The Cyber Resilience Act ties EU market access to vulnerability reporting
Products with digital elements must be secure by design, and from September 2026 makers must report exploited flaws fast.
3 min read
Image: ferner-alsdorf.de ↗The archive / 100 sourced case files
Every incident.
A lesson worth keeping.
From the early internet to cloud identity and software supply chains. Explore the evidence, understand the uncertainty, and take a defensive lesson with you.
Vulnerability response / field note
A new flaw.
A clear response.
Connect an advisory to the systems you actually run. Scope exposure, coordinate containment and check the evidence before returning to service.
Open the response guide ↗Read the playbooks →100 historical case files
CISA replaced flat vulnerability deadlines with risk-tiered timelines
BOD 26-04 replaces 2021's two-week and six-month clocks with urgency based on exposure and exploitability.
3 min read
Image: cisa.gov ↗
Attackers turned two open-source security scanners into supply chains
In March 2026, attackers compromised the Trivy and KICS scanning tools that other teams trust to find vulnerabilities.
3 min read
Image: cyberdeutsch.news ↗
Stryker's own disclosures never confirmed the wiper outsiders reported
Stryker's SEC filings describe a March 2026 IT disruption but stop short of the wiper and attribution outside researchers reported.
3 min read
Image: i.ytimg.com ↗
Google closed its record $32 billion Wiz deal after a year of review
The largest pure cybersecurity acquisition closed in March 2026 after clearances from regulators on four continents.
3 min read
Image: thenewswire.in ↗
The 2026 cyber strategy dropped the 2023 push for software liability
The March 2026 strategy is far shorter than 2023's and, unlike it, does not call for shifting liability to software makers.
3 min read
Image: epic.es ↗
A 2026 OMB memo rescinded the federal software attestation mandate
OMB rescinded the Biden-era attestation mandate but left the underlying framework and agencies' oversight duty in place.
3 min read
Image: cdn.nextgov.com ↗
The SEC sued SolarWinds and its security chief, then dropped the case
SEC filings and a federal court's ruling trace the SolarWinds case from fraud charges to a 2025 dismissal with prejudice.
3 min read
Image: aitnews.com ↗
F5 disclosed a long intrusion into its own development systems
F5's SEC filing and CISA's emergency directive describe a nation-state actor's long-term access to F5's build environment and stolen source code.
3 min read
Image: cisa.gov ↗
A 2015 information-sharing law's liability shield briefly lapsed
The U.S. Code's own amendment history shows the 2015 information-sharing law's liability shield lapsed before Congress restored it.
3 min read
Image: saratogacountyny.gov ↗
A worm used stolen maintainer tokens to republish itself on npm
GitHub and CISA describe a worm that used stolen maintainer tokens to publish malicious versions of hundreds of npm packages.
3 min read
Image: github.blog ↗
A prolonged JLR shutdown led the UK to guarantee a commercial loan
JLR's own statements, the NCSC and a government loan guarantee trace a shutdown that outlasted several announced restart dates.
3 min read
Image: d9s1543upwp3n.cloudfront.net ↗
Stolen chatbot tokens turned a sales tool into a data pipeline
Google, Cloudflare and PagerDuty records show how stolen Drift OAuth tokens let an actor query Salesforce data across many companies.
3 min read
Image: miro.medium.com ↗
NIST's 2025 identity guidance drew a line around syncable passkeys
Revision 4 requires phishing-resistant authentication at higher assurance levels and bars synced keys from the top tier.
3 min read
Image: pages.nist.gov ↗
A patched SharePoint flaw was bypassed before every version got a fix
Microsoft and CISA documents describe a SharePoint patch bypass exploited before fixes existed for every on-premises version.
3 min read
Image: Microsoft Threat Intelligence ↗
The 2025 cybersecurity order dropped attestation and identity duties
The Federal Register text of Executive Order 14306 shows exactly which 2025 cybersecurity duties were struck and which were kept.
3 min read
Image: bidenwhitehouse.archives.gov ↗
A second Operation Endgame sweep seized hundreds of servers
Operation Endgame's own record and a DOJ indictment describe a second coordinated strike on loader services, and a third five months later.
3 min read
Image: justice.gov ↗
A help desk call became the way into three UK retailers in 2025
M&S, NCSC and NCA records describe a help-desk social-engineering wave across three retailers and the case for fast containment.
