How long Entra ID keeps sign-in logs, and why the ConnectWise review outlives them
Entra ID keeps sign-in logs 7 days on Free and 30 on P1. The ConnectWise review floor of October 13 ages out on November 12.
Read →Articles
Articles
Notes on recent breaches and vulnerabilities — the specific practice that would have changed the outcome.
How long you keep systems offline after an incident is set by whose network they run on
Seminole County counters reopened in seven days while online services stayed dark; whose IP space a service runs on decided which survived.
Read →CISA listed one of four GitLab regex CVEs, and it has the narrowest version range
CISA listed one of four GitLab regex CVEs and it carries the shortest affected-version list; the floor you need is the October 21 patch line.
Read →What your web application's database account is allowed to read sets your breach size
Florida says 4.9 million people. That number was set by a database grant years earlier, not by the intrusion.
Read →Florida breach law covers your law firm, and the medical records are personal information
Fla. Stat. 501.171 makes a law firm a covered entity and client medical records personal information, with no HIPAA nexus required.
Read →Vet a subcontractor by the accounts you issued it, not by a questionnaire
A leak-site record named two unrelated companies in two fields. Vet subcontractors by the accounts you issued, not a questionnaire.
Read →A software-install flag found the shared-workstation insider, not an access review
A Florida detention deputy was caught by an install-policy alert on a shared workstation, not by any review of account access.
Read →Checking whether php2shell hit you takes three log sources
CISA php2shell hunt rule has four branches across three log sources, and the PHP error log is the one most teams never ship
Read →A required review that one person can skip is not a control
Citrus County required a second review before releasing records. Nothing in the send path enforced it, and 74 pages of SSNs went out.
Read →Your vendor's status page is a version inventory
CivicPlus restored Community Development v4 in a day and has left v3 offline for five. Restore order names which version runs a supported PHP.
Read →How Long a HIPAA Breach Investigation Actually Takes
A Florida practice detected a breach in five days but took 164 more to notify 85,585 patients, a gap HIPAA does not require it to explain
Read →NetScaler's Third 2026 Zero-Day Landed Three Days After the Last Deadline Closed
NetScalers September 30 remediation deadline closed three days before the next exploited zero-day surfaced
Read →How to verify a ransomware recovery vendor before you sign
MonsterCloud billed $150,000 to pay an $8,200 ransom, and DOJ charges say the markup ran for a decade.
Read →SOC 2 Type I Is Not SOC 2 Type II
Dean Mead cleared SOC 2 Type I in September 2026, but its Type II proof period does not end until December 2027
Read →Ivanti never assigned a CVE for the bug that hands attackers root
A CVE was assigned for the Ivanti escalation bug two days after disclosure, but not by Ivanti, and it still has no fixed version.
Read →How to test whether a compromised account can delete your backups
A leak site claims it can delete your backups. Researchers say that is unclear. Test it with three checks this week.
Read →Interlock encrypts virtual machines and leaves physical servers alone
CISA says Interlock encrypts VMs and leaves physical servers alone. For a fully virtualised back office that is total coverage, not a limit.
Read →What personal data an HOA management company keeps, and why one filing understates it
Access Residential Management filed one breach in two states on October 5. Massachusetts logged SSNs and licenses, Vermont logged health information.
Read →Your breach letter is legally forbidden from telling you what happened
Massachusetts law bans the breach notice to a resident from describing the breach and requires all of it in the filing to the Attorney General
Read →How to tell if a router still gets firmware updates
Florida sued TP-Link over routers past security support. The vendor end-of-sale list gives the date, and maintenance ends three years later.
Read →How to tell a vendor's software is end of life without asking them
A response header plus the vendor end-of-life table dates a maintenance gap from outside. On one Coral Gables firm it reads 1,764 days.
Read →Enhanced ISN Generation ships disabled, so the eighth NetScaler CVE is not in the build
CTX697096 lists eight NetScaler CVEs. Seven close on upgrade; CVE-2026-88778 needs a setting that ships disabled and no build turns on.
Read →Collect the NetScaler evidence before the upgrade reboots it
Citrix tells you to patch the exploited NetScaler now. Its own IR playbook and CISA both put evidence collection first.
Read →The franchisee filed the breach report, and nobody else has
An Oklahoma franchisee filed the HIPAA breach report. The brand is in Sunrise, Florida, and two leak sites named it. Three different scopes.
Read →Appliance mode is not a mitigation when the bug is in the data plane
F5 says Appliance mode is also vulnerable and there is no control plane exposure, so both reflex mitigations for CVE-2026-94127 fail.
Read →What a KEV deadline requires when there is no fixed release for your train
The required action on CVE-2026-93952 is mitigate or discontinue, not patch. Two of four VeloCloud Orchestrator trains still have no fixed release.
Read →The query with no case attached is the signal, not the query count
Twenty-two lookups in three years sat below every volume threshold. The control that finds them is a join between the query log and the case.
Read →The incident response plan had no trigger, and eighty days went by
Ocala detected a 492,056 dollar EFT fraud on day five and activated its incident response plan on day 80, because no event obliged anyone to start it.
Read →A CVSS attack vector of Adjacent is not a statement about your exposure
Zyxel scored CVE-2026-7273 as Adjacent, LAN only. GreyNoise counted 996 switches exploited across the internet, 564 with the factory password.
Read →The domain outlived the company's control of it
A Tampa DJJ contractor named on a leak site had a website that was already a Polish casino. A domain is a credential with no expiry reminder.
Read →Finding the network devices nobody owns means reconciling two lists that disagree
St. Lucie County found 3 unowned cameras from its permit file and 14 once it added a second list. The gap is the method.
Read →A required reason field is not a control until someone reads it
Fort Pierce police say an officer ran one plate 382 times and picked a reason each time. Nobody read the reasons for nine months.
