Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A few weeks ago we published the first part of this series where we described the infrastructure used by the RondoDox threat actors to scan and exploit vulnerable systems. In this second post we’ll take a deep dive into the malware that is deployed into vulnerable systems. Specifically, we’ll look at the initial implant used to fetch the RondoDox binary and the binary itself, detailing its behaviour, how it communicates with the Command and Control (C2), and its malicious capabilities.

Managed service providers (MSPs) are operating in an environment defined by growing attack surfaces, rising customer expectations and increasing pressure to scale efficiently. With MSPs managing more than 20 tools on average, integrations are no longer a backend convenience but are a strategic requirement for reducing complexity, accelerating response and improving margins.

OPSWAT Gold Certification validates that Netwrix Endpoint Protector delivers consistent encryption and data protection across Windows, macOS, and Linux. Linux environments often lack visibility and control, creating gaps in endpoint security. Extending unified policies across all operating systems reduces risk, strengthens compliance, and improves visibility into how sensitive data is accessed and moved across the environment. Many organizations believe their endpoint security is well covered.

We’ve been talking about zero trust for years, and for good reasons. The evolution of threats and the growing sophistication of attacks continue to underscore the need for an approach based on continuous validation, leaving behind the implicit trust that long defined traditional security.

Something big just happened in the cybersecurity world. And if you’re using OpenAI’s macOS apps… this affects you directly. OpenAI has rotated its macOS code-signing certificates after a supply chain attack quietly slipped into its workflow. No, your data wasn’t stolen. But yes, this is serious enough that every macOS user must update before May 8, 2026.

Two big things in this release, a remote-updating CertKit agent Google Trust Store CA issuer support.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! Well, better late than never as some comments have been that I’ve seen.

Modern development teams move fast; security must keep pace. As organizations increasingly rely on GitLab to power CI/CD pipelines, integrating application security directly into the workflow is no longer optional — it’s essential. The Veracode GitLab Workflow Integration embeds automated security testing directly into GitLab pipelines, enabling teams to shift security left without disrupting delivery.

Artificial intelligence is changing how a business handles its operations, and that too very rapidly. AI agents can easily read, analyze, and act on enterprise data in real time. This ease also brings serious risk. If not managed well, these systems can expose sensitive information, break compliance rules, or even make harmful decisions. Did you know that on average, the overall cost of a data breach reached $4.45 million in 2023?

Let’s be real. Shadow AI is already reshaping Shadow IT Security, whether organizations are ready or not. Chances are that your developers aren’t waiting for a formal RFP to start using AI. They’re already deep in the trenches, using Open WebUI to manage models or shipping entire projects through platforms like Lovable at a velocity that makes traditional AppSec look like it’s standing still.