Security teams can’t patch what nobody remembers exists. This week’s BTH News connects critical PHP flaws, a 16-year-old router bug, AI agents probing 1,200+ sites, and CA keys that were practically guessable. Different stories. Same problem: forgotten systems and hidden trust.

Dusting off an old feature at Between The Hacks. BTH News is back! A weekly look at cybersecurity headlines, with some context, commentary, and the occasional bit of humor. Here's the first edition!

I’ve said this for years: if a system wasn’t designed and hardened for the public Internet, it has no business being there. French refrigeration controllers just provided a very expensive reminder.

Twenty-five years ago today, I was working from home as an IT security architect for IBM e-Business when I heard the tone of the morning news anchors suddenly change. Like millions of others, I stopped working and watched the events of September 11 unfold. I remember the shock, sadness and anger. But one feeling from that day still stands out to me. Helplessness. I wanted to help. Ten days later, I was given a small opportunity to do exactly that. Today, on the 25th anniversary of September 11, I wrote about that experience, the role cybersecurity played in it, and one performance from *America: A Tribute to Heroes* that still brings tears to my eyes 25 years later. Never forget. betweenthehacks.com/blog/sep…

After nearly 30 years in cybersecurity, this is the article I wish someone had handed me when I was getting started. If you’re thinking about a career in cybersecurity, or mentoring someone who is, I hope you find it useful.

I encountered a real ClickFix attack while visiting a trusted website. The malware wasn’t the interesting part. The psychology was. Attackers are increasingly impersonating security itself. My latest Between The Hacks article: betweenthehacks.com/blog/cli… #ClickFix #Cybersecurity

I’ve been thinking about this question a lot lately. Identity tells us who an AI agent is. Governance determines what it’s allowed to do. I think the next question is: What influences AI behavior? Curious where others land on this.

I’ve seen too many teams burn cycles chasing severity scores while real risk remains exposed. This is the mental model I’ve found works better.

Legacy systems are a growing problem for every enterprise. Learn how to mitigate risk and manage these systems in your organization. This was a fun one to write!

Clever & Fascinating!

A North Korean hacker faked a resume, claimed to live in Houston, and applied for a remote job. Kraken moved him forward just to study him. Spoiler: He flunked Halloween. 🧑‍💻🎃 Full post: betweenthehacks.com/blog/the…

It’s World Password Day. If you’re still using iloveyou123, this blog is for you. Passwords are tired—let’s do better. 👉 betweenthehacks.com/blog/wor… #WorldPasswordDay #Cybersecurity #Passkeys #Infosec

I wrote about quishing, the QR code version of phishing you didn’t know you were falling for. Parking meters, invoices, job flyers... the codes look safe until they’re not. Stay Alert! 👉 bth.news/quishing #CyberSecurity #Quishing #Phishing #QRcodes

Just submitted my DEF CON 33 talk: What SBOMs Forgot About the Network NetBOM defines where a device or app should connect, and helps firewalls block everything else. Least privilege, at the network layer. netbom.net #NetBOM #DEFCON33 #Cybersecurity

This one hits hard and makes you laugh—ransomware explained the BTH way. 👇

Big changes! Between The Hacks now lives at betweenthehacks.com. Same content, just a new home. Have a look: betweenthehacks.com/blog/new…