3 min read
Image: ncsc.gov.uk ↗
NIST rewrote incident response guidance around the Cybersecurity Framework
SP 800-61 Revision 3 replaces a 2012 standalone guide with recommendations mapped to the Framework's six functions.
3 min read
Image: nist.gov ↗
The FBI's 2024 cybercrime total counts complaints, not incidents
IC3 recorded 859,532 complaints and 16.6 billion dollars in reported losses, a floor the report itself flags as low.
3 min read
Image: fbi.gov ↗
DHS disbanded the Cyber Safety Review Board mid-review in 2025
A January 2025 memo ended the board's memberships while its Salt Typhoon review was still open, reporting says.
3 min read
Image: thecyberpost.com ↗
DORA made financial firms directly responsible for ICT risk
The EU regulation applied from January 2025, requiring incident reporting, resilience testing and oversight of critical ICT providers.
3 min read
Image: snabfinance.com ↗
The EU's NIS2 directive widened cyber duties and made managers liable
The directive expanded mandatory security duties to far more sectors, and enforcement began with member states, not companies.
3 min read
Image: pablosec.com ↗
Three NIST standards turned post-quantum cryptography into a migration
FIPS 203, 204 and 205 give organizations concrete algorithms to plan a cryptographic migration around.
3 min read
Image: nist.gov ↗
A CrowdStrike content update crashed machines without any attacker
The vendor's own root-cause analysis traces the July 2024 outage to a validation bug, not an intrusion.
3 min read
Image: crowdstrike.com ↗
A pathology supplier's ransomware outage postponed NHS procedures
Synnovis and the ICO describe how a lab supplier's outage delayed care and strained London's blood supply.
3 min read
Image: medtechnews.uk ↗
Old infostealer logins opened Snowflake accounts that lacked MFA
Mandiant's investigation and Live Nation's own filing trace the 2024 campaign to credentials, not a platform breach.
3 min read
Image: Mandiant / Google Cloud ↗
A slow SSH login exposed a years-long backdoor in xz Utils
A Microsoft engineer's investigation of a performance anomaly uncovered CVE-2024-3094 before it reached stable Linux.
3 min read
Image: Greenlight ↗
CSF 2.0 added a Govern function and widened who it is for
NIST's framework document explains what changed in 2024 and what the CSF still does not do.
3 min read
Image: nist.gov ↗
A Citrix portal without MFA halted claims across US health care
UnitedHealth's Senate testimony traces the Change Healthcare breach to one login without multi-factor authentication.
3 min read
Image: dehayf5mhw1h7.cloudfront.net ↗
Operation Cronos seized LockBit's infrastructure and named a leader
The NCA-led takedown captured LockBit's platform and keys, and Treasury later sanctioned its alleged administrator.
3 min read
Image: nationalcrimeagency.gov.uk ↗
Agencies said a state actor pre-positioned inside US utilities
A joint advisory assesses with high confidence that Volt Typhoon used built-in tools to sit inside critical infrastructure.
3 min read
Image: cisa.gov ↗
An FBI takedown slowed ALPHV but did not end its affiliate model
A CISA advisory and later reporting show the 2023 disruption degraded BlackCat without stopping ransomware as a service.
3 min read
Image: cisa.gov ↗
Microsoft answered nation-state intrusions with an engineering pledge
The Secure Future Initiative commits Microsoft to specific security goals, most of them still to be independently verified.
3 min read
Image: tecniverse.com ↗
A stolen Okta support credential exposed customers' session files
A compromised service account in Okta's support system let an attacker reach files customers uploaded for troubleshooting.
3 min read
Image: nhub.news ↗
A NetScaler flaw let stolen sessions outlive a security patch
CVE-2023-4966 exposed valid NetScaler session cookies, and patching alone did not revoke ones already stolen.
3 min read
Image: cdnglobal.secnews.gr ↗
Reused passwords let one credential-stuffing attack reach millions
23andMe's DNA Relatives feature meant a small share of compromised accounts exposed data on many more relatives.
3 min read
Image: blogger.googleusercontent.com ↗
Two casinos took different paths after help-desk social engineering
Caesars and MGM both disclosed 2023 breaches tied to IT help-desk deception, with different filings and outcomes.
3 min read
Image: casino.org ↗
A federal review found SMS and voice MFA failed against Lapsus$
The Cyber Safety Review Board's Lapsus$ report found SMS and voice MFA broadly insufficient and urged phishing-resistant sign-in.
