CyphrQHow to Read a CVE Record and NVD Entry (and the 2025 Funding Scare)
Read a CVE record and an NVD entry field by field, with a real example, and learn what the 2025 CVE funding scare and NVD backlog mean for defenders.
Cyber Security
The scams and threats people and organisations actually face, and the defences that stop them.
The Data Breach Lifecycle: From First Access to Notification
How a data breach unfolds, from initial access and dwell time to containment and notification, with 2026 figures from IBM, Mandiant and Verizon.
Infostealers and Session Cookie Theft: Why MFA Isn't Enough
Infostealer malware can copy a logged-in session and skip MFA. How session cookie theft works, and the controls that make a stolen token useless.
Insider Threat Program: Types, Warning Signs and Privacy Limits
How to build an insider threat program: CISA's insider types, warning signs, least privilege, logging and DLP, HR and legal roles, and lawful monitoring.
php2shell (CVE-2026-109618): Two Critical PHP RCE Flaws and How to Patch Them
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow remote code execution. Fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35. What to do now.
Ransomware Decryption Tools: What No More Ransom Can and Can't Do
Free ransomware decryptors exist for some families only. What No More Ransom offers, why paying guarantees nothing, and the backups that matter more.
How Ransomware Attacks Work, and the Controls That Stop Them
How ransomware attacks unfold, from first access to encryption and extortion, and the backup, identity and patching controls that break the chain.
SIEM vs SOC: The Tool, the Team, and Which One You Need
A SIEM is a log platform; a SOC is the team that acts on it. Build, buy or hybrid, which logs to collect first, how long to keep them, and staffing.
CVSS vs EPSS vs KEV: Which Vulnerabilities to Patch First
CVE, CVSS, EPSS and KEV explained in plain language, with a Log4Shell worked example and a simple order for deciding which patches come first.
AI Phishing Protection for Small Business: The 30-Day Plan
AI made phishing fluent, personal and cheap. What protects a small business now, in order of impact, from passkeys to payment rules, with a 30-day plan.
Deepfake Scams: How to Spot Them When Your Eyes and Ears Can't
How deepfake voice and video scams work today, why the old visual tells no longer hold, and the verification habits that protect families and businesses.
Red Team vs Blue Team vs Purple Team: Who Needs Which, and When
Red, blue and purple teaming explained, regulator-led tests such as CBEST, TIBER-EU and DORA TLPT, how to scope one, and what a good report contains.
ZTNA vs VPN: Why Remote Access Gateways Get Breached
Why VPN appliances are a favourite way in, what zero trust network access changes, the order to migrate in, and what ZTNA does not fix.
Fileless Malware and Living off the Land: How to Detect It
Fileless attacks run through tools already on your systems, such as PowerShell and WMI. Why antivirus misses them, and how to detect and respond.
API Security Breaches: How Data Leaks Through APIs and How to Stop It
How attackers pull data out through APIs, mapped to the OWASP API Security Top 10 2023, two documented cases, and the controls that work.
Breach Detection Tools Explained: EDR, XDR, NDR, MDR and SIEM
What EDR, XDR, NDR, MDR, SIEM and deception tools each see, what they miss, and the telemetry and staff they need. With CISA and NIST sources.
What Is the Dark Web? How It Works, Who Uses It and the Risks
The dark web explained: how it differs from the deep web, who uses it, what stolen data is sold there, and what to do if your company data shows up.