Security, explained.

Threat awarenessEXPLAINER · 6 MIN READ

Why a vendor patch date and a CISA catalog date can differ

Four Apple, Google and Microsoft cases show why patch announcements and known-exploitation records belong in the same workflow, without treating either date as the start of an attack.

Defense & recoveryEXPLAINER · 5 MIN READ

Android’s September patches: the adbd flaw and the update fields to check

The September bulletin includes a race-related use-after-free in adbd. Understanding the flaw also means separating Android versions, security patch levels and Google Play system updates.

Defense & recoveryEXPLAINER · 5 MIN READ

Two exploited Windows bugs, two routes to SYSTEM privileges

Microsoft’s September fixes cover unsafe file-link handling in Windows Update Stack and heap corruption in ALPC. Both can turn local access into a much more serious compromise.

Identity & accessEXPLAINER · 5 MIN READ

Apple’s Screen Sharing fix: CVE-2026-65400 and unauthenticated access

Apple repaired an authentication-state flaw in macOS Screen Sharing. Check the affected release branch, who can reach the service and whether older access needs investigation.

Threat awarenessEXPLAINER · 5 MIN READ

Chrome CVE-2026-85046: what the exploited V8 bug tells us

Google confirmed exploitation of a V8 type-confusion flaw. The advisory identifies the fix, but leaves the underlying failure and the rest of any exploit chain undisclosed.

Defense & recoveryCHECKLIST · 5 MIN READ

An incident response plan your team can actually use

Decide who can act, what evidence to preserve and what has to be checked before service resumes. Then rehearse the plan while the systems are still working.

Identity & accessEXPLAINER · 5 MIN READ

Authenticator codes or passkeys: what changes when you sign in?

Both can improve on a password alone, but they protect against different attacks. Understand TOTP secrets, WebAuthn origin checks, recovery and the sessions left open after login.

Threat awarenessEXPLAINER · 5 MIN READ

A supplier changed their bank details. How do you know it’s really them?

A fraudulent payment request can pass SPF, DKIM and DMARC. Here’s what those checks establish, what evidence to keep, and how to verify the transaction itself.

Threat awarenessGUIDE · 4 MIN READ

Which security updates should you install first?

CVSS, EPSS and known exploitation answer different questions. Use them alongside your own inventory and exposure, then verify that the fixed software is actually running.