3 min read
Image: microsoft.com ↗
Public companies must now disclose material breaches within days
An SEC rule adopted in 2023 requires an 8-K within four business days of determining a cyber incident is material.
3 min read
Image: img.decrypt.co ↗
Forged Microsoft tokens gave a hacking group access to government email
A signing key mishandled since 2021 let Storm-0558 forge tokens and reach government mailboxes, a review board found.
3 min read
Image: dhs.gov ↗
One file-transfer flaw let attackers steal data at thousands of firms
A SQL injection in MOVEit Transfer let one group steal data from victims for months after the patch.
3 min read
Image: cisa.gov ↗
Agencies asked software makers to ship security on by default
CISA's Secure by Design guidance and pledge ask vendors to own customer security outcomes, with progress self-reported.
3 min read
Image: cisa.gov ↗
A 2023 strategy proposed shifting cyber liability onto software makers
The Biden administration's National Cybersecurity Strategy sought to rebalance responsibility toward the most capable defenders.
3 min read
Image: mayerbrown.com ↗
LastPass's encrypted vault backups were stolen for offline attack
LastPass's own notices describe how a stolen backup put encrypted vaults beyond the company's ability to protect them further.
3 min read
Image: informationage-production.s3.amazonaws.com ↗
OpenSSL downgraded a pre-announced critical flaw on release day
OpenSSL's own advisory explains why testing moved two certificate-parsing bugs from Critical to High before release.
3 min read
Image: img.helpnetsecurity.com ↗
A federal jury convicted Uber's ex-security chief over a hidden breach
DOJ and FTC records show Joseph Sullivan concealed a 2016 Uber breach from the regulator investigating an earlier one.
3 min read
Image: ftc.gov ↗
A contractor's fatigue let one attacker into Uber's internal tools
Uber's security update describes repeated MFA push prompts wearing down a contractor until one login was approved.
3 min read
Image: blogger.googleusercontent.com ↗
DOJ said good-faith security research should not be charged
A 2022 policy directs prosecutors to decline CFAA charges against good-faith security researchers, with conditions attached.
3 min read
Image: justice.gov ↗
A ransomware group's leaked chats followed its public stand on the war
CISA's Conti advisory and a $15 million reward describe a ransomware operation that kept working after its internal chats went public.
3 min read
Image: image.theregister.com ↗
Apple, Google and Microsoft committed to passkeys on the same day
A joint 2022 announcement describes what a passkey is meant to replace and what it does not address on its own.
3 min read
Image: storage.googleapis.com ↗
A 2022 law created reporting duties still waiting on a final rule
CIRCIA set 72-hour incident and 24-hour ransom-payment reporting deadlines that do not take effect until CISA finalizes its rule.
3 min read
Image: cisa.gov ↗
Viasat's satellite modems were disabled an hour before an invasion
Viasat and the UK government describe a management-network intrusion that disabled modems across Ukraine and Europe.
3 min read
Image: viasat.com ↗
A ubiquitous logging library accepted attacker-controlled lookups
Log4j's fix arrived within days of disclosure; finding every place the library was embedded took much longer.
3 min read
Image: Greenlight ↗
A directive replaced severity scores with evidence of exploitation
BOD 22-01 requires federal agencies to patch by confirmed exploitation, not by CVSS score alone.
3 min read
Image: reg4tech.com ↗
OWASP's 2021 list put broken access control at the top of web risks
The ranking comes from contributed test data and a survey, and 94 percent of tested applications showed the flaw.
3 min read
Image: miro.medium.com ↗
The government defined what a software parts list must contain
NTIA's minimum elements gave buyers and vendors a shared baseline for what a software bill of materials should include.
3 min read
Image: cisa.gov ↗
A holiday-weekend update pushed ransomware through Kaseya's customers
A compromised remote-monitoring tool let attackers reach managed service providers and, through them, their customers.
3 min read
Image: australiancybersecuritymagazine.com.au ↗
JBS paid its ransom after most plants were already running
JBS said it paid $11 million to prevent risk to customers, after restoring the bulk of its plants from its own defences.
3 min read
Image: images.wsj.net ↗
CIS Controls v8 organised safeguards by implementation group, not device
CIS's 2021 rewrite grouped 153 safeguards into three implementation groups so smaller teams have a defined starting point.
