Articles on Security

In one year, npm went from one phished password to a worm that sets up home in your code editor. Here is how a stranger's release ends up running on your laptop, what each defence actually proves, and the checks that would have stopped most of it.

A vulnerability has a life: it is born in a line of code, found, named, disclosed on a clock, patched, and then, much later, actually installed. AI has just sped up one part of that life far more than the rest. Here is the whole cycle, and the patch policy it now demands.

On 8 October 2025, the Federal Court ordered Australian Clinical Labs to pay $5.8 million, the first civil penalty in the history of the Privacy Act. The judgment is the first time a court has said what "reasonable steps" to protect personal information means. Here is what it said, what went wrong at Medlab Pathology, and how to check your own locks.

On 30 June 2025, Qantas found that a cyber criminal had targeted one of its contact centres and got into a platform that held records on about 6 million customers. The attacker targeted a call centre, not a firewall. Here is how a helpful person on a phone line became the easiest way into a large company, why MFA alone does not stop it, and what to change on your own helpdesk.

From today, if an Australian business with more than $3 million in turnover pays a ransom, it has 72 hours to tell the Australian Signals Directorate. The law does not ban paying. It bans paying quietly. Here is what a ransom actually buys, who has to report, when the clock starts, and what to put in your incident plan this week.

The weekend before last, criminals logged in to thousands of Australian super accounts with passwords stolen from other sites, and four AustralianSuper members reportedly lost a combined $500,000. Nobody broke in. They used the front door and a key that fitted. Here is how credential stuffing works, why super is a strange and tempting target, and what to switch on this week.

A tick box says "I'm not a robot", then asks you to press Windows+R, Ctrl+V and Enter. Those three keys run a stranger's command on your computer. Here is how the fake CAPTCHA works, why your antivirus barely sees it, and what to lock down this week, whether you use a website or run one.

Last Friday, one content update for one security tool turned about 8.5 million Windows computers into blue screens, from supermarket checkouts to airline check-in desks. Here is how a data file can crash a kernel, why the fix needed a person at every machine, and what to ask your own vendors before it happens again.

Ticketmaster, Neiman Marcus and other Snowflake customers had a bad few weeks, and the headlines said "Snowflake breach". The investigators say something more boring and more useful: old passwords, stolen by malware, used to walk in through the front door. Here is how it worked, whose lock it was, and what to check this week.

Ever stopped to ponder how your juicy office gossip or critical business plans zip safely through emails without landing in some sneaky hacker’s lap? Or why some emails find their cozy nook in your inbox while others are banished to the shadowy depths of the spam folder? It’s all thanks to the guardians of email security: protocols that ensure only the good stuff gets through and keeps the baddies at bay.

Here’s a startling fact for you: according to a report by Cybersecurity Ventures, cybercrime is expected to cost the world $10.5 trillion annually by 2025. That’s a colossal number, and it underscores the urgency for all of us to tighten our online security. Still think managing your myriad of passwords on a sticky note is a good idea? Yeah, didn’t think so.

Let’s get the kettle boiling by tackling an issue everyone loves to gripe about: passwords. Sure, they’ve been our digital sentinels for years, guarding our personal emails, bank accounts, and Facebook profiles. However, the harsh truth is they’re the weakest link in our cybersecurity chain. Weak or reused passwords are a hacker’s dream, and even strong ones are susceptible to phishing attacks.

Let’s talk VPNs. You’ve seen the ads. You’ve heard the buzzwords. Maybe you’ve even pondered clicking that “Subscribe Now” button. But hold on just a moment, because we’re about to delve into the nitty-gritty of what VPNs can and can’t do for you. Are they your digital guardian angel or just another layer of hype? Spoiler alert: It’s a little bit of both.

Most of us have heard about two-factor authentication or 2FA. It’s like the bouncer at the club of your personal data, asking for not just one, but two IDs before letting you in. It’s an upgrade from the old days of single-factor authentication (SFA), where you toss in a password and hope for the best. In 2FA, you’re looking at combining two different types of authentication, like a password and a security token or maybe a fingerprint. Why? Well, it’s about making it twice as hard for anyone who’s not you to access your stuff.

Let’s get down to brass tacks. User privacy in the digital world is sort of like a never-ending game of whack-a-mole. You fix one vulnerability and another one pops up almost instantly—it’s a real calorie burner for someone in my line of work, I can tell you! Now, you might be wondering why someone who is all about data collection and analytics is raising the vale on such a topic, and the reason is that it’s power scares me. Having seen it used for less-than-ethical uses over the years, I think it’s high time we discuss it.