https://cysec.sk/en/Analyses of security incidents and research with practical steps for companies.enhttps://cysec.sk/en/articles/daily-2026-10-15-microsoft-yam-store-phishing-ecosystem-disruption/https://cysec.sk/en/articles/daily-2026-10-15-microsoft-yam-store-phishing-ecosystem-disruption/Thu, 15 Oct 2026 08:00:00 GMTPeter GrajciarMicrosoft and partners disrupted infrastructure linked to YAM Store and the CoGUI and Iron Man phishing kits. The figures describe targeted messages, not confirmed successful attacks.https://cysec.sk/en/articles/daily-2026-10-14-windows-shell-mark-of-web-zero-day/https://cysec.sk/en/articles/daily-2026-10-14-windows-shell-mark-of-web-zero-day/Wed, 14 Oct 2026 08:00:00 GMTPeter GrajciarMicrosoft confirmed exploitation of a Windows Shell flaw that bypasses the Mark of the Web label. The October fix is available, and organizations should verify it reached affected devices.https://cysec.sk/en/articles/daily-2026-10-01-cisco-sdwan-manager-zero-day/https://cysec.sk/en/articles/daily-2026-10-01-cisco-sdwan-manager-zero-day/Thu, 01 Oct 2026 08:00:00 GMTPeter GrajciarA flaw in Catalyst SD-WAN Manager is being exploited. An unauthenticated attacker could gain administrator access.https://cysec.sk/en/articles/daily-2026-09-30-star-blizzard-redflick-phishing-campaigns/https://cysec.sk/en/articles/daily-2026-09-30-star-blizzard-redflick-phishing-campaigns/Wed, 30 Sep 2026 08:00:00 GMTPeter GrajciarMicrosoft has observed at least 13 larger Star Blizzard campaigns since January, with activity affecting more than 100 organizations. Its new RedFlick technique shortens the path from a message to malware, but these are targeted operations, not a mass attack on every business.https://cysec.sk/en/articles/daily-2026-09-29-netscaler-zero-days-exposed-instances/https://cysec.sk/en/articles/daily-2026-09-29-netscaler-zero-days-exposed-instances/Tue, 29 Sep 2026 08:00:00 GMTPeter GrajciarCitrix confirmed exploitation of two critical NetScaler ADC and Gateway flaws. The estimate of internet-exposed instances is not a victim count, but it gives companies a reason to check their own infrastructure now.https://cysec.sk/en/articles/daily-2026-09-27-sharepoint-cve-2026-65660-active-exploitation/https://cysec.sk/en/articles/daily-2026-09-27-sharepoint-cve-2026-65660-active-exploitation/Sun, 27 Sep 2026 08:00:00 GMTPeter GrajciarMicrosoft says it has reliable evidence that attackers are exploiting CVE-2026-65660 in on-premises SharePoint. A patch has been available since August; the risk concerns organizations running their own servers.https://cysec.sk/en/articles/czech-registry-personal-data-test-exposure/https://cysec.sk/en/articles/czech-registry-personal-data-test-exposure/Thu, 24 Sep 2026 08:00:00 GMTPeter GrajciarA test version of the Czech business register made national ID numbers and some non-public documents accessible. The ministry shut the test portal down, but is still investigating how many people may have been affected.https://cysec.sk/en/articles/trustsink-externe-mfa-krade-hesla/https://cysec.sk/en/articles/trustsink-externe-mfa-krade-hesla/Wed, 23 Sep 2026 08:00:00 GMTPeter GrajciarWhy businesses should review who can change their sign-in systems. The TrustSink research, its limits and three practical recommendations for administrators.https://cysec.sk/en/articles/daily-2026-09-23-eviltokens-posta-financne-podvody/https://cysec.sk/en/articles/daily-2026-09-23-eviltokens-posta-financne-podvody/Wed, 23 Sep 2026 08:00:00 GMTPeter GrajciarThe disruption of EvilTokens highlights the need to protect payment approvals. What Microsoft reported, and three practical steps for finance and IT.https://cysec.sk/en/articles/daily-2026-09-22-closedquorum-ai-rozhodovanie/https://cysec.sk/en/articles/daily-2026-09-22-closedquorum-ai-rozhodovanie/Tue, 22 Sep 2026 08:00:00 GMTPeter GrajciarNew research raises a practical preparedness question. Evidence and assumptions need to stay separate.https://cysec.sk/en/articles/partners-incident-inc-ransom/https://cysec.sk/en/articles/partners-incident-inc-ransom/Mon, 21 Sep 2026 08:00:00 GMTPeter GrajciarThe September INC Ransom listing needs to be read alongside the Partners group's August disclosures. The company confirms access to personal data; the attacker's identity remains unverified.https://cysec.sk/en/articles/security-priorities/https://cysec.sk/en/articles/security-priorities/Tue, 15 Sep 2026 08:00:00 GMTPeter GrajciarVulnerabilities and third parties in real incidents. How to use the 2026 DBIR findings when deciding your company’s security priorities.https://cysec.sk/en/articles/zero-trust/https://cysec.sk/en/articles/zero-trust/Wed, 09 Sep 2026 08:00:00 GMTPeter GrajciarPhishing does not need to steal a password or imitate Microsoft. In device-code phishing, a user authorizes an attacker-created session on a legitimate site. The case shows why organisations must govern sign-in flows, not only inspect domains.https://cysec.sk/en/articles/incident-first-hour/https://cysec.sk/en/articles/incident-first-hour/Thu, 03 Sep 2026 08:00:00 GMTPeter GrajciarThe M&S case shows why the first hour of an incident is not only an IT concern. Decisions about services, sales and communication need to be ready before pressure arrives.https://cysec.sk/en/articles/backup-recovery/https://cysec.sk/en/articles/backup-recovery/Thu, 27 Aug 2026 08:00:00 GMTPeter GrajciarRecovery after an incident does not end when systems come back online. The JLR case shows that a safe restart depends on logistics, suppliers, partners and business acceptance.https://cysec.sk/en/articles/cloud-responsibility/https://cysec.sk/en/articles/cloud-responsibility/Fri, 21 Aug 2026 08:00:00 GMTPeter GrajciarThe August 2025 Salesloft Drift incident showed that an integration application’s permissions form a security boundary. Cloudflare’s perspective provides a concrete example of OAuth access, support text, and a disciplined response.