Cybersecurity doesn't have to be complicated. I am here to break down concepts, threats, tips, and tools in simple language. For mere mortals and developers alike.
Since I have been asked this a lot: The best way to support this site, is to buy my books.
New Pass-ta-key research shows how malware already on a Windows PC can abuse Google-synced passkeys. The calm lesson is not to panic about passkeys, but to protect the device that holds them.
Ukraine's CERT found malware shipped as a Notepad++ plugin bundled with otherwise legitimate distributions. The vendor is right that plugin loading is normal functionality, which is exactly the problem: editor extensions are unreviewed code running with your full user privileges.
A July 2026 campaign recruited developers through Slack, then delivered four-stage malware inside a trojanised e-commerce repository presented as an interview exercise. The payload hid in an SVG and no antivirus flagged it. Running a stranger's repo is executing their code.