Insights & notes
Security knowledge without the padding. We write about what actually works — in the field, with real clients.
The new Czech Cybersecurity Act (No. 264/2025 Coll.) introduces obligations that this time go far beyond large corporations and public institutions. The regulation affects thousands of Czech companies — and many still don't know it.
Read article →DORA and the Czech cybersecurity rules require assessed suppliers, specific contract clauses and documented reviews. Here is how Observa keeps track.
Read article →Alpine Linux and OpenSSH have fixed a flaw that lets an attacker log in without knowing a password. Since 6 November 2026 Previdian reports exploitation attempts.
Read article →After an initial gap analysis the question is what comes next. How findings turn into a risk treatment plan under the Czech decree, what cannot be delegated and how to split work between suppliers.
Read article →The attack on Binance started when an engineer downloaded code from a fake job interview. Three measures that stop it: no user installs, allowlisting, training.
Read article →CISA added a WordPress Core flaw to its exploited vulnerabilities catalogue on 3 November 2026. During a short upgrade window it lets an unauthenticated attacker run code. Update to 7.1.4.
Read article →Regulators want a maintained asset inventory, known dependencies and an impact analysis with recovery times. Here is how Observa keeps all of it in one place.
Read article →Ivanti released a fix on 29 October that closes the full chain of three flaws in its Connect Secure VPN gateway. Attackers have been reaching root since early October.
Read article →Postponing security to next year does not have to mean a lost year. Deadlines under the Czech cybersecurity act do not follow the calendar. What to decide in November and what can wait.
Read article →CISA added three flaws to its exploited list this week: GitLab at CVSS 10, the SSL VPN on Cisco firewalls and insufficient logging in ESX at CVSS 2.7. Patches exist.
Read article →CISA added the Fragnesia flaw in the Linux kernel to its exploited vulnerabilities catalogue on 28 October. Attackers chain it with PHP2Shell to gain root on servers.
Read article →CISA added CVE-2026-48356 in Adobe Commerce and Magento to its exploited list on 27 October 2026. The fix dates from July, but stores still need checking.
Read article →A flaw in the Brotli decoder lets crafted compressed data corrupt process memory. Fixes are out for Node.js, .NET and PHP for Windows, with no confirmed exploitation.
Read article →Which documents DORA expects from financial entities, from the ICT risk management framework to the register of ICT providers, and how to tell a real annual review.
Read article →Assets, risks, suppliers, incidents and audit evidence in one place. What Observa does, what it automates, how it connects to your systems and what it costs.
Read article →Unit 42 reported the first case where attackers used PHP2Shell to breach a European government body and stole password hashes and MFA secrets within two hours.
Read article →CISA has added a flaw in the Collabora Online Built-in CODE Server app for Nextcloud to its exploited list. The attack needs no login and ends with commands running on the server.
Read article →A public exploit for FortiSIEM needs no login, GitLab fixed a flaw scored 10, Oracle shipped its quarterly patch set, and a Redis bug from May is being exploited.
Read article →PHP also runs inside firewalls and management consoles. Palo Alto confirms PAN-OS and Panorama are affected, Cisco is checking 25 products, Fortinet cleared most of its own.
Read article →Attackers abuse a flaw in the GlobalProtect portal and gateway of PAN-OS to establish VPN sessions without credentials, Unit 42 links it to ransomware operators.
Read article →The fix is out. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 close two flaws rated 9.2 that allow unauthenticated remote code execution. Amazon and Cloudflare report attempts.
Read article →The CVE-2026-102764 flaw in BeyondTrust Remote Support has been exploited since late August. An unauthenticated attacker can upload files to the appliance.
Read article →The week of 12 to 16 October 2026 brought five exploited vulnerabilities affecting the Ivanti VPN gateway, Palo Alto firewalls, the Cisco email gateway, Windows and the AhsayCBS backup server.
