The US National Cybersecurity Strategy — Liability Is Coming
··983 words·5 mins
The Biden administration’s new cybersecurity strategy shifts liability toward software vendors, and developers need to pay attention.
- Osmond van Hemert — Senior Software Engineer & AI Product Builder/
- Blog Categories: AI, Security, Development & Infrastructure/
- Security Incidents, Vulnerabilities & Defense/
Security Incidents, Vulnerabilities & Defense
This category gathers posts where security is the main story: breaches, vulnerabilities, software supply-chain incidents, and the practical response to each. Use the articles below to examine how attacks work, what is known, and which defensive decisions follow from the evidence.
For incident timelines, visit Breaches & Zero Days. The Cybersecurity tag follows security themes across other categories too, including infrastructure and developer tooling.
ESXiArgs Ransomware — A Wake-Up Call for VMware Infrastructure
··902 words·5 mins
A massive ransomware campaign is exploiting a two-year-old VMware ESXi vulnerability, and the scale of unpatched systems is alarming.
CircleCI's Security Incident — Rotate Your Secrets Now
··969 words·5 mins
CircleCI discloses a security incident and urges all customers to immediately rotate secrets stored in the platform.
LastPass Breach Goes From Bad to Catastrophic — Vaults Exposed
··898 words·5 mins
LastPass reveals attackers obtained copies of customer vault data, turning an already serious breach into one of the worst password manager incidents in
One Year After Log4Shell — What Actually Changed for Us
··969 words·5 mins
A year after Log4Shell shook the software industry, we examine what’s improved in supply chain security — and what still keeps us up at night.
OpenSSL's Critical Vulnerability — Lessons From the Response
··908 words·5 mins
The OpenSSL 3.0.7 patch for CVE-2022-3602 and CVE-2022-3786 arrived this week — here’s what happened and what it teaches us about vulnerability response.
The Uber Breach — When MFA Isn't Enough to Stop Attackers
··968 words·5 mins
A teenager allegedly breached Uber’s internal systems through social engineering and MFA fatigue, exposing fundamental weaknesses in how we think about
Twilio's Phishing Breach — Why SMS-Based 2FA Is Losing Ground
··759 words·4 mins
Twilio’s breach through a sophisticated phishing attack targeting employees raises hard questions about SMS-based authentication and supply chain trust.
26 Million Requests Per Second — Cloudflare and the Mantis Botnet
··876 words·5 mins
Cloudflare mitigated the largest HTTPS DDoS attack ever recorded at 26 million requests per second.
Follina — The Zero-Day That Turns a Word Doc Into a Weapon
··921 words·5 mins
CVE-2022-30190, dubbed Follina, exploits Microsoft’s diagnostic tool through Office documents — no macros required.
Heroku's Security Breach — A Wake-Up Call for Platform Trust
··919 words·5 mins
Heroku’s OAuth token breach exposes the fragile trust chain in platform-as-a-service dependencies and what it means for developers.
Spring4Shell Is Here — Assessing the Real Risk of CVE-2022-22965
··1031 words·5 mins
A critical RCE vulnerability in Spring Framework has the internet in panic mode, but the actual risk profile is more nuanced than the Log4Shell comparisons