The VITI Security Blog
Practical writing on managed IT + cybersecurity.
By the engineers doing the work - not a marketing team summarizing it. We write when we have something to say, not when the calendar says we should.
ConnectWise ScreenConnect: Critical SCKit Malware Campaign Exploits CVE-2026-84869
A critical vulnerability, CVE-2026-84869, in ConnectWise ScreenConnect client is being actively exploited by SCKit malware, posing a severe threat. Patch immediately to version 26.6.5 or later and secure operator sessions.
Read Full Article
Navigating SOC 2 and ISO 27001 with a vCISO, Not a Full Security Team
SaaS founders facing enterprise deal security requirements can achieve SOC 2 or ISO 27001 compliance efficiently using a vCISO, avoiding the cost and time of building an in-house security team. A vCISO provides expert guidance, strategy, and audit support.
N-able N-central Zero-Days: Immediate Action Required
N-able has patched critical zero-day vulnerabilities in its N-central RMM platform, some of which are being actively exploited in the wild. SMBs using N-central must update immediately to version 2026.4 HF2 to mitigate risk.
Crafting a DPDP-Compliant Consent Notice: Essentials and Pitfalls
A DPDP-compliant consent notice must clearly state the purpose, data types, and identity of the Data Fiduciary, alongside an easy withdrawal mechanism and grievance redressal. Avoiding vague language and bundled consent are critical for compliance.
Exploited Outlook Zero-Day: CVE-2026-124194 Security Advisory
Microsoft has patched an actively exploited Outlook zero-day, CVE-2026-124194. This spoofing vulnerability could lead to the disclosure of user authentication information (NTLMv2 hash) by tricking a user into opening a malicious file.
SEBI CSCRF and VAPT: What Regulated Entities Need to Test and How to Scope It
SEBI's CSCRF mandates periodic VAPT for regulated entities. This guide helps CISOs and compliance heads understand testing requirements, crucial scoping considerations, and how to effectively manage their cybersecurity posture.
ISO 27001 Internal Audit: Who Can Perform It and What Certification Auditors Check
Preparing for your ISO 27001 Stage 2 audit? Your internal audit is critical. This guide explains who can conduct it and what your certification auditor will scrutinize.
SonicWall SonicOS MFA Bypass Flaw (CVE-2026-19868) and Other High-Severity Vulnerabilities
CISA has flagged a critical SonicWall SonicOS MFA bypass vulnerability, CVE-2026-19868, as actively exploited. VITI Security advises immediate action for affected SMBs to patch their systems and review their security posture.
FTC Safeguards Rule: Naming Your Qualified Individual at a Small CPA Firm
For small CPA firms, the FTC Safeguards Rule mandates a "Qualified Individual" to lead the information security program. This vital role can be filled internally by an owner or senior manager with proper support, or more effectively, by an outsourced virtual CISO.