Read article →Over 2,500 organisations and 434,000 CI/CD pipelines. Cisco, Siemens, Volkswagen, Airbus and Deloitte on the list. Not one of them was attacked directly, and neither was the library through which it reached them. Attackers obtained a token belonging to the Trivy security scanner and rode it into the LiteLLM build. One un-revoked token, three tools deep. What that means for your dependencies.
Read article →A dense week. August Patch Tuesday brought over 400 fixes, CISA added four entries to its actively exploited catalog, and one researcher published a working Windows Defender exploit for which no patch exists. Metabase, rated 10.0, already has confirmed victims, and the N-able N-central attack reaches customers through their IT provider. Five things and what to do about them.
Read article →We need a pentest. We hear this often, and about half the time it is the wrong answer. Three distinct services are sold under similar names, and the price range is wide enough that cost tells you nothing: a quote for EUR 1,200 and one for EUR 16,000 can carry the same label. What a scan answers, what a pentest answers, what an assessment covers, and when a pentest is wasted money.
Read article →The first week of August followed an unusually clear pattern. Not one of the major vulnerabilities targeted endpoints or users. All of them targeted the tools that manage infrastructure: the TeamCity build server, the N-able N-central platform, the Cisco firewall console. Why hunt workstations one at a time when you can compromise the system that manages all of them. Five things worth attention.
Read article →Nobody calls us saying they need a vCISO. They call because a customer sent a security questionnaire nobody can answer. Because they have discovered they fall under new regulation. Because the colleague who somehow held it together has left. The common denominator is always the same: nobody owns security. What a vCISO actually does, how much time it takes, what it costs, and when you need something else.
Read article →AI tools are already in your organisation — whether IT knows about it or not. Employees are working with ChatGPT, Gemini, and Copilot, feeding them internal documents, customer emails, source code, and business plans. Data that previously stayed inside the corporate network now travels to cloud-based models operated by external providers.
Read article →In 2023, Copilot for Microsoft 365 was a near-future promise. In 2024, it became available to enterprise customers. In 2025, Microsoft announced the EU Data Boundary as a solved problem, and Copilot began reaching regulated environments — with assurances that customer data would stay in Europe. In 2026, two developments complicated that picture.
Read article →EU Cyber Resilience Act: Secure Software Development Is No Longer Optional. The regulation entered into force on 10 December 2024. It is built on a straightforward premise: manufacturers bear responsibility for the security of their products throughout their supported lifetime, not only at the point of sale. And they cannot transfer that responsibility to customers through license agreement exclusions (EULAs).
Read article →Three Critical June 2026 Vulnerabilities Under Active Exploitation: Check Point VPN (CVE-2026-50751) patched June 8, 2026 · Cisco SD-WAN (CVE-2026-20182) patched · RoguePlanet (CVE-2026-50656) unpatched
Read article →The most common mistake in cybersecurity? A company builds a system, launches an application, or introduces a new process — and only then starts asking how to secure it. By that point, it's usually too late for security to be truly effective. And too expensive to be done properly.
Read article →Picture this: someone walks into your office, plugs a USB stick into an employee's laptop, and five minutes later walks out with access to everything on that encrypted drive. Or imagine an employee with no admin rights running a simple script on a company computer and gaining full control of the operating system — no alert from the antivirus, no log entry, nothing to suggest anything happened at all.
Read article →Just a few years ago, a fraudulent email was obvious at first glance: typos, awkward phrasing, a suspicious sender, and an unrealistic promise. Today, it was written by a model trained on billions of texts. It knows your name, references your latest project, and knows what your boss is called. How do you defend against a threat the human eye can no longer see?
Read article →Large enterprises have CISOs, dedicated security teams, and million-euro budgets. Small and medium-sized businesses have reality — limited resources, little time, and a steadily growing number of cyberattacks aimed squarely at them. The good news: 80% of threats can be eliminated with the right basic measures in place. Here are the ten that matter most.
Read article →