The VITI Security Blog
Practical writing on managed IT + cybersecurity.
By the engineers doing the work - not a marketing team summarizing it. We write when we have something to say, not when the calendar says we should.
Critical Vulnerability in Siemens SIMATIC IoT2050 Advanced Actively Exploited (CVE-2026-58115)
A critical remote code execution flaw (CVE-2026-58115) in Siemens SIMATIC IoT2050 Advanced devices is under active exploitation. Businesses using these devices must take immediate action to patch or mitigate the vulnerability.
Regulation S-P Breach Notification: What Actually Starts the 30-Day Clock
Under SEC Regulation S-P, the 30-day customer notification clock begins the moment you determine a breach has occurred, not when the investigation ends.
Android SMS of Death Exploit (CVE-2026-58882) Advisory
A proof-of-concept exploit for the "SMS of Death" vulnerability (CVE-2026-58882) targeting Android devices has been publicly released. Unpatched Android 12 and 13 phones are at risk of remote crashes and service disruption. Update your devices immediately.
DPDP Breach Intimation: What to Tell the Data Protection Board and Affected Users
Under India's Digital Personal Data Protection Act (DPDP Act), a data breach triggers specific, time-sensitive notification requirements to both the Data Protection Board of India and affected Data Principals. Understanding these rules is critical for avoiding penalties and maintaining trust.
Ivanti Connect Secure Exploit Chain: CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 Advisory
A threat actor dubbed UTA0576 is chaining three Ivanti Connect Secure vulnerabilities to gain unauthenticated root access. Learn if you are affected and how to patch now.
ISO 27001 Control 8.8: The Vulnerability Management Evidence Auditors Demand
For ISO 27001 control A.8.8, auditors scrutinize your vulnerability management process. This guide details the essential evidence-from policies to scan reports-you need to demonstrate compliance.
Immediate Action Required: Critical Drupal Commerce Core Flaw (CVE-2026-118539) Under Active Attack
A critical access bypass vulnerability (CVE-2026-118539) in Drupal's Commerce Core module is being actively exploited in the wild. All businesses running affected versions must patch immediately and audit their systems for financial inconsistencies.
Does SOC 2 Require a Penetration Test? What Auditors Expect
SOC 2 does not explicitly mandate a penetration test, but auditors universally expect one. It's critical for demonstrating control effectiveness for the Security Trust Services Criteria.
CISA Adds GitLab RCE and Cisco Firewall DoS Vulnerabilities to KEV Catalog
CISA has added critical GitLab and Cisco vulnerabilities to the Known Exploited Vulnerabilities catalog. Learn if you are affected and how to respond.