# bluwarden.com blog Practical cybersecurity guidance for small and mid-sized businesses. Every post is available as markdown at `/blog/.md`. ## This Week in Cybersecurity: Week 43 October 25, 2026 · Marcus · Weekly · 23 min read Week 43: PHP2Shell flaws hit millions of websites with attack attempts, eight eMudhra CA keys prove guessable, and LiteLLM and Railway leak developer secrets. - HTML: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w43 - Markdown: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w43.md ## Node.js Brotli and TLS Flaws: What to Patch October 22, 2026 · Lucas · Development · 11 min read Node.js fixed ten flaws on 21 October, including a Brotli bug reachable through fetch() and Express 5. Who's exposed, what to update, and the eMudhra CA block. - HTML: https://bluwarden.com/blog/nodejs-brotli-tls-security-release - Markdown: https://bluwarden.com/blog/nodejs-brotli-tls-security-release.md ## PHP2Shell: Who's Exposed and What to Patch October 21, 2026 · Lucas · Threats · 21 min read PHP2Shell is under attack: two critical PHP flaws let attackers run code on web servers without a login. Who's exposed, how to patch, and what to check for. - HTML: https://bluwarden.com/blog/php2shell-critical-php-vulnerabilities - Markdown: https://bluwarden.com/blog/php2shell-critical-php-vulnerabilities.md ## APT28's NATO Shipbuilder Hack: What's Known October 20, 2026 · Marcus · Threats · 17 min read Symantec caught Russia's APT28 inside a NATO naval shipbuilder for two months. What the evidence confirms, what it can't, and what the techniques teach you. - HTML: https://bluwarden.com/blog/apt28-nato-shipbuilder-breach - Markdown: https://bluwarden.com/blog/apt28-nato-shipbuilder-breach.md ## Chinese Rental Cars Filmed Norwegian Troops October 19, 2026 · Marcus · Threats · 17 min read Rental cars used in a Norwegian military exercise filmed soldiers, routes and gate codes. What happened, what is proven, and why connected cars are a risk. - HTML: https://bluwarden.com/blog/chinese-rental-cars-norway-military - Markdown: https://bluwarden.com/blog/chinese-rental-cars-norway-military.md ## This Week in Cybersecurity: Week 42 October 18, 2026 · Marcus · Weekly · 21 min read Week 42: a stolen ConnectWise app credential opens Microsoft 365 tenants, a record 1,413-flaw Patch Tuesday, and zero-days in Ivanti, Cisco and BeyondTrust. - HTML: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w42 - Markdown: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w42.md ## Posting Your Kids Online: The Real Risks October 14, 2026 · Rose · Privacy · 20 min read Sharenting risks through the Roman Atwood stalking case: how children's photos feed stalkers, identity fraud and AI abuse, and how to share more safely. - HTML: https://bluwarden.com/blog/sharenting-risks-posting-kids-online - Markdown: https://bluwarden.com/blog/sharenting-risks-posting-kids-online.md ## How to Avoid Getting Doxxed Online October 12, 2026 · Marcus · Privacy · 17 min read How doxxing works, how common it is, and how to reduce your digital footprint: data broker opt-outs, Google removals, photo location and what to do if doxxed. - HTML: https://bluwarden.com/blog/how-to-avoid-getting-doxxed - Markdown: https://bluwarden.com/blog/how-to-avoid-getting-doxxed.md ## This Week in Cybersecurity: Week 41 October 11, 2026 · Marcus · Weekly · 19 min read Week 41: 8.8 million Danish ID records exposed through one company account, rogue Google certificates from hijacked registries, and two more NetScaler flaws. - HTML: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w41 - Markdown: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w41.md ## Fake CAPTCHA Scams: How to Spot Them October 7, 2026 · Lucas · Awareness · 14 min read Fake Cloudflare and reCAPTCHA checks trick you into pasting malware into your own PC. How the scam works, how to spot it, and what to do if you ran the command. - HTML: https://bluwarden.com/blog/fake-captcha-scams - Markdown: https://bluwarden.com/blog/fake-captcha-scams.md ## This Week in Cybersecurity: Week 40 October 4, 2026 · Marcus · Weekly · 16 min read Week 40: Citrix NetScaler flaws mass-exploited worldwide, an exploited Apple flaw patched for older iPhones, and attacks on Cisco SD-WAN and FortiMail. - HTML: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w40 - Markdown: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w40.md ## The EU's €10,000 Cash Cap and Your ID Data October 2, 2026 · Rose · Privacy · 12 min read The EU's €10,000 cash cap and stricter crypto KYC start in July 2027. Who has to show ID, who doesn't, and why the bigger risk is where the ID data ends up. - HTML: https://bluwarden.com/blog/eu-cash-limit-crypto-aml-rules - Markdown: https://bluwarden.com/blog/eu-cash-limit-crypto-aml-rules.md ## This Week in Cybersecurity: Week 39 September 27, 2026 · Marcus · Weekly · 17 min read Week 39: a Chrome and Windows zero-day