Practical defense
against AI-era attacks
Attackers are using AI to move faster. We break down real incidents, show how to defend with AI agents, and lay out the data-handling procedures that stop a breach from spreading.
Latest incidents and guides
Apache's critical mod_http2 flaw reaches only servers that speak HTTP/2: check each host, then patch or turn h2 off
CVE-2026-119618 affects Apache httpd 2.4.55 through 2.4.70, but only hosts with HTTP/2 enabled are reachable. Find them, patch internet-facing ones first, and know what the workaround breaks.
Hijacked GitHub accounts ran a CI secret stealer and deleted the run, so a missing run number is the trace
Aikido says stolen credentials let attackers run a stealer in at least 1,800 repositories from Nov. 10. The actor reverted within a minute and deleted the runs and logs.
Business Email Compromise Response: The First 24 Hours
Call the bank before you investigate, find out whose mailbox leaked the thread, then remove the rules, grants and sessions a password reset leaves behind.
Data Breach Notification Laws by State: Which Deadline Binds
A four-step procedure for a breach that touches several states: test the data and the incident, map residents, build one calendar with a start event and due date per clock, then add sector rules.
Claroc says 35,578 Grok-built apps were open to anyone with the link
Claroc's count of Grok apps open with no sign-in, why a "secret link" is findable, and how a US company finds and locks down apps its staff published.
Vates says attackers are exploiting a Xen Orchestra login bypass that grants Admin and can lead to root on XCP-ng hosts
Vates says a threat actor is exploiting an authentication bypass in Xen Orchestra, and that successful unauthenticated access leaves no log entry.
Browse by topic
Guides and checklists
Procedures, checklists and fill-in plans for handling data and running an incident.
All guides- Business Email Compromise Response: The First 24 HoursHow-to
- Data Breach Notification Laws by State: Which Deadline BindsHow-to
- HIPAA breach notification: from the discovery date to the HHS reportHow-to
- Ransomware Response Playbook: Decisions for the First 72 HoursHow-to
- New York data breach notification law: residents within thirty days, three state agencies and, for DFS licensees, a DFS report within 72 hoursOverview
- California data breach notification law: notice to residents within 30 calendar days, the Attorney General copy and what triggers themOverview
Defense first
We explain how an attack works so you can stop it. We do not publish working exploits.
Facts checked against their sources
Claims are checked against their sources before publication. Versions, prices and other values that change are re-checked afterward.
Responsible disclosure
Found a flaw in something we cover? Write to the editors at contact@cybersecurity.guru.