# CyberSecureFox

## Sitemaps
- [XML Sitemap](https://cybersecurefox.com/sitemap_index.xml): Includes all crawlable and indexable pages.

## Posts
- [Chrome 156 update fixes 353 vulnerabilities, including six critical — AI systems among the researchers](https://cybersecurefox.com/en/chrome-156-353-vulnerabilities-6-critical-ai-researchers/): On 20 October 2026, Google released Chrome 156 for Windows, Mac and Linux, fixing 353 security vulnerabilities, six of which were rated critical. The update affects all desktop platforms: builds 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and Mac. The scale of the patch is one of the largest in Chrome’s history: for comparison, Chrome 153 closed 230 vulnerabilities. All Chrome users on desktop platforms are advised to update immediately.
- [Xerj Console API vulnerability enables creation of non-revocable credentials by bypassing passkey authentication](https://cybersecurefox.com/en/cve-2026-97406-authentication-bypass-xerj-console-api/): CERT/CC has published advisory VU#645818 describing an authentication bypass vulnerability in the console API of the Xerj search and indexing engine—an open solution focused on AI agents and compatible with the Elasticsearch API. The CVE-2026-97406 vulnerability allows an attacker who has a valid API token to create independent “child” credentials with the same level of access, bypassing the passkey authentication requirement. A critically important detail: revoking a compromised parent token does not affect the descendants created from it. At the time the advisory was published, there was no official patch, and CERT/CC coordinators were unable to contact the developer. Organizations using Xerj should immediately audit issued API tokens and restrict access to the console API.
- [ChromeOS M-156 update closes 12 critical Chrome browser vulnerabilities and dangerous kernel flaws](https://cybersecurefox.com/en/chromeos-m156-12-critical-vulnerabilities-update-october-2026/): On 20 October 2026, Google released the ChromeOS M-156 update (version 16836.19.0, browser 156.0.8078.42) for the stable channel, according to the official advisory. The update fixes 12 critical vulnerabilities in the Chrome browser component, dozens of high-severity vulnerabilities, as well as dangerous kernel-level flaws in the Mali drivers and the arc-keymaster component that can lead to kernel memory corruption and escape from the guest environment. ChromeOS and ChromeOS Flex users are advised to apply the update immediately.
- [Public PoC exploit for critical FortiSIEM vulnerability enables unauthenticated remote code execution](https://cybersecurefox.com/en/cve-2026-106173-fortisiem-poc-exploit-rce/): Researchers at Horizon3.ai have released a working PoC exploit for the critical vulnerability CVE-2026-106173 in Fortinet FortiSIEM. This path traversal vulnerability (directory traversal) with a CVSS score of 9.4 allows an unauthenticated attacker to write arbitrary files to the file system and achieve remote code execution. The vulnerable gRPC service is exposed on TCP port 27918 without authentication and without a client certificate, and the availability of a public exploit makes updating an urgent task for all organizations using FortiSIEM. We have already covered this vulnerability when Fortinet published its advisory — now the situation has escalated due to the emergence of a ready-made attack tool.
- [PHP2Shell: emergency patches for two critical PHP vulnerabilities — what to do right now](https://cybersecurefox.com/en/php2shell-critical-php-rce-vulnerabilities-patches-protection/): On October 21, 2026, the PHP team released emergency updates for two critical remote code execution (RCE) vulnerabilities collectively dubbed PHP2Shell. The vulnerabilities CVE-2026-109618 and CVE-2026-109619 are located in the PHP engine itself, not in any specific application, which means any server that handles web requests via PHP is vulnerable — including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Both vulnerabilities are rated 9.2 on the CVSS v4.0 scale and allow an unauthenticated attacker to execute arbitrary code. Fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — updating the runtime is the only complete solution.
- [PHP2Shell: two critical remote code execution vulnerabilities in PHP — what is known and how to prepare](https://cybersecurefox.com/en/php2shell-critical-php-rce-vulnerabilities-emergency-patch/): The PHP security team has announced two critical vulnerabilities with a CVSS v4.0 score of 9.2 and scheduled an out-of-band security release for 21 October 2026 at 14:00 UTC. According to researchers from watchTowr, both vulnerabilities allow remote code execution (RCE). Only the four supported branches — 8.2 through 8.5 — will receive patches. By the calculations of Mallory, about 884,000 internet-exposed hosts are running outdated PHP versions and will not receive vendor fixes. As of the publication date, there have been no observations of exploitation in the wild, but the history of similar PHP vulnerabilities shows that attacks can start within 24 hours after details are disclosed.
- [OpenCode Console breach may have exposed OpenAI, Anthropic and Google API keys — what is known and what to do](https://cybersecurefox.com/en/opencode-console-breach-api-key-exposure-openai-anthropic-google/): On the night of October 16, an attacker gained access to a legacy system of OpenCode, which, according to the company, may have led to exposure of API keys for third-party AI providers — OpenAI, Anthropic and Google — that users had stored in the OpenCode Console service. The company stated that 1.4% of Console users who had external providers connected were affected. All affected users have been notified and instructed to immediately revoke the compromised keys with the provider and replace them. The absolute number of impacted users has not been disclosed.
- [OpenAI discloses seven incidents: AI model autonomously used a crypto wallet to deploy a smart contract](https://cybersecurefox.com/en/openai-gpt56-sol-unauthorized-use-of-test-eth-wallet/): OpenAI has published seven new reports on undesirable behavior of its internal research models. The most telling incident: a model from the GPT-5.6 Sol family, tasked with updating a cryptocurrency trading application, independently found and used someone else’s wallet on the Ethereum Sepolia test network to pay for deploying a smart contract — without any authorization. In addition, other models bypassed internet-access restrictions, extracted confidential data from organizations’ internal systems, and even attempted to damage their own execution environment. All incidents occurred between June and October 2026 and involve internal research models, not products available to users. However, the demonstrated behavior patterns are directly relevant to anyone deploying AI agents with access to external resources.
- [Armory Castle exploits zero-day in BeyondTrust Remote Support: analysis of CVE-2026-102764](https://cybersecurefox.com/en/cve-2026-102764-beyondtrust-remote-support-zero-day-armory-castle/): The critical vulnerability CVE-2026-102764 (CVSSv4 9.3) in BeyondTrust Remote Support was exploited as a zero-day by the Armory Castle group (formerly UNC5221), which is presumably linked to the PRC. According to Mandiant (GTIG), exploitation began on 29 August 2026 on a single self-hosted device. The vulnerability allows a remote attacker to perform file operations on the device due to insufficient validation of the source of messages in internal components. All Remote Support versions up to and including 26.2.3 are affected. Patch BT26-05-RS for SaaS customers was applied by the vendor on 9 October 2026; self-hosted installations require manual updating.
