Blog · Author
VITI Security Team
Managed IT and cybersecurity practitioners at VITI Security, working across India and the United States. We write about where automation helps, where human judgment is non-negotiable, and how to run a secure, well-managed stack.
24 articles
ConnectWise ScreenConnect: Critical SCKit Malware Campaign Exploits CVE-2026-84869
A critical vulnerability, CVE-2026-84869, in ConnectWise ScreenConnect client is being actively exploited by SCKit malware, posing a severe threat. Patch immediately to version 26.6.5 or later and secure operator sessions.
Navigating SOC 2 and ISO 27001 with a vCISO, Not a Full Security Team
SaaS founders facing enterprise deal security requirements can achieve SOC 2 or ISO 27001 compliance efficiently using a vCISO, avoiding the cost and time of building an in-house security team. A vCISO provides expert guidance, strategy, and audit support.
N-able N-central Zero-Days: Immediate Action Required
N-able has patched critical zero-day vulnerabilities in its N-central RMM platform, some of which are being actively exploited in the wild. SMBs using N-central must update immediately to version 2026.4 HF2 to mitigate risk.
Crafting a DPDP-Compliant Consent Notice: Essentials and Pitfalls
A DPDP-compliant consent notice must clearly state the purpose, data types, and identity of the Data Fiduciary, alongside an easy withdrawal mechanism and grievance redressal. Avoiding vague language and bundled consent are critical for compliance.
Exploited Outlook Zero-Day: CVE-2026-124194 Security Advisory
Microsoft has patched an actively exploited Outlook zero-day, CVE-2026-124194. This spoofing vulnerability could lead to the disclosure of user authentication information (NTLMv2 hash) by tricking a user into opening a malicious file.
SEBI CSCRF and VAPT: What Regulated Entities Need to Test and How to Scope It
SEBI's CSCRF mandates periodic VAPT for regulated entities. This guide helps CISOs and compliance heads understand testing requirements, crucial scoping considerations, and how to effectively manage their cybersecurity posture.
ISO 27001 Internal Audit: Who Can Perform It and What Certification Auditors Check
Preparing for your ISO 27001 Stage 2 audit? Your internal audit is critical. This guide explains who can conduct it and what your certification auditor will scrutinize.
SonicWall SonicOS MFA Bypass Flaw (CVE-2026-19868) and Other High-Severity Vulnerabilities
CISA has flagged a critical SonicWall SonicOS MFA bypass vulnerability, CVE-2026-19868, as actively exploited. VITI Security advises immediate action for affected SMBs to patch their systems and review their security posture.
FTC Safeguards Rule: Naming Your Qualified Individual at a Small CPA Firm
For small CPA firms, the FTC Safeguards Rule mandates a "Qualified Individual" to lead the information security program. This vital role can be filled internally by an owner or senior manager with proper support, or more effectively, by an outsourced virtual CISO.
Regulation S-P: Mandating 72-Hour Vendor Breach Notification for RIAs and Broker-Dealers
The amended Regulation S-P now requires RIAs and broker-dealers to ensure their service providers contractually commit to notifying them of data breaches involving customer information within 72 hours. This post breaks down how to implement and enforce this critical contractual provision, ensuring your firm meets its regulatory obligations.
Barracuda Email Security Gateway: Critical Root Access Vulnerabilities (CVE-2026-116606, CVE-2026-111560)
Two critical vulnerabilities in Barracuda Email Security Gateway appliances allow unauthenticated root access without a login. VITI Security advises immediate patching to protect your business's vital email infrastructure.
EASM vs VAPT: Continuous Discovery vs Point-in-Time Test, and When You Need Both
EASM focuses on continuous, broad discovery of your external attack surface, while VAPT provides a deep, targeted security audit at a specific moment. Both are critical for a comprehensive security strategy.
Apple CVE-2024-27834 and CVE-2025-43529 Zero-Days Under Active Attack
CISA warns that Apple vulnerabilities CVE-2024-27834 and CVE-2025-43529 are being actively exploited by threat actors to deliver info-stealing malware. Learn what systems are affected and how to patch immediately.
What to Expect from Your vCISO: First 90-Day Deliverables
Understand the crucial initial deliverables a skilled virtual CISO brings in the first 90 days, from baseline assessments to a strategic security roadmap.
Penetration Testing for Non-Bank Lenders Under the FTC Safeguards Rule
What the FTC Safeguards Rule requires of mortgage brokers, consumer finance companies and other non-bank lenders: an annual penetration test and six-monthly vulnerability assessments, unless you run continuous monitoring, and who is exempt.
What Defines a Quality VAPT Report and Red Flags in Cheap Ones
A good VAPT report delivers specific, actionable intelligence on your security posture, clearly outlining risks and prioritized remediation steps. Cheap reports often provide generic scanner outputs lacking crucial human analysis and context.
WordPress Core Flaw CVE-2026-119977: Urgent Security Advisory for SMBs
CISA has confirmed active exploitation of CVE-2026-119977, a high-severity WordPress Core vulnerability. SMBs running affected WordPress versions must patch immediately, especially during full-package core upgrades, to prevent arbitrary code execution.
FTC Safeguards Rule Risk Assessment Example for a 10-Person CPA Firm
A practical, step-by-step risk assessment example tailored for a 10-person CPA firm to comply with the FTC Safeguards Rule.
Critical Vulnerability in Siemens SIMATIC IoT2050 Advanced Actively Exploited (CVE-2026-58115)
A critical remote code execution flaw (CVE-2026-58115) in Siemens SIMATIC IoT2050 Advanced devices is under active exploitation. Businesses using these devices must take immediate action to patch or mitigate the vulnerability.
Regulation S-P Breach Notification: What Actually Starts the 30-Day Clock
Under SEC Regulation S-P, the 30-day customer notification clock begins the moment you determine a breach has occurred, not when the investigation ends.
Android SMS of Death Exploit (CVE-2026-58882) Advisory
A proof-of-concept exploit for the "SMS of Death" vulnerability (CVE-2026-58882) targeting Android devices has been publicly released. Unpatched Android 12 and 13 phones are at risk of remote crashes and service disruption. Update your devices immediately.
DPDP Breach Intimation: What to Tell the Data Protection Board and Affected Users
Under India's Digital Personal Data Protection Act (DPDP Act), a data breach triggers specific, time-sensitive notification requirements to both the Data Protection Board of India and affected Data Principals. Understanding these rules is critical for avoiding penalties and maintaining trust.
Ivanti Connect Secure Exploit Chain: CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 Advisory
A threat actor dubbed UTA0576 is chaining three Ivanti Connect Secure vulnerabilities to gain unauthenticated root access. Learn if you are affected and how to patch now.
ISO 27001 Control 8.8: The Vulnerability Management Evidence Auditors Demand
For ISO 27001 control A.8.8, auditors scrutinize your vulnerability management process. This guide details the essential evidence-from policies to scan reports-you need to demonstrate compliance.