chain used in real attacks, 9.8 flaws exploited in F5 and Check Point gear, and Bitget loses $351.6 million to attackers. - HTML: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w39 - Markdown: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w39.md ## ShinyHunters FBI Hack: What's Confirmed September 24, 2026 · Marcus · Threats · 14 min read The FBI confirms ShinyHunters took employee data through an unpatched PeopleSoft server. What is verified, what isn't, and what PeopleSoft admins should check. - HTML: https://bluwarden.com/blog/shinyhunters-fbi-hack-claim - Markdown: https://bluwarden.com/blog/shinyhunters-fbi-hack-claim.md ## This Week in Cybersecurity: Week 38 September 20, 2026 · Marcus · Weekly · 14 min read Week 38: a Chrome patch gap turned already-fixed bugs into zero-days, two Cisco flaws came under attack at once, and a human attacker outran every AI agent. - HTML: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w38 - Markdown: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w38.md ## This Week in Cybersecurity: Week 37 September 13, 2026 · Marcus · Weekly · 12 min read Week 37: Russian state hackers used Claude to rebuild malware, a maximum-severity GitLab flaw was exploited within hours, and Patch Tuesday broke records. - HTML: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w37 - Markdown: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w37.md ## AI Cyberattacks: What Actually Changed September 11, 2026 · Marcus · Threats · 10 min read Hundreds of AI agents breached 395 organisations in 48 countries. The tools were old and the flaw was patched three days earlier. What changed is the clock. - HTML: https://bluwarden.com/blog/ai-cyberattacks-what-changed - Markdown: https://bluwarden.com/blog/ai-cyberattacks-what-changed.md ## AI CSAM Ruling: What It Actually Means September 9, 2026 · Rose · Privacy · 11 min read A US appeals court held that possessing self-made AI CSAM at home is protected speech. What the ruling covers, what stays a felony, and who it actually affects. - HTML: https://bluwarden.com/blog/ai-csam-first-amendment-ruling - Markdown: https://bluwarden.com/blog/ai-csam-first-amendment-ruling.md ## This Week in Cybersecurity: Week 36 September 6, 2026 · Marcus · Weekly · 11 min read Week 36: a Chrome zero-day under active attack, a JFrog admin-token exploit, a Thomson Reuters court data breach, and schools hit by old PaperCut bugs. - HTML: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w36 - Markdown: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w36.md ## This Week in Cybersecurity: Week 35 August 30, 2026 · Marcus · Weekly · 11 min read Week 35: Actively exploited flaws hit PaperCut, Gitea, Oracle WebLogic and cPanel, plus a Berlin ransomware refusal and a nuclear-records breach via ownCloud. - HTML: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w35 - Markdown: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w35.md ## Device Trust: Why MFA Alone Isn't Enough August 28, 2026 · Lucas · Business · 12 min read Stolen sessions walk past MFA, so device trust became the answer. But device registration is self-service and compliance is self-reported. Here is what holds. - HTML: https://bluwarden.com/blog/device-trust-what-it-actually-stops - Markdown: https://bluwarden.com/blog/device-trust-what-it-actually-stops.md ## This Week in Cybersecurity: Week 34 August 23, 2026 · Marcus · Weekly · 10 min read Week 34: 14,500 hijacked Dahua cameras, a Rust crate with 245M downloads poisoned, WhatsApp device-linking abuse, and a CVSS 10.0 that needed nobody at all. - HTML: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w34 - Markdown: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w34.md ## This Week in Cybersecurity: Week 33 August 17, 2026 · Marcus · Weekly · 12 min read Week 33: 737 fake VPN extensions still in the Chrome store, a Windows kernel zero-day under active attack, Macs mined via Screen Sharing, passkey attacks. - HTML: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w33 - Markdown: https://bluwarden.com/blog/this-week-in-cybersecurity-2026-w33.md ## EU Cyber Resilience Act: What Changes August 16, 2026 · Rose · Privacy · 13 min read The EU Cyber Resilience Act starts to bite on 11 September 2026. What it changes about the smart devices you buy, and what to check before you buy one. - HTML: https://bluwarden.com/blog/cyber-resilience-act-what-changes - Markdown: https://bluwarden.com/blog/cyber-resilience-act-what-changes.md ## Android Sideloading Rules: What Changes August 11, 2026 · Marcus · Privacy · 10 min read Google now verifies who builds every Android app. What changes in September 2026, what it actually stops, what it doesn't, and what to do before it lands. - HTML: https://bluwarden.com/blog/android-developer-verification-sideloading - Markdown: https://bluwarden.com/blog/android-developer-verification-sideloading.md ## Scam Phone Numbers in Google