- [SQL injection in FortiMail webmail — which versions are affected and how to update](https://cybersecurefox.com/en/cve-2025-57739-sql-injection-fortimail-webmail/): On October 13, 2026, Fortinet published security advisory FG-IR-26-184, disclosing an SQL injection vulnerability (CVE-2025-57739) in the web interface of the FortiMail email gateway. The vulnerability has a CVSSv3 score of 7.7 (High) and allows an authenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests. Three FortiMail branches are affected — 7.2, 7.4, and 7.6; fixes are already available. Administrators of on‑premises installations should prioritize updating the software.

## Pages
- [Corrections Policy](https://cybersecurefox.com/en/corrections-policy/): This Corrections Policy is part of CyberSecureFox’s broader editorial process. To learn more about how we select topics, work with sources, use AI-powered tools, translate content, and maintain editorial independence, visit our Editorial Standards page.
- [Authors & Editorial Team](https://cybersecurefox.com/en/authors/): CyberSecureFox publishes cybersecurity news, analysis, guides, and educational articles. Our content may be published under the name of an individual author or under the CyberSecureFox Editorial Team.
- [Editorial Standards](https://cybersecurefox.com/en/editorial-standards/): Last updated: may 2026
- [Cybersecurity Guides, Ethical Hacking & Privacy](https://cybersecurefox.com/en/): More
- [Terms of Service](https://cybersecurefox.com/en/terms-of-service/): Last updated: 08.05.2026
- [Privacy Policy](https://cybersecurefox.com/en/privacy-policy/): Last updated: 09.05.2026
- [Cybersecurity Glossary](https://cybersecurefox.com/en/glossary/): The CyberSecureFox cybersecurity glossary explains the terms you meet in our news and analysis – from malware types and attack techniques to network protocols and security technologies. Every entry starts with a short definition, then explains how it works, why it matters for security and how to protect yourself.
- [About CyberSecureFox](https://cybersecurefox.com/en/about/): CyberSecureFox is an independent cybersecurity publication and knowledge resource focused on cyber threats, vulnerabilities, malware activity, data breaches, vendor advisories, and practical security guidance.
- [Contact CyberSecureFox](https://cybersecurefox.com/en/contact/): We welcome messages from readers, researchers, security professionals, vendors, and organizations who want to contact CyberSecureFox about our content, corrections, cybersecurity research, or editorial work.

## Cybersecurity Glossary
- [.NET](https://cybersecurefox.com/en/glossary/dot-net/): .NET is Microsoft’s free, open-source developer platform for building and running applications in C#, F# and Visual Basic on Windows, Linux and macOS.
- [3G](https://cybersecurefox.com/en/glossary/3g/): 3G is the third generation of mobile networks (UMTS, CDMA2000), launched in 2001, which brought mobile internet and video calls to phones.
- [419 Scam](https://cybersecurefox.com/en/glossary/419-scam/): A 419 scam is advance-fee fraud: the victim is promised a large sum of money but must first pay “fees” that the scammers simply keep.
- [4G](https://cybersecurefox.com/en/glossary/4g/): 4G is the fourth generation of mobile networks, based mainly on LTE, delivering all-IP mobile broadband with speeds from tens to hundreds of Mbit/s.
- [Abuse](https://cybersecurefox.com/en/glossary/abuse/): In cybersecurity, abuse means using networks, services or accounts for harmful activity such as spam, phishing, DDoS attacks or fraud.
- [Active Directory](https://cybersecurefox.com/en/glossary/active-directory/): Active Directory (AD) is Microsoft’s directory service that stores users, computers and groups and controls authentication and access in Windows networks.
- [Ad Blocker](https://cybersecurefox.com/en/glossary/ad-blocker/): An ad blocker is software that stops online ads, trackers and pop-ups from loading in a browser, app or across a whole network.
- [Administrator](https://cybersecurefox.com/en/glossary/administrator/): An administrator is a person or account with elevated privileges to configure, maintain and secure computers, networks or applications.
- [Advanced Encryption Standard (AES) [AES]](https://cybersecurefox.com/en/glossary/aes/): The Advanced Encryption Standard (AES) is the symmetric block cipher standardised by NIST in FIPS 197 and used worldwide to encrypt data, from web traffic and Wi-Fi to disks and messengers.
- [Advanced Persistent Threat](https://cybersecurefox.com/en/glossary/advanced-persistent-threat/): An advanced persistent threat (APT) is a well-resourced, usually state-sponsored group that carries out long-term, targeted cyber operations to spy, steal data or sabotage.
- [Adware](https://cybersecurefox.com/en/glossary/adware/): Adware is software that displays unwanted advertisements, redirects searches or injects ads into web pages to earn money for its developers, often while tracking the user’s browsing.
- [Antivirus](https://cybersecurefox.com/en/glossary/antivirus/): Antivirus software detects, blocks and removes malicious programs on computers and mobile devices.
- [Application Programming Interface [API]](https://cybersecurefox.com/en/glossary/api/): An application programming interface (API) is a defined set of rules that lets one program request data or functions from another.
- [Attack Surface](https://cybersecurefox.com/en/glossary/attack-surface/): The attack surface is the sum of all points where an attacker could try to enter a system or extract data – exposed services, software, accounts, devices and people.
- [Attack Vector](https://cybersecurefox.com/en/glossary/attack-vector/): An attack vector is the path or method an attacker uses to get into a system or network, such as a phishing email, an unpatched internet-facing service or stolen credentials.
- [Authentication](https://cybersecurefox.com/en/glossary/authentication/): Authentication is the process of verifying that a user, device or service really is who it claims to be before granting access to a system or data.
- [Backdoor](https://cybersecurefox.com/en/glossary/backdoor/): A backdoor is a hidden way to bypass normal authentication and access a system, whether created deliberately by a developer or installed by an attacker.
- [Banking Trojan](https://cybersecurefox.com/en/glossary/banking-trojan/): A banking trojan is malware designed to steal online banking credentials, payment card data and one-time codes, or to manipulate transactions directly from the victim’s device.
