CIL Security Advisory

The Unmanaged Machine Identity Crisis

The modern enterprise is protected by Multi-Factor Authentication and biometrics for its human workforce. But a silent, non-human workforce of…

Defending Against Hybrid Warfare & Disinformation

Imagine war isn’t just about hacking computers anymore; it’s also about hacking your brain and what you believe. This is…

Critical Remote Code Execution (RCE) Vulnerability In Nginx Rewrite Module (CVE-2026-42945)

At the core of NGINX’s flexibility is the Rewrite Module, which allows administrators to dynamically redirect URLs, rewrite paths, and…

WhatsApp Vulnerability (CVE-2026-23866) Exploited via Instagram Reels Previews

Attackers can now weaponise the trust we place in legitimate social media links. By masking a malicious web address (URL)…

OAuth Token Abuse: The Forgotten Enterprise Attack Surface

OAuth is the underlying mechanism behind “Sign in with Google,” “Connect to Microsoft 365,” and similar integrations across enterprise SaaS…

Non-Human Identity Attacks: The Invisible Perimeter

Adversaries across a wide range of motivations are increasingly choosing to log in rather than break in, exploiting credentials, session…

Dependency Confusion Attacks: Exploiting Package Name Trust in Software Development

Dependency confusion is a software supply chain attack in which threat actors publish malicious packages to public repositories with the…

Supply Chain Attacks: Compromise through Developer Tooling

Modern cyberattacks are increasingly targeting the software development ecosystem itself. Rather than attacking production servers directly, threat actors now compromise…

Defence Against Deepfake Social Engineering (BEC 2.0)

The days of relying on simple voice or video for identity verification are over. "Business Email Compromise" (BEC) has rapidly…