SXIZA / ARTICLES
Analysis of real incidents and practical recommendations for identity, cloud and IT operations.
Microsoft and partners disrupted infrastructure linked to YAM Store and the CoGUI and Iron Man phishing kits. The figures describe targeted messages, not confirmed successful attacks.
Microsoft confirmed exploitation of a Windows Shell flaw that bypasses the Mark of the Web label. The October fix is available, and organizations should verify it reached affected devices.
A flaw in Catalyst SD-WAN Manager is being exploited. An unauthenticated attacker could gain administrator access.
Microsoft has observed at least 13 larger Star Blizzard campaigns since January, with activity affecting more than 100 organizations. Its new RedFlick technique shortens the path from a message to malware, but these are targeted operations, not a mass attack on every business.
Citrix confirmed exploitation of two critical NetScaler ADC and Gateway flaws. The estimate of internet-exposed instances is not a victim count, but it gives companies a reason to check their own infrastructure now.
Microsoft says it has reliable evidence that attackers are exploiting CVE-2026-65660 in on-premises SharePoint. A patch has been available since August; the risk concerns organizations running their own servers.
A test version of the Czech business register made national ID numbers and some non-public documents accessible. The ministry shut the test portal down, but is still investigating how many people may have been affected.
Why businesses should review who can change their sign-in systems. The TrustSink research, its limits and three practical recommendations for administrators.
The disruption of EvilTokens highlights the need to protect payment approvals. What Microsoft reported, and three practical steps for finance and IT.
New research raises a practical preparedness question. Evidence and assumptions need to stay separate.
The September INC Ransom listing needs to be read alongside the Partners group's August disclosures. The company confirms access to personal data; the attacker's identity remains unverified.
Vulnerabilities and third parties in real incidents. How to use the 2026 DBIR findings when deciding your company’s security priorities.
Phishing does not need to steal a password or imitate Microsoft. In device-code phishing, a user authorizes an attacker-created session on a legitimate site. The case shows why organisations must govern sign-in flows, not only inspect domains.
The M&S case shows why the first hour of an incident is not only an IT concern. Decisions about services, sales and communication need to be ready before pressure arrives.
Recovery after an incident does not end when systems come back online. The JLR case shows that a safe restart depends on logistics, suppliers, partners and business acceptance.
The August 2025 Salesloft Drift incident showed that an integration application’s permissions form a security boundary. Cloudflare’s perspective provides a concrete example of OAuth access, support text, and a disciplined response.