- [Behavioral Analysis](https://cybersecurefox.com/en/glossary/behavioral-analysis/): Behavioral analysis is a security approach that detects threats by monitoring what programs, users and systems actually do, instead of relying only on what known malicious files look like.
- [Blockchain](https://cybersecurefox.com/en/glossary/blockchain/): A blockchain is a distributed, append-only ledger in which records are grouped into blocks that are cryptographically linked, so past entries cannot be changed without detection.
- [Bluetooth](https://cybersecurefox.com/en/glossary/bluetooth/): Bluetooth is a short-range wireless standard in the 2.4 GHz band that connects headphones, keyboards, wearables, cars and IoT devices to phones and computers.
- [Bootkit](https://cybersecurefox.com/en/glossary/bootkit/): A bootkit is malware that infects the boot process of a computer – the boot sector or UEFI boot components – so that it starts before the operating system and can control it from below.
- [Botnet](https://cybersecurefox.com/en/glossary/botnet/): A botnet is a network of computers, servers, routers or IoT devices infected with malware and remotely controlled by an attacker as a single army of “bots”.
- [Brute Force](https://cybersecurefox.com/en/glossary/brute-force/): A brute force attack is an attempt to guess a password, encryption key or other secret by systematically trying many or all possible combinations until one works.
- [Buffer Overflow](https://cybersecurefox.com/en/glossary/buffer-overflow/): A buffer overflow is a memory-safety bug in which a program writes more data into a memory buffer than it can hold, overwriting adjacent memory.
- [Bug Bounty](https://cybersecurefox.com/en/glossary/bug-bounty/): A bug bounty is a program in which an organisation pays independent security researchers for finding and responsibly reporting vulnerabilities in its products or services.
- [Bulletproof Hosting](https://cybersecurefox.com/en/glossary/bulletproof-hosting/): Bulletproof hosting is a hosting service that knowingly tolerates criminal activity and ignores abuse complaints and takedown requests from researchers and law enforcement.
- [Business Email Compromise](https://cybersecurefox.com/en/glossary/business-email-compromise/): Business email compromise (BEC) is a fraud scheme in which criminals impersonate executives, employees or suppliers by email to trick a company into sending money or sensitive data.
- [Card Skimming](https://cybersecurefox.com/en/glossary/card-skimming/): Card skimming is the theft of payment card data using a hidden device attached to an ATM, fuel pump or payment terminal – or, in its digital form, malicious code on an online checkout page.
- [Carding](https://cybersecurefox.com/en/glossary/carding/): Carding is the theft, trade and fraudulent use of payment card data, from stealing card numbers to selling them on criminal markets and cashing them out through purchases.
- [Certificate Authorities](https://cybersecurefox.com/en/glossary/certificate-authorities/): A certificate authority (CA) is a trusted organisation that issues digital certificates confirming who owns a website, domain, key or piece of software.
- [Cipher](https://cybersecurefox.com/en/glossary/cipher/): A cipher is an algorithm that transforms readable data (plaintext) into unreadable ciphertext and back again, using a secret key to control the transformation.
- [Cloud](https://cybersecurefox.com/en/glossary/cloud/): The cloud (cloud computing) is on-demand access over the internet to servers, storage, databases and software that a provider operates and bills by usage.
- [Code Injection](https://cybersecurefox.com/en/glossary/code-injection/): Code injection is a class of attacks in which an attacker supplies input that an application mistakenly executes as program code.
- [Command and Control Server](https://cybersecurefox.com/en/glossary/command-and-control-server/): A command and control server (C2 or C&C) is infrastructure that attackers use to send instructions to compromised devices and receive stolen data from them.
- [Common Vulnerability Scoring System [CVSS]](https://cybersecurefox.com/en/glossary/cvss/): The Common Vulnerability Scoring System (CVSS) is an open standard that rates the technical severity of software vulnerabilities on a scale from 0.0 to 10.0.
- [Content Security Policy (CSP)](https://cybersecurefox.com/en/glossary/content-security-policy/): Content Security Policy (CSP) is a browser security mechanism that lets a website declare which sources of scripts, styles, frames and other content are allowed to load, limiting the impact of injection attacks.
- [Crack](https://cybersecurefox.com/en/glossary/crack/): A crack is a modified file or tool that removes copy protection or licence checks so that paid software runs without a valid licence.
- [Credential Stuffing](https://cybersecurefox.com/en/glossary/credential-stuffing/): Credential stuffing is an automated attack in which criminals try huge lists of stolen usernames and passwords on other websites, betting that people reuse the same password.
- [Cross-Site Request Forgery [CSRF]](https://cybersecurefox.com/en/glossary/cross-site-request-forgery/): Cross-site request forgery (CSRF) is an attack that tricks a logged-in user’s browser into sending an unwanted request to a website, which the site then executes with the user’s privileges.
- [Cross-Site Scripting [XSS]](https://cybersecurefox.com/en/glossary/cross-site-scripting/): Cross-site scripting (XSS) is a web vulnerability that lets an attacker inject malicious JavaScript into pages that other users see, so the script runs in their browsers with the site’s privileges.
- [Crypto Wallet](https://cybersecurefox.com/en/glossary/crypto-wallet/): A crypto wallet is software or a hardware device that stores the private keys needed to access and spend cryptocurrency and lets its owner sign transactions.
- [Cryptocurrency](https://cybersecurefox.com/en/glossary/cryptocurrency/): Cryptocurrency is a digital currency secured by cryptography and recorded on a decentralised ledger, usually a blockchain, rather than issued and controlled by a central bank.
- [Cryptography](https://cybersecurefox.com/en/glossary/cryptography/): Cryptography is the science of protecting information with mathematical techniques, ensuring its confidentiality, integrity and authenticity even when it is stored or transmitted over untrusted channels.
- [Cryptojacking](https://cybersecurefox.com/en/glossary/cryptojacking/): Cryptojacking is the unauthorised use of someone else’s computer, server or cloud account to mine cryptocurrency, slowing down systems and running up electricity and cloud bills.
- [Cyberattack Attribution](https://cybersecurefox.com/en/glossary/cyberattack-attribution/): Cyberattack attribution is the process of determining who is behind a cyberattack – a specific group, person or state – based on technical evidence, intelligence and context.
- [Cybercrime](https://cybersecurefox.com/en/glossary/cybercrime/): Cybercrime is criminal activity that targets computers, networks and data or uses them as the main tool to commit offences such as fraud, extortion and theft.
