Between The Hacks

A Cybersecurity Blog

  1. CVSS, KEV, and EPSS: Three Signals, Not One Answer

    CVSS measures severity. CISA's KEV catalog records known exploitation. EPSS estimates the chance of exploitation in the next 30 days. Here's how to use all three without mistaking any one of them for risk.

  2. Black October: When Every Cybersecurity Vulnerability Is an Emergency, Nothing Is

    Cybersecurity has an urgency problem. Brotli and PHP2Shell are real threats, but CVSS, KEV, exposure, and business impact answer different risk questions.

  3. BTH News: October 29, 2026

    Emergency Brotli patches, a poisoned LiteLLM release, PHP2Shell exploitation, and AI-assisted attacks in South Korea—plus what defenders should do next.

  4. I Went Wardriving Nearly 25 Years Ago. Here’s What I Found.

    Nearly 25 years ago, I mapped early Wi-Fi networks in Pennsylvania. More than 80% did not appear to be using WEP encryption—and WEP itself was already broken.

  5. BTH News: October 22, 2026

    Two critical PHP flaws meet forgotten systems, a 16-year-old Broadcom Wi-Fi bug, AI agents attacking 1,200 sites for about $5,000, and certificate-authority keys that were practically guessable. This week’s lesson: understand the real-world risk behind the headline.

  6. BTH News: October 16, 2026

    Microsoft's record Patch Tuesday, North Korean laptop farms in Texas, cryptocurrency hardware tampering, and an alleged listening device at OpenAI. Here's what caught my attention in cybersecurity this week.

  7. The French Fridge Failure: A Lesson in Internet Exposure

    Attackers remotely manipulated refrigeration systems at hundreds of French supermarkets, pushing temperatures as high as 50°C (122°F) and spoiling food. The incident is a stark reminder that critical management interfaces should never be exposed directly to the Internet.

  8. Twenty-Five Years Later, What I Remember About September 11

    Twenty-five years after September 11, 2001, I look back on the helplessness I felt watching the attacks unfold, and how ten days later I found a small way to help through my work in cybersecurity.

  9. The Self-Scheduled Scam

    A fake $499.99 PayPal charge appeared on my son’s calendar exactly one year after I documented a similar attack. Here is how calendar invite phishing works, what it means, and what to do when one appears.

  10. Your Next Cyberattack Could Start with a Job Application

    North Korean IT worker schemes are back in the spotlight with Season 2 of To Catch a Thief. But this isn't just a story about North Korea. It's a reminder that in an era of remote work and AI-generated identities, your next cyberattack could begin with a job application. Here's why hiring has become part of your security perimeter.

  11. The Jurassic Park Moment for AI Security: When AI Starts Testing the Fence

    AI doesn’t need to be malicious to become dangerous. It only needs an objective. Here’s what the OpenAI and Hugging Face incident teaches us about the future of cybersecurity.

  12. So You Want a Career in Cybersecurity?

    After nearly three decades in cybersecurity, hundreds of interviews, and building global security teams, here are the lessons I wish someone had shared when I was starting out.

  13. A CAPTCHA Should Never Ask You to Open Terminal

    A fake CAPTCHA on a trusted website tried to trick me into opening Terminal and executing a malicious command. That experience led to a deeper investigation into ClickFix, a rapidly growing social engineering technique that exploits trust instead of software vulnerabilities, and why attackers are increasingly impersonating security itself.

  14. AI Agents Aren’t Employees: Why Identity Isn’t Enough

    Enterprise security has spent decades answering two questions: Who are you? and What are you allowed to do? As AI agents become digital workers, identity and governance remain essential, but they may no longer be enough. This article explores the overlooked question that could define the next generation of AI security: What influences behavior?

  15. World Password Day 2026: Passwords Still Matter (Whether We Like It or Not)

    Passwords remain one of the most common ways attackers gain access. Despite years of awareness, weak credentials, reuse, and exposure continue to drive breaches.