patch management
9 articles with this tag
DIVD breach (two Zammad zero-days): what leaked and what organizations running Zammad should do
On September 24, 2026, the Dutch nonprofit DIVD (Dutch Institute for Vulnerability Disclosure) publicly disclosed the breach. Its later case file describes exploitation of two previously unknown vulnerabilities in the Zammad help-desk software (CVE-2026-102489 and CVE-2026-102490). DIVD assessed that the post-intrusion activity was carried out by an AI agent that decided its own next steps. Volunteers' DIVD email addresses were confirmed taken, and their contact details may have been. Part of the information in the CSIRT ticketing system was extracted, which may include correspondence with IP addresses of vulnerable systems. CISA added both flaws to its KEV catalog on October 2. This site's take: self-hosted Zammad operators should work toward 7.2.2, as the developer recommended on October 15. For 6.5 users unable to migrate immediately, 6.5.5 is an emergency fix for CVE-2026-102489 and does not extend support. Organizations that corresponded with DIVD should speed up fixes for the issues reported to them and treat messages claiming to be DIVD with care.
Tsurugi Handa Hospital ransomware (2021) — an unpatched VPN CVE and backups encrypted along with production
The way in, per the expert committee's report, was an internet-facing VPN device left unpatched against a known vulnerability (CVE-2018-13379), reachable with leaked credentials. Short passwords, no account lockout, and users holding admin rights made it easy to spread to other machines in the hospital (lateral movement). Decisively, the primary system and its backup were on the same network and both were encrypted. A backup that isn't isolated and offline can't be relied on for recovery. EMR recovery took about two months. Defend by patching internet-facing VPNs fast, revoking leaked/reused credentials, and keeping isolated, offline, 3-2-1 backups.
Capcom Ransomware (2020) — Why an Old VPN Device Was the Way In, and the Double-Extortion Defense
The way in was an old backup VPN device that had been left running at a North American subsidiary after newer units replaced it. From there the network was breached, data was stolen, and then ransomware encrypted systems (double extortion). Up to ~390,000 people's personal data was potentially exposed (no payment-card data). Capcom refused to pay, restored from backup, and disclosed transparently. Defend by decommissioning unused gear, patching edge devices, and covering both theft and encryption (segmentation, detection, backups).
WordPress security — a production hardening reference
WordPress has the largest share, so it's the biggest target, but the ways in are predictable (plugin/theme vulnerabilities, skipped updates, weak admins, exposed admin panels). This is a working reference: (1) a priority-ordered hardening checklist (P0–P2), (2) per-area guidance — automatic updates, minimizing plugins/themes, strong admin + 2FA, reducing admin exposure (xmlrpc/REST enumeration/file editing), wp-config and secrets, file permissions, HTTPS/backups, PHP/dependency updates, and (3) a self-verification checklist. Defensive only — no attack steps.
What is malware? Types, infection routes, and the basic defenses
Malware (malicious software) is the umbrella term for software built to harm your devices or data. Viruses, worms, trojans, ransomware, spyware, and bots are all types under it. However different they look, the defense is the same three parts: prevent infection (updates, don't open suspicious attachments/macros, MFA), detect (EDR, antivirus), and be able to recover (backups). Getting these shared defenses right matters far more than memorizing the type names.
What is ransomware? How it works, how it gets in, and how to avoid paying
Ransomware is malware that encrypts your files and demands payment to get them back. Modern attacks add double extortion — they steal data first and threaten to leak it, so decryption alone doesn't stop the breach. Main entry routes: phishing, weak/no-MFA VPN/RDP, and unpatched internet-facing flaws. The single most important defense is offline/immutable backups plus restore tests — being able to recover without paying. Also prevent intrusion (MFA, patching) and limit the damage (least privilege, segmentation).
MOVEit mass breach (2023) — how a SQL injection zero-day reached 2,700+ orgs, and how to defend
The entry was a SQL injection zero-day (CVE-2023-34362) in the internet-facing MOVEit Transfer. A web shell (LEMURLOOT) was planted and data was bulk-stolen from the backing database, hitting 2,700+ orgs and ~93.3M people. Most victims were pulled in indirectly because a vendor used MOVEit. In your environment: KEV fast-patching, minimize exposure, web↔DB least privilege and segmentation, vendor inventory and data minimization.
Still on Windows 10? The security risks of running it after end of support
Regular support for Windows 10 Home/Pro-family 22H2 ended on October 14, 2025. Official guidance checked on October 16, 2026 lists consumer ESU through October 12, 2027, with automatic continuation for existing enrollees. Check enrollment and updates on the device, review regional conditions, and prioritize migration to an OS that receives updates. LTSC/IoT and commercial ESU are separate.
Equifax breach (2017) — how an unpatched Apache Struts flaw leaked 147M people
The cause was a known, already-patched CVE (CVSS 9.8) left unapplied on a public system. An expired monitoring certificate hid the exfiltration for 76 days. In your environment: asset inventory, a patch SLA, machine monitoring, and healthy detection.