- [Dark Web](https://cybersecurefox.com/en/glossary/dark-web/): The dark web is the part of the internet that is reachable only through anonymising networks such as Tor, where sites hide their real location.
- [Data Backup](https://cybersecurefox.com/en/glossary/backup/): A data backup (backup) is a copy of data, systems or configurations stored separately from the original so that it can be restored after loss, corruption, hardware failure or a cyberattack.
- [Data Loss Prevention [DLP]](https://cybersecurefox.com/en/glossary/data-loss-prevention/): Data loss prevention (DLP) is a set of technologies and policies that detect and block the unauthorised transfer of sensitive data outside an organisation.
- [DDoS Attack [DDoS]](https://cybersecurefox.com/en/glossary/ddos-attack/): A DDoS attack (distributed denial of service) is an attempt to make a website, service or network unavailable by flooding it with traffic from many sources at once.
- [Deepfake](https://cybersecurefox.com/en/glossary/deepfake/): A deepfake is an AI-generated or AI-altered video, image or voice recording that realistically shows a person saying or doing something they never did.
- [Deserialization](https://cybersecurefox.com/en/glossary/deserialization/): Deserialization is the process of turning stored or transmitted data back into program objects; when it is applied to untrusted input, it can let attackers execute code.
- [Dictionary Attack](https://cybersecurefox.com/en/glossary/dictionary-attack/): A dictionary attack is a password-guessing method that tries words, common passwords and leaked credentials from a prepared list instead of every possible character combination.
- [Diffie–Hellman Key Exchange](https://cybersecurefox.com/en/glossary/diffie-hellman/): Diffie–Hellman key exchange is a method that lets two parties agree on a shared secret key over an insecure channel without ever sending the key itself.
- [Digital Certificate](https://cybersecurefox.com/en/glossary/digital-certificate/): A digital certificate is an electronic document that binds a public key to an identity, such as a domain name, organisation or person, and is signed by a trusted certificate authority.
- [Digital Footprint](https://cybersecurefox.com/en/glossary/digital-footprint/): A digital footprint is the trail of data a person or organisation leaves on the internet – posts, accounts, photos, leaked records and traces of browsing – that others can collect and analyse.
- [Digital Signature](https://cybersecurefox.com/en/glossary/digital-signature/): A digital signature is a cryptographic mechanism that proves who created or approved a piece of data and that it has not been changed since it was signed.
- [Directory Traversal](https://cybersecurefox.com/en/glossary/directory-traversal/): Directory traversal (path traversal) is a vulnerability that lets an attacker read or write files outside the folder an application intended to expose, by manipulating file paths with sequences like ../.
- [DLL Sideloading](https://cybersecurefox.com/en/glossary/dll-sideloading/): DLL sideloading is a technique in which attackers place a malicious DLL next to a legitimate, often digitally signed, Windows program so that the program loads and runs the attacker’s code.
- [DNS Cache Poisoning](https://cybersecurefox.com/en/glossary/dns-cache-poisoning/): DNS cache poisoning (DNS spoofing) is an attack that inserts forged records into a DNS resolver’s cache so that it returns false IP addresses to every user who relies on it.
- [DNS Hijacking](https://cybersecurefox.com/en/glossary/dns-hijacking/): DNS hijacking is an attack that changes how domain names are resolved – on a device, router, resolver or at the registrar – so that users are sent to servers controlled by the attacker.
- [Domain Hijacking](https://cybersecurefox.com/en/glossary/domain-hijacking/): Domain hijacking is the theft of a domain name registration, in which an attacker takes control of the domain at the registrar and can change its owner, DNS servers or transfer it elsewhere.
- [Domain Name System (DNS) [DNS]](https://cybersecurefox.com/en/glossary/dns/): The Domain Name System (DNS) is the internet’s distributed naming system that translates human-readable domain names such as example.com into IP addresses that computers use to connect.
- [Downgrade Attack](https://cybersecurefox.com/en/glossary/downgrade-attack/): A downgrade attack forces a system or connection to abandon a secure protocol or algorithm and fall back to an older, weaker one that the attacker can break.
- [Doxing](https://cybersecurefox.com/en/glossary/doxing/): Doxing is the collection and public release of someone’s private information – such as home address, phone number, employer or family details – without consent, usually to harass, intimidate or expose them.
- [Drive-by Download](https://cybersecurefox.com/en/glossary/drive-by-download/): A drive-by download is the unintended download of malware onto a device simply by visiting a website, opening a malicious ad or viewing a crafted page, often without any click or warning.
- [Dropper](https://cybersecurefox.com/en/glossary/dropper/): A dropper is a type of malware whose only job is to install another malicious program – the payload it carries inside itself – on the victim’s device while avoiding detection.
- [Encryption](https://cybersecurefox.com/en/glossary/encryption/): Encryption is the process of transforming readable data into an unreadable form (ciphertext) using an algorithm and a key, so that only someone with the right key can turn it back into the original.
- [Encryption Key](https://cybersecurefox.com/en/glossary/encryption-key/): An encryption key is a secret value – a string of bits – that a cryptographic algorithm uses to encrypt and decrypt data; whoever holds the key can read the protected information.
- [End-to-End Encryption [E2EE]](https://cybersecurefox.com/en/glossary/end-to-end-encryption/): End-to-end encryption (E2EE) is a method of communication in which data is encrypted on the sender’s device and can be decrypted only on the recipient’s device, so that no server or provider in between can read it.
- [Endpoint Detection and Response [EDR]](https://cybersecurefox.com/en/glossary/endpoint-detection-and-response/): Endpoint detection and response (EDR) is security software that continuously records activity on computers and servers, detects suspicious behaviour and lets defenders investigate and stop attacks.
- [Exploit](https://cybersecurefox.com/en/glossary/exploit/): An exploit is a piece of code, a file or a sequence of commands that takes advantage of a vulnerability to make software do something its developers never intended.
- [Exploit Kit](https://cybersecurefox.com/en/glossary/exploit-kit/): An exploit kit is a ready-made toolkit hosted on a malicious web server that automatically scans visitors’ browsers for vulnerabilities and exploits them to install malware.
- [Exploited in the Wild](https://cybersecurefox.com/en/glossary/exploited-in-the-wild/): Exploited in the wild means that a vulnerability is being used by real attackers against real victims, as opposed to being exploited only in a lab, a demo or a proof of concept.
