In a world where network communication is encrypted, identities are protected by multi factor authentication, and access to systems is designed according to Zero Trust principles, one of the most effective attack vectors remains… a phone call. Vishing, meaning fraud based on voice driven social engineering, has not only failed to disappear with the advancement […]
With the growing scale and complexity of attacks on Internet infrastructure, traditional domain validation models have stopped meeting the requirements of modern public PKI. In response to real threats such as selective DNS spoofing and regional BGP hijacking, global certificate authorities, including DigiCert and Sectigo, implemented the mandatory Multi-Perspective Issuance Corroboration (MPIC) mechanism in 2025.
The year 2026 marks a fundamental turning point in the evolution of cybersecurity and digital trust. Drawing on forecasts prepared by DigiCert, we can see how traditional priorities in system and data protection are giving way to far deeper, structural challenges and opportunities. The next twelve months will be a period in which organizations will […]
From a technical perspective, email is today one of the best secured application-layer protocols. TLS transport encryption is a standard, DKIM signatures are widespread, and DMARC enables real enforcement of domain identity policy. Despite this, incident statistics remain unforgiving. Email is still responsible for the largest number of successful phishing attacks and security breaches resulting […]
The security of card payment processing environments has operated for years within a specific dualism. On one hand, it is a heavily regulated area, with clearly defined formal requirements imposed by card schemes. On the other hand, it remains one of the most frequently attacked segments of IT infrastructure, particularly in e-commerce, digital services, and […]
In the face of dynamic digital transformation, where the Zero Trust model is becoming the new standard and machine identity (workload identity) is just as critical as user identity, a reliable Public Key Infrastructure (PKI) forms the absolute foundation of security. For large enterprises, the choice of the right PKI architecture between the traditional Enterprise […]
Modern web application security is no longer a one-dimensional problem. Just a few years ago, most incidents could be attributed to simple configuration errors or missing CMS updates. In 2025 and 2026, however, multi-stage attacks, automated botnet campaigns, and abuse of application logic dominate, often leaving no obvious signatures. In this context, traditional vulnerability scanners […]
Encryption over HTTPS solves many problems, but one element has remained a critical vulnerability point for years: the moment when the browser still does not yet know whether it should use HTTPS. This stage precedes the actual TLS connection. It happens before the handshake is performed, before the certificate is verified and before the server […]
In October 2025, the CA/Browser Forum approved a change aimed at limiting the maximum validity period of publicly trusted Code Signing certificates from the current 39 months to 460 days (approximately 15 months). This change will take effect on March 1, 2026 and has critical implications for software supply chain security (Software Supply Chain Security).
By the end of 2025, OWASP published the final version of OWASP Top 10 2025. Although the name suggests another iteration of a well known document, in practice this edition is one of the most mature and, at the same time, one of the most uncomfortable releases in the project’s history. Uncomfortable because OWASP Top […]
