All articles
13 articles, newest first. Browse by topic or subscribe to the RSS feed.
-
Item 1.05 cyber 8-Ks in 2025-26: what 32 companies disclosed
Thirty-two companies reported a cyber incident under Item 1.05, the item for material ones, from January 2025 to October 2026. We read all 43 filings.
-
Conduent breach timeline, read from the 8-K and the notices
Conduent's breach rebuilt from its SEC filings, notice letters and state and federal breach lists: 84 days unseen, 268 days to the first letter, 62.2M people.
-
Stealer logs in the breach record: one address in five
Six stealer-log entries in the public breach catalogue, measured: 20.7% of addresses loaded in 2025-26, rows versus people, and why the flag is a floor.
-
The breach record in one spreadsheet: what 1,036 breaches show
The public breach catalogue holds 1,036 breaches and 17.8 billion loaded addresses. Grouped by year, data class and size, it says where defensive effort belongs.
-
Session tokens: what a stolen cookie can do, and what limits it
A stolen session cookie is a logged-in user. Why an idle timeout does not bound the thief, and what absolute timeouts, rotation and device binding change.
-
Ransomware kill chain mapped to the controls that interrupt each step
Eight stages of a ransomware intrusion mapped to MITRE ATT&CK v19.2 mitigations and CISA's guide, with a script that shows which stages your controls leave open.
-
SQL injection for people who write queries: mechanism, fix, test
How a string-built query lets input change the SQL, why parameterised queries end it, what OWASP and CWE-89 say, and a regression test you can run.
-
Password entropy, honestly computed, and what NIST 800-63B says
A calculator for the entropy of a password generator, the guess-time arithmetic at four rates, and why a chosen password cannot be scored.
-
Passkeys explained for people who run a login page
What a passkey is in WebAuthn terms, why origin binding makes it phishing-resistant, synced versus device-bound, and what changes on the server side.
-
MFA fatigue and push bombing: what it is and the settings that stop it
How repeated push prompts turn a stolen password into a login, what NIST, CISA and ATT&CK T1621 say, and the settings that end it.
-
How password hashing works: bcrypt, scrypt, Argon2, and the salt
What a verifier stores instead of your password, why bcrypt, scrypt and Argon2 are slow on purpose, and why the salt is not a secret.
-
Credential stuffing: how it works, how logs show it, how to slow it
Why reused passwords from old breaches become logins on your site, the shape the attack leaves in your auth logs, and the OWASP and ATT&CK controls that limit it.
-
Phishing that beats MFA: adversary-in-the-middle for defenders
How a relay phishing page captures a one-time code and the session that follows, what ATT&CK, CISA and NIST say, and the controls that hold against it.