Opinion & Analysis
Commentary
Practitioner perspectives on security strategy, threat trends, and industry challenges. Opinionated, argued from experience, and written for professionals in the trenches — not the boardroom.
RSS feed →Air-Gapping Is Not a Security Strategy — Operation Highland Proves It Never Has Been
Velvet Ant's ten-year persistence inside an air-gapped network is being reported as an extraordinary technical achievement. It isn't. It is a predictable consequence of substituting physical isolation for security architecture, and the organisations still treating air gaps as a primary control are making the same mistake that left a critical infrastructure network exposed for a decade.
CipherWatch Editorial
Security Intelligence Platform
Your Most Trusted Tool Is Now Your Biggest Blind Spot: The RMM Security Problem
The SimpleHelp OIDC authentication bypass is the latest in a consistent pattern: remote monitoring and management tools — the software your IT team uses to fix problems — have become one of the primary entry points for sophisticated attackers. The reason is structural, and it won't be solved by patching one vendor at a time.
CipherWatch Editorial
Security Intelligence Platform
Your Internal Package Mirror Is Not a Supply Chain Defence
The Miasma supply chain campaign — which compromised publisher credentials to inject malicious code into legitimate packages including the Red Hat npm namespace — exposes a fundamental gap in how most organisations think about dependency security. Internal package mirrors provide real value against several attack classes, but credential compromise of legitimate publishers is not one of them.
CipherWatch Editorial
Security Intelligence Platform
The Week That Had Everything: June 2026 and What It Reveals About Enterprise Security Capacity
The week of 9–13 June 2026 delivered a record Microsoft Patch Tuesday, a CVSS 10.0 Ivanti exploit, a wormable Linux kernel proof-of-concept, Veeam and SAP critical advisories, and an accelerating ransomware worm across 66 countries. It was not a crisis — it was a normal week in 2026. That is the diagnosis.
CipherWatch Editorial
Security Intelligence Platform
When Microsoft, SAP, Ivanti, and Palo Alto All Patch Critical Flaws on the Same Day, We Have a Coordination Problem
The week of 9 June 2026 delivered critical security patches from at least four major vendors on the same day, plus a Linux kernel PoC, plus a CISA KEV batch. The security community has created a coordination structure — Patch Tuesday — that has the opposite of its intended effect: it concentrates defender workload in a single week every month while giving attackers 30 predictable days to prepare.
CipherWatch Editorial
Security Intelligence Platform
Vulnerability Management Is Failing Because the Volume Is Unmanageable. We Need to Admit It.
The June 2026 Patch Tuesday delivered 198 CVEs from one vendor in one day. Security teams also had to process concurrent critical advisories from SAP, Ivanti, Palo Alto, and CISA on the same day. The volume is not a temporary surge — it is the permanent state of software security. The current vulnerability management model is not designed for this scale and the consequences are being measured in ransomware payments.
CipherWatch Editorial
Security Intelligence Platform
198 CVEs in One Day. Something Has Gone Wrong With How We Do Patch Management.
Microsoft's June 2026 Patch Tuesday drops 198 vulnerabilities in a single Tuesday, including six zero-days and three CVSS 9.8 remote code execution flaws. Meanwhile SAP patches 21 flaws on the same day, Cisco issues a critical advisory, and a Linux kernel PoC goes public. The security community has normalised a monthly event so large that no enterprise team can actually process it — and that normalisation is itself the problem.
CipherWatch Editorial
Security Intelligence Platform
VPN Gateways Are Where Ransomware Gets In. CVE-2026-50751 Is Not the Last One.
Check Point CVE-2026-50751 joins a long list of critical authentication bypass and remote code execution vulnerabilities in enterprise VPN gateways that have been exploited in ransomware campaigns. The pattern is consistent enough that it is no longer useful to treat each as a one-off incident — it is a structural category of risk that requires a structural response.
CipherWatch Editorial
Security Intelligence Platform
Why China-Nexus Actors Are Targeting Network Appliances — and Why Your EDR Won't Tell You
The BRICKSTORM BSD variant developed by VerdantBamboo is not a technical curiosity. It is evidence of a deliberate strategic investment by China-nexus threat actors in precisely the attack surface that most enterprise security programmes cannot see. Appliance-targeting is not the path of least resistance — it is the path of least detection.