3 min read
Image: jamestsaitwstorage.blob.core.windows.net ↗
A ransomware attack cost Ireland's health service its whole network
Conti ransomware forced a nationwide HSE shutdown; a related intrusion next door was caught and stopped in time.
3 min read
Image: preprod.admin.dr-imago.eu ↗An executive order followed the pipeline attack by five days
Executive Order 14028 set federal deadlines for zero trust, a software parts list and a standing incident review board.
3 min read
Colonial Pipeline shut itself down before ransomware reached the pumps
A precautionary IT shutdown halted East Coast fuel distribution after DarkSide ransomware hit the company's corporate network.
3 min read
Image: tsa.gov ↗
A modified upload script quietly copied secrets from CI pipelines
Codecov's Bash Uploader was altered for two months to exfiltrate environment data from customers' build pipelines.
3 min read
Image: canada1.discourse-cdn.com ↗
Unpatched Exchange servers fell within days of a March 2021 fix
An emergency directive followed mass web-shell exploitation of on-premises Exchange flaws Microsoft patched on 2 March 2021.
3 min read
Image: microsoft.com ↗
A backdoored SolarWinds update reached thousands of networks at once
CISA's emergency directive, SolarWinds' SEC filing and Microsoft's investigation describe how a compromised build system spread.
3 min read
Image: Greenlight ↗
FireEye disclosed the theft of its own attack-simulation tools
FireEye told the SEC a sophisticated actor took its red team tools and it built 300 countermeasures before any misuse was seen.
3 min read
Image: investors.com ↗
Treasury warned that paying some ransomware gangs could break sanctions law
OFAC's advisory says facilitating a ransomware payment can violate sanctions on a strict-liability basis, even without knowledge of the recipient.
3 min read
Image: infocrypto.fr ↗
A hospital chain's ransomware outage became a securities disclosure test
UHS told investors it suspended IT access after a September 2020 incident, then said a month later it still could not quantify the cost.
3 min read
Image: substackcdn.com ↗
Zerologon let an unauthenticated attacker on the network seize a domain
CISA ordered federal domain controllers patched within days after a Netlogon flaw let an unauthenticated attacker seize admin rights.
3 min read
Image: img2022.cnblogs.com ↗
NIST defined zero trust in seven tenets, not a single product
Special Publication 800-207 sets seven zero trust tenets and frames the shift as architectural, not a product purchase.
3 min read
Image: linux-abos.com ↗
Phone calls to Twitter staff reached tools that could take over any account
New York's financial regulator found vishing calls reached internal tools that more than 1,000 employees could use.
3 min read
Image: etimg.etb2bimg.com ↗
A Citrix gateway flaw sat unpatched for a month while attacks began
CISA recorded active exploitation of CVE-2019-19781 from January 2020, before permanent fixes existed for every affected version.
3 min read
Image: myce.wiki ↗
A misconfigured firewall exposed 100 million Capital One records
DOJ and OCC records describe a web application firewall flaw and an over-broad cloud role, and the bank's shared-responsibility failure.
3 min read
Image: occ.gov ↗
Norsk Hydro chose transparency and manual operations over ransom
The company's own updates from March 2019 recorded a ransomware attack, manual plant operations, and a refusal to pay.
3 min read
Image: Norsk Hydro ↗
MITRE's ATT&CK evaluations publish results without vendor scores
Since 2018, the paid, opt-in programme has released raw detection data rather than rankings, by design.
3 min read
Image: miro.medium.com ↗
GDPR gave data breach notification a 72-hour clock in 2018
The regulation's text and UK regulatory guidance show how a legal breach-notification deadline actually works.
3 min read
Image: oneplacesolutions.com ↗
Yahoo waited two years to tell investors about its 2014 breach
An SEC settlement records how a known breach stayed off Yahoo's disclosures until a corporate sale was closing.
3 min read
Image: myinformernews.com ↗
Meltdown and Spectre showed processors leaking memory across bounds
Researcher and vendor disclosures explain why fixing a hardware design flaw meant trading away performance.
3 min read
Image: cdnglobal.secnews.gr ↗
Equifax left a known web-framework flaw unpatched for months
A federal audit and an FTC settlement trace the 2017 breach to a missed patch notice and an expired certificate.
3 min read
Image: Greenlight ↗
NotPetya spread through a tax-software update and became a wiper
Governments record how a Ukrainian accounting update carried a destructive wiper across the globe.
