Blog | DarkInvader

browse by category

Manchester Airports Cyber Attack: What the 8.7 Million Record Breach Teaches Every UK Business

Manchester Airports cyber attack: what was stolen, why WiFi and number plate data matters, and a 10-day plan to check your own exposure.

September 4, 2026

PaperCut NG Vulnerability Response: How to Find Every Exposed Print Server You Own

PaperCut NG vulnerability response beyond patching: fingerprint exposed print servers, check for compromise and prove it’s closed.

September 3, 2026

Digital ID Security Risks: The Attack Paths That Matter (A Practical Guide)

Digital ID security risks explained through the real attack paths: stolen sessions, spoofed portals and supplier gaps. See how to monitor and respond.

September 1, 2026

Third Party Breach Response: What To Do In The First 72 Hours (And How To Spot One Early)

Third party breach hitting your data? Get the early warning signals, a 72-hour UK response runbook and the contract fixes that stop a repeat.

August 31, 2026

CVE-2026-19490: The NetScaler Gateway Auth Bypass to Fix Before Exploitation Starts

CVE-2026-19490 is a critical authentication bypass vulnerability in NetScaler ADC and Gateway. It refers to an authentication flaw that could potentially become a major security threat if not addressed promptly.

August 28, 2026

Shadow IT Risks: 7 Exposures Attackers Find Before You Do

Shadow IT risks explained from the attacker’s view: 7 exposures, how each one is discovered from outside, and what to fix first. See how to find yours.

August 27, 2026

GitLab CVE-2026-19478: How a GraphQL Directive Became an Unauthenticated Delete Button for Public Projects

CVE-2026-19478 is a critical code injection vulnerability in GitLab. Rated 9.4, it permits unauthenticated deletion of public projects. GitLab has released patches for affected versions.

August 25, 2026

Metabase, Framework and n8n: The Anatomy of a Fourth-Party Data Breach

Explore the anatomy of a fourth-party data breach, examining the risks associated with Metabase, Framework, and n8n and how to mitigate them.

August 24, 2026

How a Forgotten VPN at a Wind Farm Reached Siemens PLCs at a Heat Plant

In the interconnected world of industrial operations, cyber threats can emerge unexpectedly. This post explores how a forgotten VPN at a wind farm compromised Siemens PLCs at a heat plant and the importance of robust cybersecurity strategies.

August 21, 2026

What an Agent-Discovered SharePoint Chain Tells Us About the Next Decade of Exploitation

In cybersecurity, anticipating future trends means understanding current discoveries. The agent-discovered SharePoint vulnerability chain illuminates how exploitation could evolve and how organisations can prepare.

August 20, 2026

Inside the vCenter Syslog Flaw Being Used to Backdoor Virtual Estates Worldwide

A comprehensive analysis of the vCenter Syslog Flaw, its potential impacts, and mitigation strategies.

August 18, 2026

Payroll Pirates: How AitM Phishing Beats MFA to Hunt Finance Mailboxes

An exploration of the "Payroll Pirates" AitM phishing campaign, highlighting its techniques and providing guidance for detection and defense.

August 17, 2026

4,400 Exposed Rockwell PLCs: The Water Utility Attacks Didn’t Need a Zero-Day

Forescout’s Vedere Labs identified 4,407 internet-exposed Rockwell Automation/Allen-Bradley PLCs in an August 2026 scan, including 22 in cities affected by coordinated attacks on US water utilities. Attackers achieved disruption without exploiting any vulnerability: they changed IP addresses and set passwords on controllers that were already publicly reachable.

August 14, 2026

Kemp LoadMaster CVE-2026-8037: Understanding the Exploit Before It Hit the KEV

CVE-2026-8037 is a critical (CVSS 9.6) unauthenticated command injection flaw in Progress Kemp LoadMaster, disclosed on 4 June 2026 and added to CISA’s KEV catalogue on 7 August 2026 after telemetry recorded 792 exploitation attempts from 65 IP addresses over 41 days. Attackers can execute arbitrary OS commands on unpatched appliances without credentials.

August 13, 2026

TeamCity CVE-2026-63077: CISA Confirms Active Exploitation of Critical CI/CD RCE

Explore the critical TeamCity CVE-2026-63077 vulnerability, actively exploited as confirmed by CISA. Learn about its implications, mitigation strategies, and how organisations can protect themselves.

August 11, 2026

Why 73% of Organizations Lack Incident Response Readiness: The Visibility and Coordination Gap

73% of organisations lack adequate incident response capabilities. This blog explores the gaps in visibility and coordination, offering solutions to enhance readiness and resilience.

August 10, 2026

Azure Cosmos DB CosmosEscape: How a Sandbox Escape Exposed Every Customer’s Databases

Exploration of Azure Cosmos DB critical vulnerability, CosmosEscape, highlighting the risks of shared infrastructure in cloud computing.

August 7, 2026

Minnesota Water Systems Under Attack: How External Asset Visibility Stops Critical Infrastructure Breaches

Explore how External Asset Visibility (EAV) is crucial in safeguarding Minnesota’s water systems from cyber attacks.

August 6, 2026

Cisco FMC Static Credentials Zero-Day Exploited in Live Attacks

Cisco FMC static credentials vulnerability CVE-2026-20316 actively exploited. Immediate patching needed by August 1 deadline. Exploit details and remediation steps.

August 4, 2026

WordPress wp2shell Critical RCE Chain Exploited in Mass Attacks: Immediate Patching Required

Discover the wp2shell vulnerability affecting millions of WordPress sites. Explore the critical Remote Code Execution (RCE) flaw and learn how to protect your site from mass attacks.

August 3, 2026

AWS Kiro Security Flaw: Prompt Injection Bypasses Safety Boundaries and Enables Silent Code Execution

Critical vulnerability discovered in AWS Kiro allowing silent code execution through prompt injection, posing risks to developers.

July 31, 2026

Cl0p Ransomware Exploits Internet-Exposed PTC Windchill & FlexPLM

Cl0p ransomware exploits vulnerabilities in PTC Windchill and FlexPLM, enabling unauthenticated RCE and data theft. Critical patching is essential.

July 30, 2026

Russian State-Backed Threat Actors Deploy Zero-Click Phishing Against Western Organisations: How to Detect and Defend

NCSC alerts to Russian state-backed LAUNDRY BEAR zero-click attacks on Zimbra email platforms. Learn detection signals and patching priorities for your organisation.

July 28, 2026

Cloud Misconfiguration and Exposed Services: The Quiet Attack Surface

Explore the hidden risks of cloud misconfiguration and exposed services, and learn strategies to protect your organisation.

July 27, 2026

Threat Intelligence, Unpacked