AI Overviews August 6, 2026 · Lucas · Awareness · 9 min read Google and ChatGPT are surfacing scam customer service numbers as fact. Here's how the fraud works, the real cases behind it, and how to check before you call. - HTML: https://bluwarden.com/blog/scam-phone-numbers-ai-overviews - Markdown: https://bluwarden.com/blog/scam-phone-numbers-ai-overviews.md ## Mac Outbound Firewall: What macOS Misses July 29, 2026 · Rose · Hardening · 12 min read macOS's built-in firewall only inspects incoming traffic. Here's how to see and control what your Mac quietly sends out, using LuLu - a free, open-source tool. - HTML: https://bluwarden.com/blog/macos-outbound-firewall-lulu - Markdown: https://bluwarden.com/blog/macos-outbound-firewall-lulu.md ## How to Vibe Code Securely July 20, 2026 · Marcus · Development · 23 min read A technical, plain-language guide to building AI-generated apps that don't leak - secrets, auth, injection, and what never to paste into your AI agent. - HTML: https://bluwarden.com/blog/secure-vibe-coded-apps-2026 - Markdown: https://bluwarden.com/blog/secure-vibe-coded-apps-2026.md ## EU Chat Control: What It Means for You July 18, 2026 · Rose · Privacy · 9 min read The EU's Chat Control mass-scanning law is back and extended to 2028. Here's what it means for your private messages and email, and how to reduce your exposure. - HTML: https://bluwarden.com/blog/chat-control-is-back - Markdown: https://bluwarden.com/blog/chat-control-is-back.md ## Most Private Browser for iPhone July 3, 2026 · Marcus · Hardening · 9 min read Every iPhone browser runs on the same engine. Here's what really differs between Safari, Chrome, Brave, Firefox and Orion - and which one leaks least. - HTML: https://bluwarden.com/blog/ios-browser-hardening-2026 - Markdown: https://bluwarden.com/blog/ios-browser-hardening-2026.md ## What Are Cybersecurity Services? June 30, 2026 · Lucas · Business · 8 min read A plain-language guide to what cybersecurity services include, why small businesses get targeted, and how to spot a good provider from an expensive one. - HTML: https://bluwarden.com/blog/cybersecurity-services-what-they-are - Markdown: https://bluwarden.com/blog/cybersecurity-services-what-they-are.md ## What Is Smishing? How to Stop Scam Texts June 27, 2026 · Lucas · Awareness · 8 min read Smart people click smishing links too. Why SMS scams work on the informed - and the iPhone and Android settings that protect you when you don't notice. - HTML: https://bluwarden.com/blog/smishing-anatomy-phone-protection - Markdown: https://bluwarden.com/blog/smishing-anatomy-phone-protection.md ## Biggest Cybersecurity Threats to Companies June 24, 2026 · Marcus · Threats · 8 min read Everyone talks about AI attacks. Real breaches are more boring - stolen sessions, ClickFix and RMM abuse. Here's what's actually getting companies owned. - HTML: https://bluwarden.com/blog/what-actually-breaks-company-security-2026 - Markdown: https://bluwarden.com/blog/what-actually-breaks-company-security-2026.md ## Phishing Simulation: Why It Works June 19, 2026 · Marcus · Awareness · 9 min read Most breaches start with one rushed click. Here's how controlled phishing simulations turn staff from your weakest link into your first line of defence. - HTML: https://bluwarden.com/blog/phishing-simulation-why-companies-need-it - Markdown: https://bluwarden.com/blog/phishing-simulation-why-companies-need-it.md ## Password Best Practices: Passkeys & MFA June 14, 2026 · Lucas · Hardening · 7 min read Protect your accounts with strong passwords, passkeys and MFA - a plain-language guide to phishing-resistant authentication for people and for teams. - HTML: https://bluwarden.com/blog/password-best-practices-2026 - Markdown: https://bluwarden.com/blog/password-best-practices-2026.md ## How to Secure Your iPhone June 9, 2026 · Marcus · Hardening · 8 min read Harden a standard iPhone using only built-in iOS settings - Advanced Data Protection, per-app location, phishing defence and more. No extra apps needed. - HTML: https://bluwarden.com/blog/ios-standard-security-hardening - Markdown: https://bluwarden.com/blog/ios-standard-security-hardening.md ## How to Secure Your Android Phone June 2, 2026 · Lucas · Hardening · 7 min read Secure your Android phone in 2026 using only built-in settings and your Google account - no extra apps. Covers screen lock, permissions, 2FA and anti-theft. - HTML: https://bluwarden.com/blog/android-standard-security-hardening - Markdown: https://bluwarden.com/blog/android-standard-security-hardening.md ## 10 Most Private & Secure Browsers (Ranked) May 12, 2026 · Marcus · Privacy · 8 min read Ten popular browsers ranked from most private and secure to least - Tor, Brave, Firefox, Safari, Chrome and more, in plain language, no jargon. - HTML: https://bluwarden.com/blog/private-secure-browsers-2026 - Markdown: https://bluwarden.com/blog/private-secure-browsers-2026.md