
Passwords remain one of the most common ways attackers gain access. Despite years of awareness, weak credentials, reuse, and exposure continue to drive breaches.
Earlier this month, Anthropic's Claude Mythos Preview AI model discovered 27-year-old bugs that survived decades of human review. The Cloud Security Alliance, SANS, and over 100 CISOs just published emergency guidance. Here's what vendors need to do now.
Running a vulnerability scan is easy. Treating every finding as urgent is not. This model helps teams prioritize real risk instead of chasing severity scores.
What came after a dramatic Louvre heist highlights the risks of leaving legacy technology untreated in your enterprise, and how to mitigate them before they make the news.
Step-by-step guide to changing your Venmo privacy settings, including how to make past transactions private and hide your public payment history. Updated for 2026.
National Internet Safety Month was born in 2005 to raise awareness around growing online risks. Nearly 20 years later, its message is more relevant than ever. Here’s how it started—and why it still matters.
Skip the cybersecurity overwhelm. This 10-minute weekend checklist covers the essential security tasks that actually matter—from software updates to MFA setup. No jargon, no scare tactics, just practical steps anyone can follow to lock down their digital life.
Think fake job applicants are just awkward interviews and padded resumes? Think again. One North Korean operative nearly infiltrated a U.S. crypto firm by pretending to be a software engineer named “Steven Smith.” This story, and the red flags it raised, is a must-read for anyone hiring online.
Passwords are still the leading cause of breaches, and most of us still treat them like an afterthought. This post breaks down where we’re going wrong, what’s finally getting better, and why passkeys might be our best shot at a password-free future.
Laptops are magnets for thieves, hackers, and nosy strangers on airplanes. This guide walks you through 10 smart ways to secure your laptop—physically, digitally, and privately—so your files stay safe, your data stays yours, and your webcam isn’t watching you back.
Quishing is phishing’s slicker, sneakier cousin. It hides behind QR codes, shows up on flyers and parking meters, and tricks you into handing over your credentials, often before your coffee kicks in. Here’s how it works, who it’s targeting, and how to stop it.
When I tried to lock down my smart thermostats, I discovered how hard it is to control what IoT devices connect to. Here’s what I learned—and why we need NetBOM.
Ransomware: Because Who Doesn’t Want to Be Held Hostage by Their Own Files?
Ransomware is no longer just a hacker’s side hustle—it’s big business. In this post, we break down what ransomware is, how it works, who it targets (on purpose and by accident), and what you can do to stay safe. Featuring real-world examples, including some very aggressive office printersmme.
Between The Hacks has updated its default domain name to betweenthehacks.com. Everything is still here, but a few links might need attention. Learn more about this update and let us know if you spot any issues.
Still using passwords? It might be time to move on.
Passkeys are a simpler, more secure way to log in—no typing, no phishing, no stress. In this post, I break down how passkeys work, why they matter, and how you can start using them today.
After years of preaching network segmentation, I took it to the next level—by physically disconnecting everything. Scissors, copper mesh, and a rotating SSID script. What could go wrong?
Most home devices can access the entire internet—and often each other. Segmentation helps, but without visibility into what your devices are doing, you’re still exposed.