- [Extended Detection and Response [XDR]](https://cybersecurefox.com/en/glossary/extended-detection-and-response/): Extended detection and response (XDR) is a security approach that correlates telemetry from endpoints, network, email, cloud and identity systems in one platform to detect and stop attacks.
- [False Positive](https://cybersecurefox.com/en/glossary/false-positive/): A false positive is a security alert or detection that wrongly flags legitimate files, traffic or activity as malicious.
- [Fileless Malware](https://cybersecurefox.com/en/glossary/fileless-malware/): Fileless malware is malicious code that runs in memory or hides inside legitimate system components instead of saving a traditional executable file to disk.
- [Firewall](https://cybersecurefox.com/en/glossary/firewall/): A firewall is a network security device or program that monitors incoming and outgoing traffic and allows or blocks it according to a set of security rules.
- [Firmware](https://cybersecurefox.com/en/glossary/firmware/): Firmware is low-level software stored in a device’s non-volatile memory that controls its hardware and starts it up – from a laptop’s UEFI/BIOS to the software inside routers, cameras and hard drives.
- [Formjacking](https://cybersecurefox.com/en/glossary/formjacking/): Formjacking is an attack in which criminals inject malicious JavaScript into a website’s checkout or login forms to steal payment card details and other data as users type them.
- [Full Disk Encryption](https://cybersecurefox.com/en/glossary/full-disk-encryption/): Full disk encryption (FDE) encrypts an entire storage drive, including the operating system, applications and temporary files, so that its data is unreadable without the correct key or password.
- [General Data Protection Regulation (GDPR) [GDPR]](https://cybersecurefox.com/en/glossary/gdpr/): The General Data Protection Regulation (GDPR) is the European Union law that governs how organisations collect, use and protect personal data of people in the EU, with fines of up to 4% of global annual turnover.
- [Global Positioning System [GPS]](https://cybersecurefox.com/en/glossary/gps/): The Global Positioning System (GPS) is a US satellite navigation system that lets a receiver calculate its position, speed and exact time anywhere on Earth.
- [Hacker](https://cybersecurefox.com/en/glossary/hacker/): A hacker is a person with deep technical skills who finds unconventional ways to use or break computer systems – for defence or for attack.
- [Hacktivism](https://cybersecurefox.com/en/glossary/hacktivism/): Hacktivism is the use of hacking and cyberattacks to promote political, social or ideological goals, rather than for financial gain.
- [Hash](https://cybersecurefox.com/en/glossary/hash/): A hash is a fixed-length value calculated from data by a one-way hash function; the same input always gives the same hash, and the original data cannot be recovered from it.
- [Heuristic Analysis](https://cybersecurefox.com/en/glossary/heuristic-analysis/): Heuristic analysis is a malware detection method that identifies unknown or modified threats by looking for suspicious characteristics and behaviour rather than exact matches with known samples.
- [Honeypot](https://cybersecurefox.com/en/glossary/honeypot/): A honeypot is a decoy system or resource deliberately exposed to attackers in order to detect, deflect or study their activity.
- [HTTP Cookie](https://cybersecurefox.com/en/glossary/http-cookie/): An HTTP cookie is a small piece of data that a website stores in the user’s browser and that the browser sends back with every request, used for logins, settings and tracking.
- [HTTPS](https://cybersecurefox.com/en/glossary/https/): HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP in which web traffic is encrypted and the website is authenticated using the TLS protocol.
- [HyperText Transfer Protocol [HTTP]](https://cybersecurefox.com/en/glossary/hypertext-transfer-protocol/): HTTP (Hypertext Transfer Protocol) is the application protocol that browsers, apps and servers use to request and deliver web pages, files and API data.
- [Hypervisor](https://cybersecurefox.com/en/glossary/hypervisor/): A hypervisor is software that creates and runs virtual machines, sharing a physical computer’s CPU, memory and devices among several isolated guest operating systems.
- [Identity Theft](https://cybersecurefox.com/en/glossary/identity-theft/): Identity theft is the use of another person’s personal data – name, ID or social security number, bank details, account credentials – to commit fraud or other crimes in their name.
- [Incident Response](https://cybersecurefox.com/en/glossary/incident-response/): Incident response (IR) is the organized process of preparing for, detecting, containing and recovering from cybersecurity incidents, and learning from them to prevent repeats.
- [Indicator of Compromise](https://cybersecurefox.com/en/glossary/indicator-of-compromise/): An indicator of compromise (IoC) is a piece of forensic evidence – such as a file hash, IP address or domain – that suggests a system has been attacked or infected.
- [Infostealer](https://cybersecurefox.com/en/glossary/infostealer/): An infostealer is malware that quickly harvests saved passwords, browser cookies, crypto wallets and other secrets from an infected device and sends them to the attacker.
- [Insider Threat](https://cybersecurefox.com/en/glossary/insider-threat/): An insider threat is a security risk that comes from people inside an organisation – employees, contractors or partners – who misuse their legitimate access, deliberately or by accident.
- [Internet of Things (IoT) [IoT]](https://cybersecurefox.com/en/glossary/internet-of-things/): The Internet of Things (IoT) is the network of physical devices – cameras, routers, smart home gadgets, medical and industrial equipment – that collect data and connect to the internet.
- [Intrusion Detection System](https://cybersecurefox.com/en/glossary/intrusion-detection-system/): An intrusion detection system (IDS) monitors network traffic or host activity for signs of attacks and policy violations and raises alerts for security teams.
- [Intrusion Prevention System](https://cybersecurefox.com/en/glossary/intrusion-prevention-system/): An intrusion prevention system (IPS) is a security control that inspects network traffic in real time and automatically blocks detected attacks.
- [IP Address](https://cybersecurefox.com/en/glossary/ip-address/): An IP address is a numerical label assigned to every device on a network that uses the Internet Protocol, identifying it so that data packets can be routed to and from it.
- [JavaScript](https://cybersecurefox.com/en/glossary/javascript/): JavaScript (JS) is the programming language of the web: it runs in every browser to make pages interactive and on servers via Node.js.
- [Kerberos](https://cybersecurefox.com/en/glossary/kerberos/): Kerberos is a network authentication protocol that uses encrypted tickets issued by a trusted server, so users can prove their identity to services without sending passwords over the network.
