Sana Qureshi
Security & Privacy Editor · 47 stories[email protected]Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.
Latest from Sana Qureshi
All desk coverage
NewsZammad Zero-Days (CVE-2026-102489, CVE-2026-102490): Patch Now
CISA added both Zammad zero-days to its KEV catalog after DIVD says an AI agent chained them to hijack a session, run code, and gain root inside its own network.
ExplainerWhat Is a Password Manager? How It Works and Do You Need One
What a password manager actually does, how its zero-knowledge encryption protects your vault, autofill and passkey support, and whether you need one.
NewsAtlassian CVE-2026-21589: Critical File-Read Flaw, Patch Now
A critical, unauthenticated file-read bug hits eight self-hosted Atlassian products. Cloud is already patched; no exploitation confirmed yet, but patch now.
ComparisonRing vs Arlo vs Google Nest: Price, Features and Which to Buy
Arlo's $29.99 unlimited-camera plan leads on AI detection, Ring is cheapest for whole-home video history, and Google Nest wins for Gemini-connected smart homes.
NewsFortiMail CVE-2026-104286: Critical Zero-Day Exploited, Patch Now
A critical, unauthenticated path-traversal flaw in FortiMail is under active attack. CISA added it to its exploited-vulnerabilities list the same day Fortinet disclosed it.
ExplainerWhat Is a Pig Butchering Scam? How It Works, Explained
A fake online relationship paired with a fake crypto investment, explained step by step using FBI, FTC, and Treasury data, plus red flags and where to report it.
NewsArizona Supreme Court Data Breach: What Happened and Who's Affected
A phishing click exposed Social Security numbers, protective-order files and 150,000+ foster-care records in Arizona's court system. Here's what's known and how to protect yourself.
.jpg)
ComparisonDeleteMe vs Incogni vs Aura: Price and Features Compared
DeleteMe, Incogni, and Aura all scrub your data from broker sites, but pricing, coverage, and who does the removal differ sharply. Here is the breakdown.
NewsCitrix NetScaler CVE-2026-88779: New SAML Zero-Day, Patch Now
A new NetScaler memory-buffer bug tied to SAML authentication is under active exploitation. Citrix patched it in CTX697174; CISA set an October 7 KEV deadline.
ExplainerWhat Is a VPN? How It Works and Whether You Need One
A plain-language guide to what a VPN actually does, how the encrypted tunnel works, and when you do (and don't) need one.
NewsFrontline Education Data Breach: What Happened, Who's Affected
A vulnerability in third-party software let attackers into Frontline Education's systems, exposing school-district employee data. Here's what's known and what to do next.
ComparisonBark vs Qustodio vs Net Nanny: Price and Features Compared
Bark, Qustodio, and Net Nanny take different approaches to screen time, filtering, and monitoring. Here is what each actually costs and covers.
NewsWindows Netlogon RCE (CVE-2026-41089): Is It Exploited? Patch Now
A 9.8 CVSS Netlogon RCE in Windows Server domain controllers, patched in May 2026 — now caught in a dispute between Belgium's CCB and Microsoft over active exploitation.
GuideQR Code Scams Explained: How to Spot and Avoid Quishing
Scammers hide malicious links inside QR codes on parking meters, packages, and texts. Here is how quishing works, the warning signs, and what to do if you scan a bad one.
NewsPentagon Data Breach: What Happened to the DMDC and Who Was Affected
Over 3 million people had personal data exposed when a Pentagon personnel system went unprotected for months. Here is what is confirmed and what is still only reported.
Comparison1Password vs Dashlane: Price, Features and Security Compared
1Password's $2.99-a-month Individual plan undercuts Dashlane's $5.42 Premium tier, but Dashlane bundles a VPN and scam alerts. Here is the full price and security breakdown.
NewsZammad Zero-Day Chain Exploited by AI Agent: Patch Now
An unauthenticated session-fixation RCE and a local root escalation in Zammad combine into full root takeover. CISA's KEV deadline is October 5, 2026.
ExplainerWhat Is a Zero-Day Vulnerability? How It Works and How to Stay Safe
What a zero-day vulnerability, exploit, and attack actually mean, how the CVE disclosure-to-patch cycle works, and the concrete steps that reduce your risk.
NewsAdobe Commerce CVE-2026-71362: Critical Flaw Exploited, Patch Now
A critical incorrect-authorization bug in Adobe Commerce and Magento Open Source is being actively exploited to hijack customer sessions. CISA set a September 27 federal patch deadline.
ComparisonCrowdStrike vs SentinelOne: EDR Price and Features Compared
A buyer-focused comparison of CrowdStrike Falcon and SentinelOne Singularity: published pricing, detection approach, platform coverage and which fits your org size.
NewsFortiMail CVE-2026-104286: Critical Flaw Exploited, Patch Now
CISA confirms active exploitation of a critical, unauthenticated FortiMail path traversal flaw and gives federal agencies until October 4 to patch or mitigate.
ExplainerRansomware Explained: What It Is and How to Stay Safe
What ransomware is, how attacks unfold, whether paying the ransom ever makes sense, and the steps that actually reduce your risk.
NewsKiteworks Patches Dozens of Critical Flaws After Shutdown Scare
Days after warning customers to shut systems down over a federal threat tip, Kiteworks disclosed dozens of new vulnerabilities, including a critical flaw letting attackers hijack admin accounts.
ComparisonSignal vs WhatsApp vs Telegram: Which Is Most Private?
