TechLogHub Blog — Page 20 of 25
Insights, guides, and product strategy for builders and product teams.
FBI IC3 2025 report: record $20.9 billion in cybercrime losses, up 26%
The FBI's 2025 IC3 report logged 1,008,597 complaints and $20.88B in losses. Investment fraud led at $8.6B; BEC cost $3B. What matters for engineering teams.
Snowflake customer data stolen via tokens taken in a SaaS integrator breach
Tokens stolen from a breached SaaS integration provider were used against Snowflake and other cloud tenants. What happened and how to lock down integrations.
US agencies warn Iran-affiliated hackers are disrupting Rockwell PLCs
FBI, CISA, NSA and others warn Iran-affiliated actors are hitting internet-exposed CompactLogix and Micro850 PLCs. Ports to check, IOCs and mitigations.
Flowise CVE-2025-59528 (CVSS 10) RCE now exploited in the wild
VulnCheck saw the first in-the-wild exploitation of Flowise CVE-2025-59528, a CVSS 10 CustomMCP code-injection bug. Affected versions, fix and hardening steps.
APT28 hijacked SOHO router DNS to intercept Microsoft 365 logins
Microsoft says APT28 (Forest Blizzard) changed DNS on hacked SOHO routers to run AiTM attacks on Outlook web logins, hitting 200+ orgs. How to detect it.
Automated pentesting's 'PoC cliff': what it misses and how to fill the gaps
Why automated pentest tools find less with each run, what the 'PoC cliff' argument gets right, and how to combine pentesting, BAS and CI security tests.
Microsoft removes SaRA command-line tool from Windows; Get Help CLI replaces it
Windows updates from 10 March 2026 remove the SaRA command-line utility. Admin scripts calling SaRACmd must move to GetHelpCmd.exe. Here is how to migrate.
Infostealers and stolen session cookies: why basic breach monitoring falls short
Infostealer logs leak live session cookies that bypass MFA, which breach-list checks miss. How the attack works and how to harden sessions in apps you build.
FortiClient EMS zero-day CVE-2026-35616 exploited; hotfix out for 7.4.5 and 7.4.6
Fortinet hotfixed CVE-2026-35616, a pre-auth API bypass in FortiClient EMS 7.4.5-7.4.6 exploited as a zero-day. CISA set an April 9 deadline. What to check.
React2Shell exploited to steal secrets from 766 Next.js hosts in automated campaign
Cisco Talos found UAT-10608 using React2Shell (CVE-2025-55182) to auto-harvest DB creds, SSH keys, AWS and Stripe keys from 766 Next.js hosts. Check yours.
Axios npm hijack: fake Teams 'update' let North Korean hackers publish malware
Malicious axios 1.14.1 and 0.30.4 shipped a RAT via plain-crypto-js on 31 March 2026 after UNC1069 social-engineered the maintainer. How to check and recover.
Device code phishing jumps 37x in 2026 as EvilTokens and copycat kits spread
Push Security saw device code phishing pages rise 37.5x in 2026 as kits like EvilTokens hijack OAuth tokens and sidestep MFA. How to block and detect the flow.
LinkedIn probes for 6,000+ Chrome extensions: what BrowserGate found and how it works
A LinkedIn script checks for 6,236 Chrome extensions and collects device data. How extension probing works, LinkedIn's response, and how to limit it.
Hims & Hers support-ticket breach: Zendesk reached through a hijacked Okta SSO account
Hims & Hers says attackers read support tickets on its help desk on 4-7 February 2026. Reports tie it to a ShinyHunters Okta SSO campaign. What to fix.
Die Linke confirms Qilin ransomware attack: staff data at risk, member database safe
Germany's Die Linke says Qilin ransomware hit its HQ network on 26 March 2026, putting internal and staff data at risk. Its member database was not affected.
Multi-extortion ransomware explained: why backups alone no longer save you
Ransomware now pairs encryption with data theft and pressure on customers. What 2025-26 incidents show, and the controls engineering teams should prioritise.
Exchange Online access bug hits Outlook mobile and new Outlook for Mac for weeks
A Microsoft change adding a new virtual account broke Exchange Online access in Outlook mobile and new Outlook for Mac from 11 March 2026, and it recurred.
Engineer who locked out 254 servers in extortion plot pleads guilty, gets 32 months
Daniel Rhyne used scheduled tasks to lock his employer out of 254 servers and 3,284 PCs, demanding 20 BTC. He pleaded guilty and was sentenced to 32 months.
CERT-EU: Trivy supply-chain attack led to European Commission AWS breach
CERT-EU says an AWS key stolen via the poisoned Trivy scanner let TeamPCP breach the Commission's Europa hosting, hitting 42 internal and 29+ EU clients.
Fake 'leaked Claude Code' GitHub repos push Vidar stealer and GhostSocks proxy
After Claude Code's source leaked via an npm source map, fake GitHub repos offering it spread Vidar malware. How to keep .map files out of your packages.
Showing 20 of 485 articles