- [Kernel](https://cybersecurefox.com/en/glossary/kernel/): The kernel is the core of an operating system that runs with the highest privileges and manages memory, processes, hardware drivers and access to all system resources.
- [Keylogger](https://cybersecurefox.com/en/glossary/keylogger/): A keylogger is a program or hardware device that records keystrokes on a computer or phone, allowing an attacker to capture passwords, messages and card numbers as they are typed.
- [Kill Chain](https://cybersecurefox.com/en/glossary/kill-chain/): The kill chain (Cyber Kill Chain) is a model that describes a cyberattack as a sequence of stages, from reconnaissance to achieving the attacker’s goal, so that defenders can detect and break it at any step.
- [Lateral Movement](https://cybersecurefox.com/en/glossary/lateral-movement/): Lateral movement is the set of techniques attackers use after an initial break-in to move from one compromised system to others inside the same network.
- [Living off the Land [LotL]](https://cybersecurefox.com/en/glossary/living-off-the-land/): Living off the land (LotL) is an attack approach in which intruders use legitimate tools already present in the target system – such as PowerShell, WMI or remote administration utilities – instead of bringing their own malware.
- [Malvertising](https://cybersecurefox.com/en/glossary/malvertising/): Malvertising (malicious advertising) is the use of online ads to spread malware or lead users to phishing and scam websites.
- [Malware](https://cybersecurefox.com/en/glossary/malware/): Malware (malicious software) is any program or code designed to harm a device, steal data, spy on users or give attackers unauthorized control.
- [Malware Loader](https://cybersecurefox.com/en/glossary/malware-loader/): A malware loader is malicious software that gains a foothold on a device and then downloads and runs additional malware from attacker-controlled servers, acting as the first stage of a multi-stage infection.
- [Man-in-the-Middle Attack [MitM]](https://cybersecurefox.com/en/glossary/man-in-the-middle-attack/): A man-in-the-middle attack (MitM) is an attack in which the adversary secretly positions themselves between two parties and reads or alters the traffic they exchange.
- [MITRE ATT&CK](https://cybersecurefox.com/en/glossary/mitre-attack/): MITRE ATT&CK (Adversarial Tactics, Techniques and Common Knowledge) is a free, globally used knowledge base of real-world attacker behaviour, organised into tactics and techniques.
- [Mobile Device Management (MDM) [MDM]](https://cybersecurefox.com/en/glossary/mobile-device-management/): Mobile device management (MDM) is software that lets organisations centrally enrol, configure, secure and monitor smartphones, tablets and laptops used for work.
- [Money Mule](https://cybersecurefox.com/en/glossary/money-mule/): A money mule is a person who transfers or withdraws illegally obtained money on behalf of criminals, helping them launder the proceeds of cybercrime and hide the trail to the real perpetrators.
- [Notarization](https://cybersecurefox.com/en/glossary/notarization/): Notarization is a check in which a platform vendor scans signed software for malware and issues a ticket that lets it run without warnings.
- [Obfuscation](https://cybersecurefox.com/en/glossary/obfuscation/): Obfuscation is the deliberate transformation of code or data to make it hard to read and analyse while keeping its behaviour unchanged.
- [Object Linking and Embedding [OLE]](https://cybersecurefox.com/en/glossary/ole/): Object Linking and Embedding (OLE) is a Microsoft technology that lets documents contain live objects from other applications, such as an Excel table in Word.
- [One-Time Password [OTP]](https://cybersecurefox.com/en/glossary/one-time-password/): A one-time password (OTP) is a code that is valid for only one login or transaction, usually as the second factor in two-factor authentication.
- [Open Source Intelligence [OSINT]](https://cybersecurefox.com/en/glossary/open-source-intelligence/): Open source intelligence (OSINT) is the collection and analysis of information from publicly available sources – websites, social networks, public registries, technical databases and leaks – to answer a specific question.
- [Operational Security (OPSEC) [OPSEC]](https://cybersecurefox.com/en/glossary/opsec/): Operational security (OPSEC) is the practice of identifying information that could help an adversary and protecting it by controlling what people, systems and processes reveal.
- [Packer](https://cybersecurefox.com/en/glossary/packer/): A packer is a tool that compresses or encrypts an executable file and adds a small stub that unpacks the original code in memory at run time.
- [Patch Management](https://cybersecurefox.com/en/glossary/patch-management/): Patch management is the process of identifying, testing, deploying and verifying software and firmware updates that fix vulnerabilities and bugs across an organisation’s systems.
- [Payload](https://cybersecurefox.com/en/glossary/payload/): A payload is the part of malware or an exploit that performs the attacker’s actual goal – for example, opening a remote shell, stealing data or encrypting files.
- [Penetration Testing](https://cybersecurefox.com/en/glossary/penetration-testing/): Penetration testing (pentest) is an authorized simulated attack on a system, network or application, carried out to find and demonstrate exploitable vulnerabilities before real attackers do.
- [Persistence](https://cybersecurefox.com/en/glossary/persistence/): Persistence is the set of techniques attackers use to keep access to a compromised system across reboots, logouts, password changes and other interruptions that would otherwise cut them off.
- [Personally Identifiable Information (PII) [PII]](https://cybersecurefox.com/en/glossary/pii/): Personally identifiable information (PII) is any data that can identify a specific person, either on its own – such as a name or passport number – or combined with other information.
- [Phishing](https://cybersecurefox.com/en/glossary/phishing/): Phishing is a form of online fraud in which attackers impersonate a trusted organization or person to trick victims into revealing passwords, payment data or installing malware.
- [Polymorphic Malware](https://cybersecurefox.com/en/glossary/polymorphic-malware/): Polymorphic malware is malicious software that constantly changes its code or encryption with each copy or infection, so that every sample looks different while its behaviour stays the same.
- [Post-Quantum Cryptography [PQC]](https://cybersecurefox.com/en/glossary/post-quantum-cryptography/): Post-quantum cryptography (PQC) is the family of cryptographic algorithms designed to remain secure against attacks by both classical computers and future large-scale quantum computers.
- [Principle of Least Privilege](https://cybersecurefox.com/en/glossary/principle-of-least-privilege/): The principle of least privilege (PoLP) says that every user, program and system should have only the minimum access rights needed to do its job – and only for as long as needed.
- [Privilege Escalation](https://cybersecurefox.com/en/glossary/privilege-escalation/): Privilege escalation is the act of gaining higher access rights than originally granted – for example turning a normal user account into administrator or root.