CipherWatch Editorial
Security Intelligence Platform
The Smart TV Is a Network Device. Most Enterprises Have Not Noticed.
The revelation that free apps are enrolling Smart TVs as residential proxy exit nodes is not primarily a consumer privacy story. It is a network security story about a class of device that has proliferated across enterprise environments — conference rooms, executive suites, hotel rooms during business travel — without being managed as a network security asset.
CipherWatch Editorial
Security Intelligence Platform
The Third-Party Plugin Is the Perimeter Now — Magento Today, Your Stack Next
CVE-2026-45247 in the Mirasvit Magento extension continues a pattern that security teams have been watching for years: the attack surface of any complex platform is not defined by the core platform's security — it is defined by every third-party component installed on it. This is not a Magento problem. It is an architecture problem that affects every enterprise platform stack.
CipherWatch Editorial
Security Intelligence Platform
CVE-2026-46243 and the Enterprise Linux Kernel Patch Lag Problem
The 19-year latency of CVE-2026-46243 makes headlines. What is less discussed is the operational lag between 'patch available' and 'patch applied' across enterprise Linux fleets. Distribution advisories are published. Patched kernels hit repositories. And then organisations schedule the reboots — often weeks later. CVE-2026-46243 is not unusual in its severity; it is unusual in making the patch lag visible.
CipherWatch Editorial
Security Intelligence Platform
Healthcare Ransomware Is a Structural Problem. The Gentelman Surge Is Not a Surprise.
The Gentelman ransomware surge hitting healthcare this week follows a pattern that has repeated with near-mechanical regularity for five years. The security industry has correctly diagnosed the problem: legacy infrastructure, high willingness to pay, broad RMM attack surface, and regulatory environments that prioritise availability over security. The diagnosis is correct. The treatment is not happening fast enough.
CipherWatch Editorial
Security Intelligence Platform
The ITSM Platform Is the Map to Your Infrastructure — and You've Left It Unlocked
The ServiceNow API breach is the latest confirmation that IT Service Management platforms are among the highest-value targets in the enterprise. They contain everything an attacker needs to plan a targeted intrusion: network topology, patch status, change windows, and credentials. The industry's classification of these platforms as 'IT operations tools' rather than 'sensitive data repositories' is a governance error with real consequences.
CipherWatch Editorial
Security Intelligence Platform
Oracle's Quarterly CPU and the Enterprise Java Patching Culture That Makes WebLogic Vulnerabilities Sticky
CVE-2024-21182 was patched in January 2024. It reached the CISA KEV in June 2026. The 18-month gap is not unique to this CVE — it reflects how enterprise Java middleware is patched in practice, which is to say: slowly, incompletely, and often only under direct pressure.
CipherWatch Editorial
Security Intelligence Platform
When Everything Is Critical, Nothing Is: The CVSS Severity Inflation Problem
Q2 2026 has produced more CVSS 9.0+ vulnerabilities than most organisations can effectively respond to simultaneously. Part of the problem is the vulnerability itself. Part of the problem is that the CVSS scoring system has drifted toward higher scores over time, reducing the signal value of 'critical' as a triage category.
CipherWatch Editorial
Security Intelligence Platform
Netlogon Will Be Exploited Again. The Question Is Whether Your Architecture Has Changed Since Zerologon.
CVE-2026-41089 is the third significant Netlogon vulnerability with active exploitation in six years. Zerologon (CVE-2020-1472) prompted an industry-wide reckoning with domain controller exposure. If your DC network architecture has not materially changed since 2020, the reckoning was incomplete.
CipherWatch Editorial
Security Intelligence Platform
65 Days Unpatched: The Citrix NetScaler Exploitation Pattern Nobody Has Solved
CVE-2026-3055 was patched in March. In late May, Fortinet confirms large-scale exploitation of thousands of unpatched NetScaler appliances. This cycle has repeated with every major Citrix vulnerability for years. The gap between patch availability and patch deployment on network appliances is a structural problem with a known solution that the industry is not implementing.
CipherWatch Editorial
Security Intelligence Platform