.svg)
Cybersecurity
Posts tagged Cybersecurity
45 posts
How to Check for PHP2Shell (CVE-2026-109618): Free PHP2Shell Checker
The fastest way to check a site for PHP2Shell is to run the free PHP2Shell checker, which reads the PHP version the site advertises and compares it ...
Railway Security Incident (October 2026): What to Do, and What SOC 2, ISO 27001, GDPR and HIPAA Require
On October 21, 2026, Railway disclosed that an unauthorized third party may have accessed the encrypted environment variables of its customers and,...
PHP2Shell (CVE-2026-109618, CVE-2026-109619): What to Do, and When It Becomes an Incident
PHP2Shell is two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution without a login on PHP web...
Agentic AI Security Architecture: How to Let AI Agents Do Real Work Safely
Agentic AI security architecture starts with a map of the components of an AI agent system and the connections between them, which sets the scope,...
Datadog and SOC 2: Which Controls Datadog Covers and What Still Needs a Program
Datadog can supply SOC 2 evidence for vulnerability identification (CC7.1), security monitoring (CC7.2), alert evaluation (CC7.3), unauthorized or...
Hybrid Cloud Security Monitoring with Datadog: What Covers On-Premises Servers
Hybrid cloud security monitoring applies the same detection, vulnerability scanning, and configuration checks to on-premises servers as to cloud...
Is Datadog a SIEM? How Datadog Cloud SIEM Handles SOC 2 Logging and Monitoring
Yes. Datadog Cloud SIEM is Datadog's security information and event management (SIEM) product. It applies threat detection rules to the logs already...
Datadog Cloud Security Management: Vulnerability and Misconfiguration Scanning for SOC 2 and ISO 27001
Datadog Cloud Security Management checks hosts, containers, and cloud accounts for software vulnerabilities and insecure settings. It uses the same...
EU Cyber Resilience Act (CRA): What It Is, Timeline and Requirements for Hardware and Software Makers
The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, is an EU law that sets mandatory cybersecurity requirements for hardware and software...
What Is a Neocloud? Definition, Examples, and What It Means for Compliance
A neocloud is a cloud provider built around renting GPU compute for AI training and inference, often on bare metal servers, with far fewer managed...
How to Secure Your Jobber Account
A Jobber account holds client names, addresses, job history, and, for businesses using Jobber Payments, saved payment details. It is also the system...
Top Google Workspace Security Recommendations
A Google Workspace account is not secured by default just because Google operates the infrastructure behind it. Google secures the servers; the...
How Does a DMARC Check Work? A Step-by-Step Guide to DMARC Validation
A DMARC check looks at a message that has already gone through SPF and DKIM, and asks one more question: does the domain that passed either of those...
How Does a DKIM Check Work? A Step-by-Step Guide to DKIM Verification
A DKIM check confirms two things about a message: 1) that a system holding the sending domain's private key signed it, and 2) that the signed parts...
How Does an SPF Check Work?
When a message arrives, the receiving mail server checks the sending domain's SPF record before it does almost anything else with the message. It...
SPF, DKIM and DMARC: How the Three Email Authentication Records Work Together
SPF, DKIM and DMARC work as a team to stop attackers from sending email that looks like it comes from a domain they do not control. SPF checks...
Top 8 vCISO Services for Mid-Market SaaS in 2026
The right vCISO service for a mid-market SaaS company is the one that owns and runs the security program end to end, on a fractional basis, the way a...
What Does a Security Architect Do?
A security architect does three jobs: sets security requirements for systems other people design, assesses and reviews those designs, and solutions...
How to Run a Security Assessment Across 90 Applications in 90 Days
When an application portfolio is too large to pen-test, an inquiry-based maturity assessment gets you a defensible, board-ready picture in weeks...
Hybrid Identity Management: How to Centralize IGA
It's tempting to centralize identity by buying a platform, but I leave the platform for last. Below is my approach to solutioning centralized...
Security Architecture in Practice: The Questions Teams Actually Ask
Security architecture is the practice of designing how people, process, and technology work together to protect an organization's systems. It is not...
What Is Security Architecture? A Practitioner's Guide
Security architecture is the practice of understanding a system component by component and connection by connection. In practice it comes down to two...
How to Create a Security Architecture Diagram (With a Worked Example)
A security architecture diagram is a boxes-and-arrows drawing of a system: boxes for the key components, arrows for the data flows or network flows...
Who Advises on Security Architecture and Design? The Five Options Compared
Advice on security architecture and design should come from someone with a deep understanding of cybersecurity practice: ideally ten or more years in...
The Security Architecture Review Process: Phases, Checklist, and Deliverables
A security architecture review is a structured walk through a system's components and connections, checking each against security best practices and...
What Is a SOC Report? SOC 1, SOC 2, and SOC 3 Explained
A SOC report (System and Organization Controls report) is an independent auditor's attestation report on a service organization's controls, issued by...
Third Party Risk Management (TPRM): What It Is and How to Build a Program
Third party risk management (TPRM) is the discipline of identifying, assessing, and controlling the risks that come from the external organizations a...
What Is a Vulnerability Scan? What It Finds, What It Misses, and How Often to Run One
A vulnerability scan is an automated check that compares systems, software, and configurations against a database of known security weaknesses and...
Vulnerability Assessment Services: What They Include, What They Cost, and How to Choose a Provider
Vulnerability assessment services are engagements where a third party inventories an environment, scans it for known security weaknesses, validates...
Quebec Law 25 Compliance: The Privacy Law Every SaaS Company Should Know About (But Probably Doesn't)
Quebec Law 25 is the province's modernized private-sector privacy law: a set of amendments (adopted in 2021 as Bill 64) to the Act respecting the...