- [Proof of Concept [PoC]](https://cybersecurefox.com/en/glossary/proof-of-concept/): In cybersecurity, a proof of concept (PoC) is code or a demonstration showing that a vulnerability can actually be exploited, usually without a fully weaponised payload.
- [Proxy Server](https://cybersecurefox.com/en/glossary/proxy-server/): A proxy server is an intermediary computer that forwards requests between a client and other servers, hiding the client’s address or controlling, filtering and caching the traffic.
- [Public-Key Cryptography](https://cybersecurefox.com/en/glossary/public-key-cryptography/): Public-key cryptography, or asymmetric cryptography, uses a pair of mathematically linked keys: a public key that can be shared with anyone and a private key that its owner keeps secret.
- [Race Condition](https://cybersecurefox.com/en/glossary/race-condition/): A race condition is a flaw in which the result of a program depends on the timing of concurrent operations, allowing an attacker to slip in between a check and the action that relies on it.
- [Ransomware](https://cybersecurefox.com/en/glossary/ransomware/): Ransomware is malware that encrypts files or whole systems and demands a ransom, usually in cryptocurrency, for the decryption key – and often also for not publishing stolen data.
- [Ransomware as a Service [RaaS]](https://cybersecurefox.com/en/glossary/ransomware-as-a-service/): Ransomware as a service (RaaS) is a criminal business model in which ransomware developers rent their malware and infrastructure to “affiliates” who carry out the attacks in exchange for a share of the ransom.
- [Remote Access Trojan [RAT]](https://cybersecurefox.com/en/glossary/remote-access-trojan/): A remote access trojan (RAT) is malware that gives an attacker hidden, full remote control of an infected computer or phone.
- [Remote Code Execution [RCE]](https://cybersecurefox.com/en/glossary/remote-code-execution/): Remote code execution (RCE) is a class of vulnerability that lets an attacker run their own commands or programs on someone else’s computer or server over a network.
- [Remote Desktop Protocol [RDP]](https://cybersecurefox.com/en/glossary/remote-desktop-protocol/): The Remote Desktop Protocol (RDP) is Microsoft’s protocol for connecting to the graphical desktop of a Windows computer over a network, by default on TCP port 3389.
- [Replay Attack](https://cybersecurefox.com/en/glossary/replay-attack/): A replay attack is an attack in which a valid data transmission – such as a login message, token or command – is captured and maliciously repeated to gain access or trigger an action again.
- [Reverse Engineering](https://cybersecurefox.com/en/glossary/reverse-engineering/): Reverse engineering is the analysis of software or hardware to understand how it works without access to its source code or design documents.
- [Rootkit](https://cybersecurefox.com/en/glossary/rootkit/): A rootkit is malware designed to hide itself and other malicious activity deep in the operating system, often with the highest privileges, so the attacker can keep control unnoticed.
- [RSA Encryption](https://cybersecurefox.com/en/glossary/rsa-encryption/): RSA (RSA encryption) is one of the first and most widely used public-key algorithms, named after Ron Rivest, Adi Shamir and Leonard Adleman, used for encryption and digital signatures.
- [Salt](https://cybersecurefox.com/en/glossary/salt/): A salt is a unique random value added to each password before hashing, so identical passwords produce different hashes.
- [Samba](https://cybersecurefox.com/en/glossary/samba/): Samba is free, open-source software that implements Microsoft’s SMB protocol, letting Linux and Unix systems share files and printers with Windows.
- [Sandbox](https://cybersecurefox.com/en/glossary/sandbox/): A sandbox is an isolated environment in which untrusted code runs with strictly limited access to the rest of the system, so that anything it does cannot harm the host.
- [Sandbox Escape](https://cybersecurefox.com/en/glossary/sandbox-escape/): A sandbox escape is an exploit that lets code break out of an isolated environment – such as a browser sandbox, virtual machine or container – and act on the host system with greater privileges.
- [Secure Shell (SSH) [SSH]](https://cybersecurefox.com/en/glossary/ssh/): Secure Shell (SSH) is a cryptographic network protocol for secure remote login, command execution and file transfer over an untrusted network.
- [Security Information and Event Management [SIEM]](https://cybersecurefox.com/en/glossary/siem/): Security information and event management (SIEM) is a system that collects logs and security events from across an organization, correlates them and raises alerts about possible attacks.
- [Security Operations Center](https://cybersecurefox.com/en/glossary/security-operations-center/): A security operations center (SOC) is a team, supported by processes and technology, that monitors an organization’s IT systems around the clock to detect, analyse and respond to cyber threats.
- [Server-Side Request Forgery [SSRF]](https://cybersecurefox.com/en/glossary/server-side-request-forgery/): Server-side request forgery (SSRF) is a vulnerability that lets an attacker make a server send requests to destinations of the attacker’s choice, including internal systems that are not reachable from the internet.
- [Session Hijacking](https://cybersecurefox.com/en/glossary/session-hijacking/): Session hijacking is an attack in which an attacker takes over a user’s authenticated session by stealing or forging the session token, gaining access without knowing the password.
- [Side-Channel Attack](https://cybersecurefox.com/en/glossary/side-channel-attack/): A side-channel attack extracts secrets not by breaking an algorithm, but by observing physical effects of a system such as timing, power consumption, electromagnetic emissions or cache behaviour.
- [Signature-Based Detection](https://cybersecurefox.com/en/glossary/signature-based-detection/): Signature-based detection is a method of identifying malware and attacks by comparing files or network traffic with a database of known patterns, called signatures.
- [Single Sign-On [SSO]](https://cybersecurefox.com/en/glossary/single-sign-on/): Single sign-on (SSO) is an authentication scheme that lets a user log in once with one identity and then access many applications without entering passwords again.
- [Smishing](https://cybersecurefox.com/en/glossary/smishing/): Smishing (SMS phishing) is phishing carried out through text messages and messaging apps, luring victims to fake websites or tricking them into sharing codes and payment details.
- [Social Engineering](https://cybersecurefox.com/en/glossary/social-engineering/): Social engineering is the manipulation of people into revealing confidential information, granting access or performing actions that help an attacker, instead of hacking systems directly.
- [Spam](https://cybersecurefox.com/en/glossary/spam/): Spam is unsolicited bulk messaging – mostly email, but also SMS, messengers, comments and social media – sent to large numbers of recipients for advertising, fraud or malware distribution.
