Security Advisories
Vendor advisories, CISA bulletins, and government cybersecurity guidance translated for working defenders.
4 articles
AdvisoryGuideStrategy
PCI DSS 4.0: What Changed and What to Do
PCI DSS 4.0 became mandatory in early 2024 with a long tail of "future-dated" requirements landing March 31, 2025. If you are still operating to 3.2.1, the gap is wider than it looks.
Threat BriefAdvisory
Supply Chain Attacks on npm and PyPI: What Changed in 2025
Typosquatting, dependency confusion, and the compensating controls we now recommend by default.
AdvisoryForensics
CISA Reports BRICKSTORM Used For Long-Term Access
Tactics used to maintain long-term implants in U.S. systems. And detection guidance you can apply this week.
AdvisoryThreat BriefIntelligence
The Oracle PeopleSoft Zero-Day: ShinyHunters and the HR Stack Problem
Oracle's out of band June 2026 advisory for CVE-2026-35273 confirmed what enterprise defenders had been seeing for days: ShinyHunters was exploiting PeopleSoft in the wild and the HR stack was the entry point.