NSA and CISA Sound the Alarm on Known Vulnerabilities
··977 words·5 mins
A joint NSA/CISA advisory details 25 CVEs actively exploited by Chinese state-sponsored actors. The uncomfortable truth: most are well-known and patchable.
- Osmond van Hemert — Senior Software Engineer & Applied AI/
- Blog Tags: Software Development, AI, Security & Infrastructure/
- Cybersecurity Across Software & Cloud/
Cybersecurity Across Software & Cloud
Cybersecurity is not confined to incident reports. This tag follows threats and defenses across software dependencies, cloud platforms, developer tooling, and operational practice. Browse the list below when you want the security angle on those topics, even when security is not the post’s primary category.
For articles organized primarily as security analysis, use the Security category. To follow a particular threat pattern, explore the Supply Chain Security series.
Zerologon — A 10-Out-of-10 Vulnerability That Should Terrify
··858 words·5 mins
CVE-2020-1472, dubbed Zerologon, scores a perfect 10.0 CVSS and allows full domain takeover with a handful of packets. Here’s what you need to know.
The Twitter Bitcoin Hack — A Social Engineering Masterclass
··1019 words·5 mins
The massive Twitter compromise that hit Barack Obama, Elon Musk, and Apple wasn’t a sophisticated zero-day — it was social engineering targeting internal tools.
The Pandemic IoT Boom — More Devices, More Risk, Old Problems
··1087 words·6 mins
Home IoT device sales have surged during lockdowns, and every one of those devices just joined a corporate network via VPN.
Your CI/CD Pipeline Is Now Your Biggest Attack Surface
··999 words·5 mins
As teams rushed to enable remote development workflows, CI/CD pipelines became a prime target.
Apple and Google's Exposure Notification API — Privacy at Scale
··1108 words·6 mins
Apple and Google collaborate on a Bluetooth-based exposure notification system that puts privacy-preserving architecture front and center.
Zoom's Security Reckoning — When Rapid Growth Exposes Debt
··997 words·5 mins
Zoom’s explosive pandemic-driven growth is exposing serious security and privacy issues. The ‘Zoombombing’ phenomenon is just the tip of the iceberg.
The Crypto AG Revelation — Your Encryption Vendor, the CIA
··1080 words·6 mins
The Washington Post reveals the CIA secretly owned Crypto AG for decades, selling compromised encryption to governments worldwide.
The NSA Found a Critical Windows Crypto Bug — That's Good News
··956 words·5 mins
The NSA disclosed CVE-2020-0601, a critical vulnerability in Windows CryptoAPI’s certificate validation.