Vulnerabilities
Secure Configuration Baselines for Small Businesses
Default settings prioritise functionality over security, leaving small organisations exposed to automated attacks that exploit known weak configurations.
Vulnerabilities
Vulnerabilities coverage from Cipher Insider holds 44 articles, 27 of them reference guides. The newest was published on October 16, 2026. New stories are added as soon as they are confirmed, from more than 150 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include MITRE CWE and CISA Known Exploited Vulnerabilities Catalog.
Vulnerabilities
Host Header Injection: Risks and Protection for Small Businesses
Attackers manipulate the HTTP Host header to bypass security controls, cache poison servers and steal session tokens without touching your application code.
Vulnerabilities
Remediation Tracking Mistakes That Leave Systems Exposed
Tracking vulnerabilities without verifying the underlying fix allows false negatives to persist, creating a false sense of security that attackers exploit through residual weaknesses.
Vulnerabilities
Detecting VPN Appliance Vulnerabilities: Signs, Tools and Blind Spots
VPN appliance vulnerabilities often manifest as subtle timing anomalies in encrypted tunnels rather than obvious authentication failures or port scans.
Vulnerabilities
Fortinet FortiGate Vulnerabilities: Risks and Protection for Small Businesses
Small organisations face disproportionate risk from FortiGate flaws because they rely on default configurations that expose management interfaces to the internet.
Vulnerabilities
How Vulnerability Chaining Works: The Multi-Step Attack Explained
Attackers rarely exploit a single flaw to breach a system; they combine weak points to bypass defences that would stop any individual vulnerability on its own.
Vulnerabilities
JWT Vulnerability Response: Containment and Recovery Steps
Revoking a compromised JWT signing key forces immediate session termination for all users, which is the only way to guarantee an attacker cannot forge new tokens.
Vulnerabilities
Apache Struts Vulnerabilities: Debunking 6 Common Security Myths
Misconfigurations and legacy plugin usage create wider attack surfaces than the core framework code, shifting risk away from simple patching.
Vulnerabilities
PyPI Package Vulnerability Myths: What Developers Get Wrong
Most PyPI package vulnerabilities stem from poor dependency management and hidden supply chain risks rather than direct code exploits in the libraries you import.
Vulnerabilities
Out-of-band security patches explained with clear examples
Emergency fixes bypass standard testing cycles to address immediate risks, creating a trade-off between speed and system stability.
Vulnerabilities
External Attack Surface Scanning: Correcting Common Misconceptions
External attack surface scanning reveals exposure to the internet, but it cannot verify internal misconfigurations or guarantee that a service is free from logic flaws.
Vulnerabilities
IoT Device Vulnerabilities: Definition, Causes and Mitigation Strategies
Many smart devices ship with hardcoded credentials that cannot be changed, turning everyday objects into permanent entry points for attackers.
Vulnerabilities
Vulnerability Scanning vs Penetration Testing: Which Security Assessment Fits Your Needs
Scans map known weaknesses at scale while penetration testing exploits chains to prove impact, making them complementary rather than competing security controls.
Vulnerabilities
Remote Code Execution Vulnerabilities: How They Work and How to Stop Them
Remote code execution flaws allow attackers to run commands on your server without any prior access, bypassing standard authentication entirely.
Vulnerabilities
XML External Entity Prevention Checklist for Secure Applications
Disabling external entity processing entirely is the only reliable defence against XXE, as parser configurations vary widely and default settings often remain permissive.
Vulnerabilities
Detecting VPN and ADC Vulnerabilities: Signals, Tools and Blind Spots
Most gateway breaches stem from misconfigured trust boundaries rather than broken encryption, leaving standard network monitors blind to lateral movement within the tunnel.
Vulnerabilities
Orgs Urged to Patch SonicWall SMA1000 as Wild SSRF Exploits Hit Critical CVE-2026-102255
Attackers are targeting a maximum-severity flaw in SonicWall SMA1000 appliances within days of the vendor releasing a security update.
Vulnerabilities
SAP S/4HANA flaw enables full system compromise via ABAP code execution
A critical vulnerability in SAP S/4HANA rule processing allows authenticated attackers with specific privileges to execute arbitrary ABAP code.
Vulnerabilities
Organisations face critical SAP NetWeaver risk as CVE-2026-89110 enables remote system compromise
A critical vulnerability in SAP NetWeaver Visual Composer allows attackers to invoke internal operations on connected systems, risking full compromise.
Vulnerabilities
SAP Python SDK OAuth2 Flaw Risks Credential Theft for Cloud App Developers
A critical vulnerability in the SAP Cloud SDK for Python allows attackers to hijack token requests and steal client credentials via server-side request forgery.
Vulnerabilities
Flock Security’s new CVE role raises trust questions for public safety agencies
The surveillance firm can now assign vulnerability IDs to its own cameras, sparking debate over transparency and conflict of interest.
Vulnerabilities
OTRS Bug Lets Attackers Keep Access for 16 Hours After Password Reset or Account Disable
A critical flaw in OTRS allows attackers to use stolen authentication tokens even after the associated user accounts are disabled or passwords are reset.
Vulnerabilities
Organisations Shift Security Liability to Vendors via Hosted Platforms in 2027
Hosted platforms absorb server hardening and update tasks, shifting security responsibility from the user to the vendor, according to a 2027 analysis.
Vulnerabilities
Organisations Urged to Patch Smart Casa v1.0.12 Amid Critical CVE-2026-93932 Deserialization Risk
A critical vulnerability in ThemeREX Smart Casa versions up to 1.0.12 allows attackers to inject objects via untrusted data deserialization.