Read →Remediating a KEV entry that names no product version
CISA gave three days to remediate two Linux kernel CVEs that name no product version. The fixed version is in your distro tracker, not the NVD range.
Read →A workflow engine that evaluates user-supplied expressions needs an auth boundary in front of it
Conductor 3.30.2 shipped June 3 and narrowed the GraalVM sandbox. It did not close the workflow API that evaluates expressions before login.
Read →The Cisco PSIRT advance notification is the maintenance window
Cisco named September 16 on September 9. The exploited ISE bug landed with a three-day KEV deadline, and the week before was the only slack.
Read →Upgrading GitLab does not rotate the secrets GitLab was holding
CVE-2026-85706 let an unauthenticated read of the GitLab secrets file, which holds the key that decrypts every CI/CD variable
Read →The NCUA 72-hour clock starts on belief, not on proof
NCUA gives a credit union 72 hours from the moment it reasonably believes it had a reportable cyber incident, not from the moment it can prove one.
Read →When your law firm is breached, its notice goes to individuals and your clock waits
Greenberg Traurig filed a consumer breach notice on September 9. It starts no clock for the client organizations whose documents were in the set.
Read →Cisco's fix for an exploited email gateway is a rebuild, not an upgrade
Cisco says upgrade only where exploitation of CVE-2026-76461 is not suspected. For a suspected virtual gateway it says new VM, rebuilt config, new credentials.
Read →Broadcom's fixed version for vCenter 7.0 is a support contract
For vCenter 7.0 the fix for CVE-2026-59310 is an extended support contract, and a tracker that reads patch available files it as done.
Read →You cannot manage a partner agency's phone, so manage what its login can pull
FLHSMV could not wipe the personal phone a Plant City officer kept its login on. The controls it did hold were account scope and query volume.
Read →JFrog's July fixed version is inside August's affected range
Three JFrog Artifactory advisories in 32 days: the 7.133 fix named in July is listed as affected in August, and all three CVEs are now in KEV.
Read →The RouterOS upgrade is also the only compromise check you get
MikroTik shipped the compromise check inside the RouterOS patch. An un-flagged device has not been cleared, only checked against known signs.
Read →Upgrading your RMM server does not update its agents
ConnectWise fixed CVE-2026-84869 in the ScreenConnect client, not the server. A patched server with stale agents is still the vulnerable build.
Read →The NetScaler precondition clause has a build number in it
Whether SAML gates CVE-2026-19490 depends on the NetScaler build. The June fixes sit in the gated range and 13.1 FIPS has no gate at all.
Read →Discovery, not disclosure, is when your breach-notification clock starts
A Sarasota vendor took 155 days to notify a breach against a 45-day Vermont deadline, because discovery was never defined in advance.
Read →The KEV title tells you what the attacker got, not what your code got wrong
CISA listed the Starlette and Kestra bugs by impact, not defect. Both are authorization bypasses, and your own middleware decides if yours is reachable.
Read →The precondition clause decides which NetScaler CVEs apply to you
Two NetScaler CVEs shipped in one Citrix advisory. The precondition clause, not the severity score, decided which one could touch you.
Read →Retest the component, not the CVE
SonicWall shipped 12.4.3-03453 as the July fix for SMA1000. The September advisory lists that same build as affected, 49 days later.
Read →A stock exchange announcement is not a breach notification
Craneware disclosed a breach to the London Stock Exchange. Your vendor disclosure venue is not the same thing as your notification clock.
Read →The legacy environment stays in scope until the data is gone
An Orlando practice was breached on legacy systems three months into an acquisition. The migration window is the gap nobody owns.
Read →On an authenticated page, the URL is the disclosure
A Miami Beach hospital settled a Florida wiretap claim over tracking scripts on its patient portal. The control that catches it is CSP report-only.
Read →The right time to retest after a breach is before the investigation ends
Lennar detected a breach on March 30. A second intrusion began 57 days later, while the first investigation was still open.
Read →KEV membership is not a patch trigger
A NetScaler overread was exploited within a day of its patch and is still absent from KEV 45 days later. Your own config is the better trigger.
Read →Your breach becomes public on the attacker's schedule
A Kissimmee provider was named on a leak site 14 days after the estimated intrusion and had said nothing 8 days later. Both facts are normal.
Read →BOD 26-04 replaced CVSS with four questions about your own config
CISA replaced CVSS-scored patch deadlines with four variables in June. The KEV median deadline fell from 21 days to 3.
Read →Under Regulation S-P, not knowing whose data it was means notifying everyone
Kovack Financial took 322 days to determine whose data was in the files. Regulation S-P now allows 30, and the default list is everyone.
Read →What to ask your IT provider when their remote management console is breached
An Ocala IT provider and ten organizations hit a leak site in 26 hours. The RMM console is the admin account nobody audits.
Read →Removing PLCs from the internet means finding the ones on cellular modems first
The FBI water-sector alert names no CVE. Initial access was the vendor programming software talking to an exposed PLC on a cellular modem.
Read →A silent security fix leaves you nothing to verify
N-central 2026.2 fixed a critical auth bypass in April and named no CVE. The CVE arrived 95 days later, after the incomplete fix was exploited.
Read →Six days of database access looked like an eight-hour outage
CareCloud reported an eight-hour outage to the SEC. Its breach notice, four months later, described six days of database access nobody saw.
Read →Breach notification speed is a data inventory problem
Operation PAR detected the intrusion in four days and took 380 more to notify 145,714 people. The gap is a data inventory problem, not a legal one.
Read →The 60-day breach clock starts when you finish the investigation, not when you find the intruder
Operation PAR detected the intrusion on day one and needed 365 more days to determine PHI was involved. The 60-day clock only starts at determination.
Read →