SSH hardening: 5 settings that close 95% of the vectors
Weak password + port 22 open = an invitation to brute force. Here are the exact sshd_config changes to lock down SSH on …
Information Security 144 posts
Information security in plain English: scams, hardening and privacy — plus retrogaming, games and geek culture.
DragonForce ransomware: the cartel that took down M&S and Co-op
DragonForce took down Marks & Spencer with a phone call to the helpdesk: it stole NTDS.dit and locked ESXi. A cartel …
MOVEit: 3 years on from the zero-day that exposed 93 million records
On 31 May 2023, CVE-2023-34362 in MOVEit Transfer became the largest supply chain attack by SQL injection in history, …
CISA leaked AWS GovCloud credentials on GitHub for 6 months
A CISA contractor published AWS GovCloud account credentials, SSH keys and plain-text passwords in a public repo — and …
Carnival Corporation: 6m customers leaked by ShinyHunters
Carnival Corporation had 6 million customers exposed after ShinyHunters tricked an employee through social engineering …
MFA Fatigue: the attack that turns your 2FA against you
Push bombing needs no zero-day — just the patience to spam notifications until you approve. How MFA fatigue works and …
CVE-2026-42897: Exchange OWA zero-day exploited with no patch
Opening an email in Exchange OWA can compromise your authenticated session. CVE-2026-42897 is active with no permanent …
GitHub hacked via a VS Code extension: the TeamPCP case
A corrupted VS Code extension was live for 18 minutes and cost GitHub 3,800 internal repositories. Here's how that …
YellowKey: the zero-day that bypasses BitLocker on Windows
CVE-2026-45585 grants access to BitLocker-protected drives with brief physical access. Here is how the attack works and …
PowerShell for auditing Windows security logs
Use Get-WinEvent in PowerShell to monitor critical Windows events: failed logins, new processes and brute force …