Analysis and explanation of vulnerabilities, offensive techniques and compliance for security and engineering teams.
Case Study
TIBER-EU turns red teaming from a vendor demo into a regulated, intelligence-driven exercise with mutual recognition across Europe. Here is how the mechanism works, who plays which role, and what it means under DORA.
CVE Alert
Two critical PHP flaws rated 9.2 allow unauthenticated remote code execution on any web server running the interpreter. Here is how the longjmp memory corruption actually works, who is exposed, and what to do now.
Industry News
STISC says attackers are mailing .7z and .zip archives from @mail.ru addresses, hiding executable files behind names like "Payment Order" and "Paid Invoices" — and the malware can clean up after itself.
Industry News
DORA replaced "do you have security controls?" with "have you proven your critical service survives a real attack?" Here's what the testing regime demands — and where TLPT fits.
Industry News
Moldova's first mandatory cybersecurity framework is now in force, modelled on the EU's NIS2. Here is who falls under it, what it actually demands, and why two of its obligations cannot be satisfied with paperwork.
Security Guide
PCI DSS is the one framework that says "penetration test" out loud and pins a frequency to it. Here's what 11.3 and 11.4 demand, and what your QSA will ask for.
Security Guide
Neither standard says "run a penetration test every year." Both demand something no document can prove: that your controls actually work. Here's what auditors accept as evidence — and what quietly creates a nonconformity.
Security Guide
Three overlapping EU regulations are reshaping how companies prove they are secure. Here is what DORA, NIS2 and the Cyber Resilience Act actually demand — and why the deadlines matter.
Security Guide
NIS2 is an EU directive, yet Moldovan companies keep getting asked to prove their systems were tested. Here is how a penetration test answers that question — and what evidence each framework actually demands.
Industry News
The window between a vendor's patch and a working exploit has collapsed from weeks to hours, thanks to AI. Here's what defenders need to do instead of just patching faster.
Case Study
An honest, criteria-based comparison of the leading penetration testing providers in Moldova to help you choose the right partner in 2026.
Industry News
The European Commission has released a comprehensive Action Plan on AI and cybersecurity, outlining new rules for evaluating advanced AI models, controlled access for critical sectors, and a dedicated testing platform for critical infrastructure.
Industry News
Deloitte clarifies what TLPT is, how it differs from traditional penetration testing, and its role in EU DORA and other regulatory frameworks.
Security Guide
Penetration testing, or ethical hacking, simulates cyberattacks to identify vulnerabilities before malicious actors exploit them. This guide covers types, techniques, and steps involved.
Industry News
A threat actor tracked as O-UNC-066 is using voice phishing and a custom phishing kit to trick Microsoft 365 users into enrolling an attacker-controlled passkey, enabling account takeover and data extortion.
CVE Alert
A cybercrime crew left its server open for 22 days, exposing a massive operation that backdoored thousands of WordPress sites using 27 CVEs, including CVE-2026-3844 in Breeze caching plugin.
Industry News
Anthropic's Project Glasswing, using Claude Mythos Preview, has identified over 10,000 high- or critical-severity vulnerabilities in widely used software, with patching now the main bottleneck.
CVE Alert
Qualys disclosed CVE-2026-46333, a privilege escalation flaw in the Linux kernel's __ptrace_may_access() function, affecting major distributions since 2016. Exploits allow unprivileged users to read sensitive files and execute arbitrary commands as root.
CVE Alert
A critical authentication bypass vulnerability (CVE-2026-20896, CVSS 9.8) in Gitea Docker images is being actively probed by threat actors just 13 days after public disclosure. The flaw allows unauthenticated attackers to impersonate any user via a crafted HTTP header.
CVE Alert
U.S. agencies issue urgent CISA deadline for patching critical Cisco SD-WAN vulnerabilities, while researchers uncover PleaseFix flaws in AI browsers that could compromise password managers.
CVE Alert
Qualys Web Application Scanning (WAS) now detects the critical Log4Shell vulnerability (CVE-2021-44228) using QID 150440 and 150441, leveraging Out-of-Band detection via Qualys Periscope.