This Week in Cybersecurity: Week 43
Week 43: PHP2Shell flaws hit millions of websites with attack attempts, eight eMudhra CA keys prove guessable, and LiteLLM and Railway leak developer secrets.
Marcus · · 23 min readAuthor
Marcus
Marcus writes bluwarden's privacy and device-hardening guides. He spends his time in the weeds of browser internals, mobile platforms, and the settings vendors would rather you left alone - then turns what he finds into steps a non-specialist can follow. His rule: no hype, no fear-selling, just the handful of changes that move the needle.
More from Marcus
Marcus · · 23 min readAPT28's NATO Shipbuilder Hack: What's Known
Symantec caught Russia's APT28 inside a NATO naval shipbuilder for two months. What the evidence confirms, what it can't, and what the techniques teach you.
Marcus · · 17 min readChinese Rental Cars Filmed Norwegian Troops
Rental cars used in a Norwegian military exercise filmed soldiers, routes and gate codes. What happened, what is proven, and why connected cars are a risk.
Marcus · · 17 min readThis Week in Cybersecurity: Week 42
Week 42: a stolen ConnectWise app credential opens Microsoft 365 tenants, a record 1,413-flaw Patch Tuesday, and zero-days in Ivanti, Cisco and BeyondTrust.
Marcus · · 21 min readHow to Avoid Getting Doxxed Online
How doxxing works, how common it is, and how to reduce your digital footprint: data broker opt-outs, Google removals, photo location and what to do if doxxed.
Marcus · · 17 min readThis Week in Cybersecurity: Week 41
Week 41: 8.8 million Danish ID records exposed through one company account, rogue Google certificates from hijacked registries, and two more NetScaler flaws.
Marcus · · 19 min readThis Week in Cybersecurity: Week 40
Week 40: Citrix NetScaler flaws mass-exploited worldwide, an exploited Apple flaw patched for older iPhones, and attacks on Cisco SD-WAN and FortiMail.
Marcus · · 16 min readThis Week in Cybersecurity: Week 39
Week 39: a Chrome and Windows zero-day chain used in real attacks, 9.8 flaws exploited in F5 and Check Point gear, and Bitget loses $351.6 million to attackers.
Marcus · · 17 min readShinyHunters FBI Hack: What's Confirmed
The FBI confirms ShinyHunters took employee data through an unpatched PeopleSoft server. What is verified, what isn't, and what PeopleSoft admins should check.
Marcus · · 14 min readThis Week in Cybersecurity: Week 38
Week 38: a Chrome patch gap turned already-fixed bugs into zero-days, two Cisco flaws came under attack at once, and a human attacker outran every AI agent.
Marcus · · 14 min readThis Week in Cybersecurity: Week 37
Week 37: Russian state hackers used Claude to rebuild malware, a maximum-severity GitLab flaw was exploited within hours, and Patch Tuesday broke records.
Marcus · · 12 min readAI Cyberattacks: What Actually Changed
Hundreds of AI agents breached 395 organisations in 48 countries. The tools were old and the flaw was patched three days earlier. What changed is the clock.
Marcus · · 10 min readThis Week in Cybersecurity: Week 36
Week 36: a Chrome zero-day under active attack, a JFrog admin-token exploit, a Thomson Reuters court data breach, and schools hit by old PaperCut bugs.
Marcus · · 11 min readThis Week in Cybersecurity: Week 35
Week 35: Actively exploited flaws hit PaperCut, Gitea, Oracle WebLogic and cPanel, plus a Berlin ransomware refusal and a nuclear-records breach via ownCloud.
Marcus · · 11 min readThis Week in Cybersecurity: Week 34
Week 34: 14,500 hijacked Dahua cameras, a Rust crate with 245M downloads poisoned, WhatsApp device-linking abuse, and a CVSS 10.0 that needed nobody at all.
Marcus · · 10 min readThis Week in Cybersecurity: Week 33
Week 33: 737 fake VPN extensions still in the Chrome store, a Windows kernel zero-day under active attack, Macs mined via Screen Sharing, passkey attacks.
Marcus · · 12 min readAndroid Sideloading Rules: What Changes
Google now verifies who builds every Android app. What changes in September 2026, what it actually stops, what it doesn't, and what to do before it lands.
Marcus · · 10 min readHow to Vibe Code Securely
A technical, plain-language guide to building AI-generated apps that don't leak - secrets, auth, injection, and what never to paste into your AI agent.
Marcus · · 23 min readMost Private Browser for iPhone
Every iPhone browser runs on the same engine. Here's what really differs between Safari, Chrome, Brave, Firefox and Orion - and which one leaks least.
Marcus · · 9 min readBiggest Cybersecurity Threats to Companies
Everyone talks about AI attacks. Real breaches are more boring - stolen sessions, ClickFix and RMM abuse. Here's what's actually getting companies owned.
Marcus · · 8 min readPhishing Simulation: Why It Works
Most breaches start with one rushed click. Here's how controlled phishing simulations turn staff from your weakest link into your first line of defence.
Marcus · · 9 min readHow to Secure Your iPhone
Harden a standard iPhone using only built-in iOS settings - Advanced Data Protection, per-app location, phishing defence and more. No extra apps needed.
Marcus · · 8 min read10 Most Private & Secure Browsers (Ranked)
Ten popular browsers ranked from most private and secure to least - Tor, Brave, Firefox, Safari, Chrome and more, in plain language, no jargon.
Marcus · · 8 min readGet new posts in your feed reader
One feed with every new article and the weekly roundup. Nothing to sign up for, nothing collected.
https://bluwarden.com/feed.xmlOpenNew to feeds? Paste the address into a reader such as NetNewsWire, Feedly or Thunderbird and new posts turn up on their own.