Pinned Tweet
Applications must be protected from unauthorised access. Develop the knowledge and expertise to identify, mitigate, and prevent security vulnerabilities throughout the SDLC. cycubixlimited.ac-page.com/c… #cybersecurity #appsecurity #AppSec #webappsec #threatmodeling #devsecops #PCIDSS
Copilot does not grant new access. It inherits the permissions each user already has, so a rollout makes years of SharePoint oversharing searchable in seconds. Run the oversharing assessment before the rollout date, not after it.
youtube.com/watch?v=pkGFZoK8…
58% of the sites where our scanner could complete a Reject click carried on tracking anyway. The banner records a decision nothing downstream reads. Test the reject path, not the accept path.
nitter.gq/cycubix/status/2118319…
Your website has a cookie banner. But is it actually respecting your visitors' choices?
New research from ConsentScan, developed by Cycubix, found that 69% of 160 leading EU websites loaded trackers or non-essential cookies before visitors gave consent.
And on websites where the scanner could complete a 'Reject' click, 58% continued tracking afterwards.
That's why we've launched ConsentScan – a tool designed to help businesses see what's really happening behind their cookie banners, identify potential GDPR and ePrivacy compliance issues, and understand how to fix them.
Think your website is compliant? Put it to the test.
Run your free scan: consentscan.io
Read the full EU Consent Index 2026: cycubix.com/cybersecurity-in…
#ConsentScan #GDPR #DataPrivacy #Cybersecurity #CookieCompliance
Fabio Cerullo retweeted
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline.
In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
Fabio Cerullo retweeted
Security release pre-alert:
We will release new versions of Node.js 22, 24, and 26 release lines on or shortly, after 2026-11-11 in order to address security vulnerabilities.
The highest severity issue fixed in this release is HIGH.
nodejs.org/en/blog/vulnerabi…
Supermarket fridge attacks: practical steps to reduce losses.
• Remove public controller access
• Secure maintenance via VPN + MFA
• Patch and segment
• Fit an independent temperature probe with remote/offline alerts
• Test safe local operation
European supermarkets hit by freezer hacking ft.trib.al/0CCoIp6
Fabio Cerullo retweeted
🔴 ÚLTIMA HORA | Un ciberataque causa pérdidas millonarias en decenas de supermercados en Bélgica y Suecia al disparar la temperatura de los refrigeradores social.elpais.com/w92i2
A cookie banner is not consent. The test is whether anything fired before the visitor clicked. Most sites I assess have a perfect banner and a tag manager that loads pixels anyway. Open devtools on your own homepage and watch.
nitter.gq/cycubix/status/2115142…
Building in SF, selling into Europe? 🇪🇺
Your cookie banner could be your first GDPR headache. If analytics or ad pixels fire before consent, EU regulators treat that as a violation.
Your first scan is free at consentscan.io
#GDPR #SaaS #SanFrancisco
NIS2 makes security training an explicit obligation. Most firms treat it as a completion rate for the auditor. The real gap is design: no report button in the toolbar, MFA optional in the account build.
cycubix.com/cybersecurity-in…
32 web shells in 61 seconds, from one automated run in the CyberXero campaign. Secure coding programmes built for human-speed attackers are already behind.
cycubix.com/cybersecurity-in…
Excessive agency is not a jailbreak. It is a service account with more permissions than the job needs, and an agent allowed to act without a human in the path. Now LLM03 in OWASP's 2026 list, up from LLM06.
youtube.com/watch?v=U86OzXB2…
628,000 records, taken by a crew pairing Cobalt Strike with an AI coding agent. It does not need a novel exploit, just volume: every parameter, every forgotten plugin, at machine tempo. Secure coding stopped being annual.
nitter.gq/cycubix/status/2110416…
A threat actor just used an AI coding agent (on top of Cobalt Strike) to steal 628,000+ records.
The same tools your devs use to ship faster are now in attackers' hands.
What this means for your security program + how to defend against it:
cycubix.com/cybersecurity-in…
ASOS says an attacker impersonated a trusted contact, got an employee's credentials, then used them on third party platforms. Your account, someone else's logs. Map what one stolen session opens before you need to know.
nitter.gq/cycubix/status/2110287…
The recent ASOS security incident is a reminder that cybercriminals don't always need to break through technical defences. Sometimes, they simply need someone to trust them.
According to ASOS, an attacker gained access to an ASOS employee account by "impersonating a trusted contact to obtain log in credentials" which were then used to access information on third-party platforms. (More here via @BBCNews - bbc.co.uk/news/articles/c3zx…)
It's a real-world example of social engineering and something we've been exploring in our recent Cycubix insights.
Attackers exploit trust, authority and urgency to manipulate human behaviour. And while security awareness is important, protecting an organisation can't rely on employees recognising every threat, every time.
We've explored these risks in three recent articles:
🔐 Cybersecurity Burnout: The Human Error Risk
cycubix.com/cybersecurity-in…
🧠 The Psychology of Social Engineering
cycubix.com/cybersecurity-in…
🎣 Why People Fall for Phishing
cycubix.com/cybersecurity-in…
The lesson? Cybersecurity isn't just about technology. It's about understanding human behaviour and putting the right safeguards in place.
At Cycubix, we help organisations identify risks and strengthen their security defences. Get in touch to discuss how we can support your business.
#CyberSecurity #SocialEngineering #PhishingAwareness #HumanRisk #CyberResilience
€403m against Google for unlawful location data is the headline. The quieter problem: most consent banners fire analytics tags before anyone clicks accept. The policy says one thing, the network tab says another.
nitter.gq/cycubix/status/2110053…
Google was just fined €403m for unlawful location-data processing — one of 2026's biggest GDPR fines. Cumulative EU fines have now topped €7.1bn. Is your site's cookie consent actually compliant? Check free: consentscan.io/blog/google-4… #GDPR #DataPrivacy