3 min read
Image: Greenlight ↗
Federal guidance dropped forced password changes and complexity rules
NIST's 2017 authentication guideline asked for breach screening instead of periodic changes, and practice lagged for years.
3 min read
Image: pages.nist.gov ↗
WannaCry spread through a patched flaw the NHS had not applied
The National Audit Office found unpatched systems and unclear response roles let the ransomware disrupt care at 81 NHS trusts.
3 min read
Image: Greenlight ↗
Microsoft patched the SMB flaw two months before WannaCry hit
Microsoft's own bulletin and blog posts show the fix, the leak, and the warning all preceded the WannaCry worm.
3 min read
Image: learn.microsoft.com ↗
Default passwords on IoT devices built a record-setting botnet
A CISA alert and an academic measurement study traced Mirai's spread to just 62 factory-default username and password combinations.
3 min read
Image: api.moneyoval.com ↗
No More Ransom gave victims a free alternative before paying
Police and vendors launched a joint decryptor catalogue in July 2016 that has grown well beyond its first four tools.
3 min read
Image: ismg-cdn.nyc3.cdn.digitaloceanspaces.com ↗
Ukraine's 2015 grid attack was stopped by switching to manual control
A joint SANS and E-ISAC analysis found operators restored power within hours, and it deliberately declined to assign attribution.
3 min read
Image: m.antikor.ua ↗
OPM's breach exposed background-investigation records for millions
A House Oversight investigation called the breach preventable and found the agency had ignored years of inspector-general warnings.
3 min read
Image: oversight.house.gov ↗
MITRE ATT&CK turned observed adversary behavior into shared terms
MITRE's own site and design paper explain what ATT&CK is built from and what mapped coverage does not prove.
3 min read
Image: cdn.prod.website-files.com ↗
The Sony Pictures attack paired data leaks with disk-wiping malware
A CISA alert and a Treasury sanctions notice together record the malware's mechanics and the US attribution to North Korea.
3 min read
Image: home.treasury.gov ↗
A decades-old Bash flaw called Shellshock reached the web via CGI
Vendor and coordination-center advisories show why the first Shellshock patch needed four follow-up fixes.
3 min read
Image: securityaffairs.com ↗
Heartbleed forced the web to assume its encryption keys were exposed
OpenSSL's April 2014 advisory disclosed a memory-read flaw that had been live in the library for over two years before anyone found it.
3 min read
Image: Greenlight ↗
A vendor's stolen credentials opened Target's payment network
A Senate committee's kill-chain analysis found Target missed its own intrusion-detection alerts at several stages of the 2013 breach.
3 min read
Image: blogger.googleusercontent.com ↗
Stuxnet altered industrial controllers while reporting normal operation
Symantec's technical dossier, corroborated by two CISA advisories, described malware that hid its changes to programmable controllers from operators.
3 min read
Image: Greenlight ↗
Conficker outlived its patch and forced a coordinated industry defense
A worm that kept spreading years after Microsoft's fix pushed security vendors, registries and ICANN into an unprecedented joint response.
3 min read
Image: learn.microsoft.com ↗
A 376-byte worm reached most vulnerable hosts within ten minutes
CAIDA's measurement of the Sapphire/Slammer worm showed how a patch released six months earlier still left networks exposed.
3 min read
Image: photo-baomoi.bmcdn.me ↗
The 1988 internet worm exposed a missing security focal point
A GAO review of the Morris worm found no one owned Internet-wide security, and a 1991 appeals ruling tested a new computer-crime law.
3 min read
Image: Greenlight ↗
IBM's breach cost figure is a vendor estimate, not an audited total
The widely cited average blends breach sizes and sectors, so it should not be read as a per-record multiplier.
3 min read
Image: ibm.com ↗
Verizon's 2026 breach report found more third parties involved
A contributed dataset showed third-party involvement in 48 percent of breaches, a figure with its own definitions and limits.
3 min read
Image: ui.prt.news ↗
Ransomware payment data disagrees because it measures different things
Coveware's payment rate keeps falling while Chainalysis's tracked total rose, and neither figure is a full ransomware count.
3 min read
Image: bleepstatic.com ↗No case files match.
Try a broader search or clear the filters. Saved items stay in this browser.
Historical accounts include incidents, standards and policy. Event dates and source dates remain distinct. Read our method ↗