Mailchimp
Not subscribed to OpsMatters Newsletter
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Latest posts
Autonomous Pentest Findings: Unauthenticated Kill Switch
Some of the most dangerous vulnerabilities in modern web apps are the default features left switched on where they were never meant to be reachable. The first entry in our Findings from the AP series looks at an exposed actuator endpoint. On paper, this finding started the same way most do: an HTTP endpoint returned a 200. Nothing about that response looks unusual by itself. It’s the kind of line that gets logged, categorized, and moved past in most automated scans.
Emerging Threat: (CVE-2026-67281) MikroTik RouterOS Unauthenticated File Read via WebFig
CVE-2026-67281 is an unauthenticated file read vulnerability in WebFig, the web-based management interface in MikroTik RouterOS. A newly allocated session on the /jsproxy path retains a stale, uninitialized principal pointer that WebFig then uses for file authorization decisions. The vulnerability carries a CVSS v4.0 base score of 8.7 (High). A CVSS v3.1 base score has not been assigned in the CVE record at the time of writing.
The Ultimate API Security Guide: Everything You Need to Know to Protect Your APIs
APIs power modern software. They connect apps, move data, and run agentic AI workflows. But every API is also a door into your systems. Attackers know this. They target APIs more than any other layer today. This guide breaks down API security from the ground up. You will learn what it means, why it matters, and how to protect your APIs against real-world threats. We cover risks, the OWASP API Security Top 10, best practices, tools, and use cases. Let’s get started.
Cyber Threat Intelligence for Insurance: The Supply Chain Risk Insurers Can't Ignore
A strong internal security score means little if the brokers, claims processors, and software vendors an insurer depends on are the weak link. This blog breaks down where insurance supply chain risk sits and what to do about it.
Twitter Brand Impersonation: How Security Teams Detect Fake Accounts and Phishing on X
Most brand impersonation starts in public. A lookalike support handle appears, replies to real customers under your official account, and links to a credential-harvesting page. By the time it reaches a takedown vendor's weekly report, the damage window has been open for hours.
How Enterprises Vet Vendors: A Digital Contact Card Case Study
Every large company works with dozens, sometimes hundreds, of outside vendors. From software providers to marketing agencies to hardware suppliers, enterprises depend on a wide network of partners to keep operations running smoothly. But before any vendor gets a seat at the table, they go through a process that can feel like a job interview crossed with a background check. This process is called vendor vetting, and it exists to protect the enterprise from risk, wasted money, and reputational damage.
How AI Phone Calling Is Changing Voice Phishing Defense
Phone scams have been around for decades, but the last few years have brought a sharp shift in how convincing they've become. Voice phishing, often called vishing, used to rely on generic scripts and a scammer's ability to sound believable. Today, the same technology that powers helpful tools like AI phone calling is also being studied and used to fight back against these scams.
Why Sales Commission Data Needs the Same Audit Trail as Any Other Financial Record
An unexpected data integrity question has crept into sales operations: can a company actually reconstruct how a commission payout was calculated months after the fact? For teams still running compensation through spreadsheets, the honest answer is usually no, and that blind spot carries real financial and compliance weight.
Top 4 enterprise risk management software solutions
Good enterprise risk management software gives you one place to record and score every risk, keeps that record current by watching your controls instead of waiting for a quarterly review, maps risks to the frameworks you report against, connects to the tools your teams already use, and turns all of it into dashboards your executives and board will read. The hard part is telling which products do those things well and which just store risks in a nicer grid. Below are the features that matter, a scorecard to weigh them, and four tools worth a look.
The Largest and Most Notorious Cyber Attacks in History
The most damaging cyber attacks in history rarely involved exotic techniques. A graduate student's experimental worm, a password with no second factor, and an unpatched file transfer tool each caused more damage than any advanced exploit on record. Reading four decades of these incidents in order shows how consistently intruders take the simplest available route, and how little that route has changed since 1988.