All Posts

The defensive-security industry has a discipline it rarely practices on itself. Vendors audit their customers. Auditors audit the vendors. Compliance...

For decades the security industry has worked off a stable mental model. The endpoint was the workstation. The shell was the login session. The credentials...

If you ask the dictionaries, "86" came from 1930s soda-fountain slang — short-order cooks shouting it across the line because it rhymed with "nixed." If you...

The defensive-security industry runs on a quiet fiction. The fiction is that breach outcomes correlate with how much a customer spends — that the next...

Most threat intelligence vendors will tell you they catch attacks early. Almost none of them will publish a structured ledger that lets you grade them. We...

ReversingLabs disclosed today that the North Korean threat actor Famous Chollima — also tracked as Shifty Corsair, the same group behind the Contagious...

Cybersecurity researchers at Aikido Security, SafeDep, Socket, StepSecurity, and Wiz disclosed today that a new supply chain campaign codenamed "mini...

Lumen Black Lotus Labs and Microsoft Threat Intelligence disclosed yesterday that Russia's GRU APT 28 — Forest Blizzard, Fancy Bear — quietly compromised...

Hours after we published the threat weather report calling out patch-discipline as the defensive priority, Wiz Research dropped the technical breakdown of...

It's a CRITICAL day on the PreCog board. Five of eleven precursor signals are elevated. The dominant pattern is staging — anonymization layer being...

On March 12, 2026, the FBI issued advisory PSA260312. The subject: criminal actors and nation-state operators are systematically abusing residential proxy...

On March 20, 2026, the FBI, CISA, NSA, and allied agencies issued joint advisory PSA260320. The subject: Russia's SVR and FSB have developed a reliable...

193.24.123.42. PROSPERO OOO. Autonomous System 200593. Saint Petersburg, Russia. That single IP block is responsible for 83% of the active exploitation traffic we've observed against Ivanti Connect Secure, Policy Secure, and ZTA Gateways. Not 83% of all IVanti traffic. Eighty-three percent of the malicious exploitation attempts, concentrated in one Russian commercial hosting provider. CISA added CVE-2025-22457 and CVE-2025-0282 to the Known Exploited Vulnerabilities catalog.