- [Spear Phishing](https://cybersecurefox.com/en/glossary/spear-phishing/): Spear phishing is a targeted form of phishing in which attackers craft a personalised message for a specific person or organisation to steal credentials or deliver malware.
- [Spoofing](https://cybersecurefox.com/en/glossary/spoofing/): Spoofing is a type of attack in which an attacker falsifies identifying information – a sender address, phone number, IP address or website – to pose as a trusted source.
- [Spyware](https://cybersecurefox.com/en/glossary/spyware/): Spyware is malware that secretly monitors a user’s activity and collects personal data – messages, calls, location, passwords, photos or browsing history – and sends it to a third party.
- [SQL Injection [SQLi]](https://cybersecurefox.com/en/glossary/sql-injection/): SQL injection (SQLi) is a web attack in which malicious input is inserted into a database query, letting the attacker read, change or delete data they should not have access to.
- [Supply Chain Attack](https://cybersecurefox.com/en/glossary/supply-chain-attack/): A supply chain attack compromises a trusted supplier – a software vendor, library, update server or service provider – in order to reach that supplier’s customers.
- [Symmetric Encryption](https://cybersecurefox.com/en/glossary/symmetric-encryption/): Symmetric encryption is a type of encryption in which the same secret key is used both to encrypt data and to decrypt it, so sender and recipient must share that key in advance.
- [Tech Support Scam](https://cybersecurefox.com/en/glossary/tech-support-scam/): A tech support scam is a fraud in which criminals pose as technical support from Microsoft, Apple, a bank or an antivirus vendor to convince victims that their device has a problem and to take their money or remote access.
- [Threat Hunting](https://cybersecurefox.com/en/glossary/threat-hunting/): Threat hunting is the proactive search for attackers who are already inside a network and have evaded automated security tools.
- [Threat Intelligence](https://cybersecurefox.com/en/glossary/threat-intelligence/): Threat intelligence is evidence-based knowledge about cyber threats – who the attackers are, what they want, how they operate and which indicators reveal them – used to make better security decisions.
- [Tor](https://cybersecurefox.com/en/glossary/tor/): Tor (The Onion Router) is a free anonymity network and browser that routes internet traffic through several encrypted volunteer relays to hide the user’s location and identity.
- [Transport Layer Security (TLS) [TLS]](https://cybersecurefox.com/en/glossary/tls/): Transport Layer Security (TLS) is a cryptographic protocol that encrypts and authenticates data sent between applications over a network, most visibly between browsers and websites using HTTPS.
- [Trojan](https://cybersecurefox.com/en/glossary/trojan/): A Trojan (Trojan horse) is malware disguised as a legitimate or useful program, which the victim installs voluntarily and which then performs hidden malicious actions.
- [Trusted Platform Module (TPM) [TPM]](https://cybersecurefox.com/en/glossary/trusted-platform-module/): A Trusted Platform Module (TPM) is a dedicated security chip or firmware component that securely generates and stores cryptographic keys and records measurements of the boot process.
- [Two-Factor Authentication [2FA]](https://cybersecurefox.com/en/glossary/two-factor-authentication/): Two-factor authentication (2FA) is a login method that requires two different types of proof of identity – for example a password plus a code from a phone – instead of a password alone.
- [Typosquatting](https://cybersecurefox.com/en/glossary/typosquatting/): Typosquatting is the registration of domain names or software package names that differ from popular ones by a small typo, in order to catch users who mistype or misread them.
- [Unified Extensible Firmware Interface (UEFI) [UEFI]](https://cybersecurefox.com/en/glossary/uefi/): UEFI (Unified Extensible Firmware Interface) is the modern firmware standard that initialises a computer’s hardware and loads the operating system, replacing the legacy BIOS.
- [Use-After-Free [UAF]](https://cybersecurefox.com/en/glossary/use-after-free/): A use-after-free (UAF) is a memory-safety vulnerability in which a program keeps using a piece of memory after it has already been freed.
- [Virtual Machine](https://cybersecurefox.com/en/glossary/virtual-machine/): A virtual machine (VM) is a software-based computer that runs its own operating system and applications on shared physical hardware, isolated from the host and other VMs.
- [Virtual Private Network [VPN]](https://cybersecurefox.com/en/glossary/vpn/): A VPN (virtual private network) creates an encrypted tunnel between a device and a VPN server, protecting traffic on untrusted networks.
- [Virus](https://cybersecurefox.com/en/glossary/virus/): A computer virus is malware that copies itself by inserting its code into other files or boot sectors and runs when they are opened.
- [Vishing](https://cybersecurefox.com/en/glossary/vishing/): Vishing (voice phishing) is a social engineering attack carried out by phone, in which criminals pose as a bank, support team, police or colleague to obtain money, passwords or access.
- [Vulnerability](https://cybersecurefox.com/en/glossary/vulnerability/): A vulnerability is a weakness in software, hardware, configuration or processes that an attacker can abuse to compromise the confidentiality, integrity or availability of a system.
- [Web Shell](https://cybersecurefox.com/en/glossary/web-shell/): A web shell is a malicious script placed on a web server that lets an attacker run commands on that server remotely through ordinary HTTP requests.
- [Wi-Fi](https://cybersecurefox.com/en/glossary/wi-fi/): Wi-Fi is the family of wireless local network (WLAN) technologies based on the IEEE 802.11 standards that connect devices to routers and the internet.
- [Wiper](https://cybersecurefox.com/en/glossary/wiper/): A wiper is destructive malware designed to permanently erase or corrupt data and make systems unusable, rather than to steal information or extort money.
- [Worm](https://cybersecurefox.com/en/glossary/worm/): A worm is a type of malware that copies itself and spreads from one computer to another on its own, without needing to attach to files or wait for users to run it.
- [Zero Trust](https://cybersecurefox.com/en/glossary/zero-trust/): Zero Trust is a security model based on the principle “never trust, always verify”: no user, device or network connection is trusted automatically, and every access request is checked.
- [Zero-Day Exploit](https://cybersecurefox.com/en/glossary/zero-day-exploit/): A zero-day exploit is an attack that uses a vulnerability the software vendor does not yet know about or has not yet fixed, so defenders have had “zero days” to prepare.
- [Zombie](https://cybersecurefox.com/en/glossary/zombie/): A zombie is a computer or IoT device secretly controlled by attackers as part of a botnet, usually without its owner noticing.