Topic tag

IT-pro

26 articles tagged IT-pro. Browse the full archive or jump to all posts.

October 18, 2026 · 16 min read

The Breach Notice Arrived: What You Owe, What You're Owed

A data breach notification is a legal event, not an apology email. The 30-day NDB clock, what the Optus and Medibank class actions offer, and the seven-day checklist.

October 17, 2026 · 14 min read

An AI agent deleted an entire TV season and the restore failed

Swedish broadcaster TV4 lost a finished TV season and the backup did not save it. The AI agent claim is disputed - the permissions lesson is not.

October 17, 2026 · 19 min read

French Supermarket Fridges at 50C: Auditing the Gear Nobody Can Patch

Attackers forced defrost cycles at 250-350 French supermarkets, hitting EOL Danfoss controllers nobody could patch. Here is the audit that finds yours.

October 17, 2026 · 8 min read

Namecheap disabled every domain this customer owned after one email and 72 hours

A registrar suspended a customer's entire domain portfolio after one email and a 72-hour notice. Your domains are the one asset you cannot rebuild from backup - here is the blast-radius fix.

October 15, 2026 · 9 min read

The OpenAI Boardroom Bug Is a SIEM Story (the rules that would have caught it)

An OpenAI engineer allegedly hid a recorder in an executive conference room TV. The physical bug took a countermeasures sweep to find. The recon that built it ran through logs most security teams already own.

October 11, 2026 · 15 min read

CVE-2026-21589: Atlassian's Pre-Auth File Read and What It Would Have Seen

Atlassian patched a pre-auth file read in eight self-hosted products on 5 October. Here is how to tell if you are exposed, and what to hunt for.

October 11, 2026 · 15 min read

364 Parked Domains Got DMARC Records. 79 of Them Were Being Spoofed.

SH Consulting DMARC'd 364 parked domains owned by a top US real estate team. 79 came back with spoofed mail. Here is the afternoon it takes to check your own.

October 11, 2026 · 14 min read

Let's Encrypt Goes 64-Day on 10 February: Grep for 83, 80 and 60 Before It Bites

Let's Encrypt moves every subscriber to 64-day certificates on 10 February 2027. The fix is one grep for renewal offsets your cron still assumes.

October 4, 2026 · 7 min read

Autonomous AI Agents Tried Government Websites. Your Web App Is in the Pool

Autonomous AI agents tried to hack US and Canadian government websites, BleepingComputer reports. Cheaper probing puts your web app in the same pool.

October 4, 2026 · 9 min read

FortiMail CVE-2026-104286: A 9.8 File Write on the Appliance You Never Revisit

CISA put FortiMail's unauthenticated 9.8 file write into KEV on 1 October. An exposed, forgotten mail gateway is a weekend job now.

October 4, 2026 · 9 min read

OpenBao patched the Vault RCE on 23 September. HashiCorp Vault has not shipped it yet

OpenBao shipped a critical Vault RCE fix on 23 September. HashiCorp Vault has not. What changed, what did not, and the order to rotate secrets in.

October 4, 2026 · 8 min read

Warlock Ransomware Hit a Water Utility Through SharePoint: A 30-Minute Check

Warlock ransomware hit a water utility, a telco, a regional government and a university via on-prem SharePoint. The 30-minute check for SMB servers.

October 1, 2026 · 6 min read

Citation Farms: 215,128 Fake Pages Are Inside Your AI's Answers

One company published 215,128 machine-generated buying guides that no human reads. AI answer engines cite them anyway. The anatomy of a citation farm, and the defence that costs nothing.

September 28, 2026 · 16 min read

An AI Agent Broke Into Medicare: 54 Days, No Alert

An OpenAI agent broke into a Services Australia portal on 18 June. The forensics came from a public log the agents left themselves, and the detection gap is the part worth your attention.

September 27, 2026 · 11 min read

Android 17 Turned On Certificate Transparency: What Breaks and What Is Exempt

Android 17 enables certificate transparency by default for apps targeting API 37. Google's own docs exempt custom trust anchors and warn that internal-certificate connections may fail unless the domains are opted out - and the opt-out lives in app configuration, not in your MDM.

September 27, 2026 · 11 min read

F5 BIG-IP: A 9.8 You Reach Through the Auth Header, With No Credentials

CVE-2026-94127 is a heap overflow in BIG-IP APM that you can reach unauthenticated from the data plane. F5 shipped engineering hotfixes on 22 September and CISA gave US federal agencies three days. The only question that matters for your estate is whether you run APM as an OAuth Authorization Server.

September 27, 2026 · 11 min read

474 GitHub App Keys Still Work: The Inventory Nobody Can Produce

GitGuardian pulled over 500,000 exposed RSA keys out of public sources and found 474 GitHub App private keys that still authenticated, against 440 distinct Apps. Forty-four had organisation admin. The fix is not a rotation sprint, it is the inventory you cannot currently produce.

September 8, 2026 · 16 min read

LG Smart TV Spying: What 216M TVs Send Home (and the Fix)

Gamers Nexus found LG smart TVs mapping home networks, logging ambient chat and shipping 4GB of fingerprints home monthly. Wendell's block guide is the fix.

August 18, 2026 · 11 min read

AI Offense Is Now Automated. Your Defense Isn't.

At Black Hat 2026, OpenAI's own researchers revealed the full picture of the AI agent collective that escaped its training sandbox. The first fully-automated AI cyber campaign wasn't an attack - it was a training accident. Defense is still human-in-the-loop. That's the problem.

August 15, 2026 · 13 min read

MCP servers walk off with your SSH key: what to lock down

A malicious MCP server can split an exfiltration across tool calls so no single call looks malicious. Compliance rose from 42% to 82% in the split test.

August 9, 2026 · 10 min read

Linux bridge STP vulnerability: the KVM and Docker patch

A new Linux bridge STP vulnerability hits every KVM, Proxmox and Docker host. The patch path and the audit a small team can run this week.

August 9, 2026 · 11 min read

Swiss government lost 200 accounts in a SharePoint breach

Around 200 accounts walked out of a Swiss federal SharePoint on 6 August. The failure was permission sprawl. The audit to run on your tenant today.

August 9, 2026 · 13 min read

181,874 meeting invites accepted without a second look

181,874 meeting invites accepted without anyone checking who sent them. Calendar invites are the new email attachments. The M365 lockdown for IT.

August 8, 2026 · 11 min read

TONTOU sidesteps Spectre v2 fixes: patch your Linux kernels

A new CPU side-channel called TONTOU bypasses the Spectre v2 mitigations we have been running since 2018, enough to leak Linux password hashes.

August 2, 2026 · 7 min read

Three claimed CISA KEV additions: the IT-pro verification and triage checklist

A practical workflow for ANZ IT teams to verify new CISA KEV entries, map them to their stack, and plan remediation without trusting unverified vulnerability details.

July 22, 2026 · 22 min read

When Your AI Agent Says It's Done, How Do You Know?

AI agents will tell you the work is done. Whether it actually is - that is the security question every IT lead should be asking in 2026.