Cybersecurity writing, courses, and a weekly roundup of what actually mattered.https://threatnotes.org/enhttps://threatnotes.org/news/2026-07-20/https://threatnotes.org/news/2026-07-20/Two browser extensions, a car alarm fitted at the dealership, and WordPress core itself. Almost nothing that went wrong this week came from outside — it came from things that were already installed and already trusted.Tue, 28 Jul 2026 00:00:00 GMTweeklybrowser-extensionscredential-stuffingransomwarewordpresshttps://threatnotes.org/posts/anatomy-of-a-credential-stuffing-attack/https://threatnotes.org/posts/anatomy-of-a-credential-stuffing-attack/Credential stuffing is not brute force. Understanding the difference is what makes it detectable — and what makes most rate limits useless against it.Tue, 21 Jul 2026 00:00:00 GMTcredential-stuffingauthenticationdetectionhttps://threatnotes.org/posts/reading-your-first-wireshark-capture/https://threatnotes.org/posts/reading-your-first-wireshark-capture/Opening a pcap for the first time is overwhelming by design — it shows you everything. Here is the small set of filters and habits that turn noise into a narrative.Tue, 14 Jul 2026 00:00:00 GMTnetworkwiresharkfundamentalshttps://threatnotes.org/posts/why-mfa-fatigue-attacks-work/https://threatnotes.org/posts/why-mfa-fatigue-attacks-work/The failure is not that users are careless. It is that push approval asks a question the user has no way to answer correctly — and asks it dozens of times until they slip.Tue, 07 Jul 2026 00:00:00 GMTmfaauthenticationsocial-engineeringhttps://threatnotes.org/posts/social-engineering-isnt-just-email/https://threatnotes.org/posts/social-engineering-isnt-just-email/We spent a decade teaching everyone to be suspicious of their inbox. Attackers responded by picking up the phone — where nobody is watching, nobody was trained, and being helpful is literally in the job description.Mon, 09 Feb 2026 00:00:00 GMTsocial-engineeringhuman-factorshttps://threatnotes.org/posts/public-wifi-whats-actually-at-risk/https://threatnotes.org/posts/public-wifi-whats-actually-at-risk/The scary version of this advice is fifteen years out of date. Here is what someone on the café network can genuinely do to you in 2026 — and the two things that still go badly wrong, neither of which encryption can save you from.Mon, 02 Feb 2026 00:00:00 GMTwifinetwork-securityhttps://threatnotes.org/posts/the-lock-icon-doesnt-mean-safe/https://threatnotes.org/posts/the-lock-icon-doesnt-mean-safe/The padlock is an armoured van. It guarantees nobody read your letter on the way — and has no opinion whatsoever about whether the person you posted it to is a con artist.Mon, 26 Jan 2026 00:00:00 GMThttpstlsweb-basicshttps://threatnotes.org/posts/what-mfa-actually-protects-you-against/https://threatnotes.org/posts/what-mfa-actually-protects-you-against/MFA is either “a magic switch that ends hacking” or “already broken, why bother”, depending on who you ask. Both are wrong. Here is the honest version — what it kills stone dead, what walks straight past it, and which kind to actually turn on.Mon, 19 Jan 2026 00:00:00 GMTmfaauthenticationhttps://threatnotes.org/posts/anatomy-of-a-phishing-email/https://threatnotes.org/posts/anatomy-of-a-phishing-email/Stop trying to sense whether an email “feels off”. A phishing message has five jobs it must do to work, and every one of them leaves a mark you can check in about eight seconds.Mon, 12 Jan 2026 00:00:00 GMTphishingsocial-engineeringemail-securityhttps://threatnotes.org/posts/why-your-password-isnt-the-problem/https://threatnotes.org/posts/why-your-password-isnt-the-problem/You have been trained to worry about whether your password is strong enough. Almost nobody is attacked that way. Here is the thing that actually loses people their accounts — explained with a shed, a locksmith, and some uncomfortable arithmetic.Mon, 05 Jan 2026 00:00:00 GMTpasswordscredential-reusebasics