Encryption, metadata, ownership and backups compared head-to-head to find out which of the three messaging apps actually protects your privacy.
NewsCisco Catalyst SD-WAN Manager CVE-2026-76504: Patch Now
CISA confirms active exploitation of a critical, unauthenticated Cisco Catalyst SD-WAN Manager auth-bypass flaw and gives federal agencies until October 3 to patch.
GuideSIM Swap Scams Explained: Warning Signs and How to Protect Yourself
Criminals can hijack your phone number to intercept SMS codes and raid your accounts. Here is how SIM swapping works, the warning signs, and how to lock your number down.
NewsMikroTik Routers Under Active Attack: Patch RouterOS Now
CERT Polska and CISA say attackers are chaining RouterOS flaws to seize control of internet-exposed MikroTik routers without any login credentials.
ComparisonWindows Defender vs Norton vs McAfee: Do You Need Paid Antivirus?
Microsoft's built-in antivirus scores well in independent testing, but Norton 360 and McAfee bundle a VPN, dark web monitoring and identity protection it lacks. Here's what actually differs.
NewsWordPress CVE-2026-87902: Critical RCE Flaw Exploited, Patch Now
WordPress 7.1.2 fixes a critical, unauthenticated path-traversal bug in get_page_template() that attackers began exploiting within hours of disclosure. CISA has ordered federal agencies to patch fast.
ExplainerPhishing Emails Explained: How to Spot Them and What to Do
How to spot a phishing email by its real red flags, the scams impersonating Amazon and Geek Squad right now, and what to do if you clicked or handed over a password.
NewsApple CVE-2026-86950 Zero-Day Exploited: Update iOS, macOS Now
A Core Graphics flaw fixed in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 was used in a targeted attack. Here's what Apple says and what to do.
.webp)
ComparisonLifeLock vs Aura vs Identity Guard: Prices and Features Compared
LifeLock, Aura, and Identity Guard all monitor your identity and credit, but pricing tiers, insurance limits, and family coverage differ sharply. Here's how their official plans compare.
Cisco ISE, Email Gateway Zero-Days Exploited: Patch Now
Two Cisco zero-days—an ISE authentication bypass and a Secure Email Gateway SQL injection—are under active exploitation and listed in CISA's KEV catalog.
GuideHow to Opt Out of Data Brokers and People-Search Sites
Data brokers compile and sell your personal details to anyone who pays. Here's how they get your data, why it matters, and how to opt out for free.
NewsCitrix NetScaler CVE-2026-88771 & 88772 Exploited: Patch Now
Two critical NetScaler ADC and Gateway zero-days are being exploited in the wild. Here is what Citrix's CTX697096 bulletin and CISA's KEV listing say, and how to patch.
ComparisonNorton vs Bitdefender vs McAfee: Prices and Features Compared
A side-by-side look at Norton 360, Bitdefender Total Security, and McAfee Total Protection — pricing, renewal traps, device coverage, and the security extras each one bundles in.
NewsSeptember 2026 Patch Tuesday: Two Windows Zero-Days Under Attack
CISA added two actively exploited Windows privilege-escalation flaws to its KEV catalog the same day Microsoft patched them in September's Patch Tuesday release.
ExplainerWhat Is Have I Been Pwned? How to Check If You've Been Hacked
Have I Been Pwned is a free, legitimate breach-notification service run by security researcher Troy Hunt for checking your email and passwords.
NewsCVE-2026-65660: SharePoint Flaw Under Active Attack, Patch Now
CVE-2026-65660 lets authenticated attackers hijack on-premises SharePoint Server via a ToolPane code-injection bug. CISA confirms active exploitation and sets a September 28 deadline.
GuideHow to Set Up an Authenticator App for Two-Factor Authentication
Text-message codes can be stolen with a SIM swap. Here is how to switch your accounts to an authenticator app, step by step, and avoid getting locked out.
ComparisonExpressVPN vs Surfshark vs Proton VPN: Prices and Features Compared
Surfshark is cheapest upfront, Proton VPN undercuts Surfshark month to month and ExpressVPN renews highest. Every tier compared from the official pricing pages.
NewsIDScan.net Data Breach: Was Your Driver’s License Exposed?
The ID-scanning firm behind countless counter checks says names and license numbers were taken. A seller claimed 153 million records. Here is what to do.
NewsChrome 154 Security Update: 108 Fixes, 11 Critical and How to Update
Chrome 154 fixes 108 security bugs, 11 of them rated Critical. Here is what the Critical fixes cover and how to make sure you are on the patched version.
GuideHow to Set Up Passkeys on iPhone, Android and Windows
Replace passwords with your face, fingerprint or PIN. Step-by-step passkey setup for iPhone, Android, Windows, Google and Microsoft accounts, straight from each company’s own instructions.
ComparisonBitwarden vs 1Password vs Proton Pass: Prices and Features Compared
Official prices, free plans, family plans and security features side by side, so you can pick the password manager that fits your budget and how you share logins.
NewsF5 BIG-IP APM CVE-2026-94127 Exploited: Hotfixes and Mitigation
F5 says a critical heap overflow in BIG-IP APM’s OAuth authorization server is under attack. Here is who is exposed, which hotfix to install and what to look for in logs.
NewsCheck Point CVE-2026-93616 and CVE-2026-85102 Exploited: Patch Now
A management-server zero-day used since July and a VPN bug now hitting Spark firewalls: here are the fixed Jumbo Hotfix takes, the log checks and the September 25 CISA deadline.