ESXiArgs Ransomware — A Wake-Up Call for VMware Infrastructure
··902 words·5 mins
A massive ransomware campaign is exploiting a two-year-old VMware ESXi vulnerability, and the scale of unpatched systems is alarming.
- Osmond van Hemert — Senior Software Engineer & Applied AI/
- Blog Tags: Software Development, AI, Security & Infrastructure/
- Cybersecurity Across Software & Cloud/
Cybersecurity Across Software & Cloud
Cybersecurity is not confined to incident reports. This tag follows threats and defenses across software dependencies, cloud platforms, developer tooling, and operational practice. Browse the list below when you want the security angle on those topics, even when security is not the post’s primary category.
For articles organized primarily as security analysis, use the Security category. To follow a particular threat pattern, explore the Supply Chain Security series.
CircleCI's Security Incident — Rotate Your Secrets Now
··969 words·5 mins
CircleCI discloses a security incident and urges all customers to immediately rotate secrets stored in the platform.
LastPass Breach Goes From Bad to Catastrophic — Vaults Exposed
··898 words·5 mins
LastPass reveals attackers obtained copies of customer vault data, turning an already serious breach into one of the worst password manager incidents in
One Year After Log4Shell — What Actually Changed for Us
··969 words·5 mins
A year after Log4Shell shook the software industry, we examine what’s improved in supply chain security — and what still keeps us up at night.
OpenSSL's Critical Vulnerability — Lessons From the Response
··908 words·5 mins
The OpenSSL 3.0.7 patch for CVE-2022-3602 and CVE-2022-3786 arrived this week — here’s what happened and what it teaches us about vulnerability response.
The Uber Breach — When MFA Isn't Enough to Stop Attackers
··968 words·5 mins
A teenager allegedly breached Uber’s internal systems through social engineering and MFA fatigue, exposing fundamental weaknesses in how we think about
Twilio's Phishing Breach — Why SMS-Based 2FA Is Losing Ground
··759 words·4 mins
Twilio’s breach through a sophisticated phishing attack targeting employees raises hard questions about SMS-based authentication and supply chain trust.
26 Million Requests Per Second — Cloudflare and the Mantis Botnet
··876 words·5 mins
Cloudflare mitigated the largest HTTPS DDoS attack ever recorded at 26 million requests per second.
Follina — The Zero-Day That Turns a Word Doc Into a Weapon
··921 words·5 mins
CVE-2022-30190, dubbed Follina, exploits Microsoft’s diagnostic tool through Office documents — no macros required.
Heroku's Security Breach — A Wake-Up Call for Platform Trust
··919 words·5 mins
Heroku’s OAuth token breach exposes the fragile trust chain in platform-as-a-service dependencies and what it means for developers.
Spring4Shell Is Here — Assessing the Real Risk of CVE-2022-22965
··1031 words·5 mins
A critical RCE vulnerability in Spring Framework has the internet in panic mode, but the actual risk profile is more nuanced than the Log4Shell comparisons
Lapsus$ Breaches Okta and Microsoft — An Identity Nightmare
··976 words·5 mins
The Lapsus$ hacking group has breached both Okta and Microsoft, exposing critical weaknesses in identity provider security and third-party access management.