Researchers at Outpost24 have published a new analysis on the recent 700Credit breach. This analysis dives into the origin of this breach and the database’s appearance on the darkweb. I covered this news previously here.
Here’s the link to the analysis: https://outpost24.com/blog/700credit-data-breach/
700Credit Data Breach Analysis By Outpost24
Posted in Commentary with tags Outpost24 on December 17, 2025 by itnerdUnderstanding React2Shell: Critical Remote Code Execution in React Server Components and Next.js
Posted in Commentary with tags Outpost24 on December 17, 2025 by itnerdIt is being reported that a ransomware gang is exploiting the critical React2Shell vulnerability (CVE-2025-55182) to gain initial access to corporate networks and deploy the file-encrypting malware less than a minute later.
Outpost24 researchers just recently published an in-depth look at the React2Shell vulnerability, diving into what exactly the vulnerability is, how the exploit works, its exploitation characteristics, as well as practical detection, remediation tips, and risk management implications.
The team commented, “The RSC model is designed to let servers return rendered UI fragments to clients efficiently. Behind this capability is a serialization and deserialization protocol, often called the Flight protocol that encodes component data and function calls for transport between client and server.
The React2Shell vulnerabilities arise because the deserialization logic in the Flight protocol does not validate untrusted data fully. When a server receives a maliciously crafted Request payload, the decoder may incorporate attacker-controlled values into internal objects and execution paths. This missing validation allows an attacker to control execution flow and trigger arbitrary code execution in the server process context.
Since Next.js builds on the same underlying React RSC infrastructure, applications that include RSC support (especially with the App Router) are also affected unless they have been updated to include the patched React implementation.”
For full details, the analysis can be found here: https://outpost24.com/blog/react2shell-cve-2025-55182-react-vulnerability/
New survey shows majority of Canadians and Americans think about data privacy before shopping with a company
Posted in Commentary with tags Telus on December 17, 2025 by itnerdThis holiday season, while shoppers search for the perfect gifts and best deals, they’re also navigating countless requests for their personal information. An email address for the receipt? A phone number for delivery updates? According to the latest TELUS Data Trust Survey, Canadian and American shoppers are increasingly pausing to consider their privacy: What am I getting in return? What are you doing with my data? This shift toward intentional data sharing means retailers must demonstrate clear benefits – convenience, savings, or better service – and respect for customers’ data privacy in order to build the trust required for customers to hand over their information and do business with them.
The survey reveals that 78% of Canadians and 80% of Americans are more likely to buy from companies they trust. In fact, 70% of Canadians and 72% of Americans actively consider respect for their data privacy when deciding whether to trust a company. Yet confidence in organizations remains low. Only 39% of Canadians believe Canadian organizations respect data privacy – and just 19% say the same about American organizations. Americans share similar concerns, with only 37% believing that U.S. organizations respect data privacy and 31% saying they believe Canadian organizations respect data privacy. For the two-thirds of consumers who prioritize data privacy and trust over convenience (66% of Canadians and 71% of Americans), trust has become a deal-breaker.
As shoppers navigate deals and digital offers this season, they’re paying close attention to how companies handle their personal information. Here are some questions they can consider before they buy:
Clarity matters
- Is the privacy policy understandable? 85% of Canadians and 86% of Americans want privacy policies presented in a user-friendly way. Consumers want to clearly understand how a company uses their data.
- Is the company transparent about what it does with customer information? 90% of Canadians and 91% of Americans want to know how their personal information is used. Shoppers should look for companies that spell it out clearly.
Safety first
- How does the company handle security? 89% of Canadians and 90% of Americans want companies actively looking for ways to improve data security. Shoppers should look for companies that talk openly about their data practices.
- What happens if something goes wrong? 91% in both countries want honesty and openness in the event of a data breach. Has the company been transparent about past issues?
Built-in trust
- Does the company have a data ethics program? 86% of Canadians and 87% of Americans say having data ethics experts on the team makes them more willing to trust a company. Companies serious about privacy make it part of their values and operations.
- Is the company committed to responsible AI? 85% of Canadians and 86% of Americans want companies to commit to responsible AI use—especially important as AI becomes commonplace.
- Does the company invest in training its employees? 60% of Canadians and 65% of Americans trust companies that provide data literacy training to their staff more than those that don’t.
Consumers have the power to choose companies that deserve their trust. By asking the right questions about privacy and data practices, shoppers can ensure their personal information is treated with the same respect as their hard-earned money.
Learn about TELUS’ commitment to data and trust by visiting: telus.com/trust.
About the survey
The statistics found in this release are taken from our 2025 AI & Data Trust research study. This study polled 5,487 Canadian members and 6,109 American members of Leger’s online panel from September 2 to 28, 2025. These numbers includes a sample of the population of Canada and America that matches the census in terms of age, gender, and region, with boosts in demographic groups including women, youth (12–18 years old), Indigenous Peoples, Black women, LGBTQ2S+, individuals with disabilities, low-income individuals, seniors, immigrant populations (past five years), and racialized groups historically underrepresented in Canada (e.g., South Asian, Chinese, Black).
Guest Post – Keepit predictions for 2026: From hype-check to hard truths — real protection, real risk, real demand
Posted in Commentary with tags Keepit on December 17, 2025 by itnerdLast year, Keepit predicted that 2025 would be the year SaaS data protection stops being optional and becomes a must-have — as data volume increases, API strain grows, and practical AI solutions start to win over hype.
Now, as we look ahead to 2026, our view sharpens. The growing complexity across cloud, hybrid, compliance and threat landscapes forces us to confront three truths: first, protecting cloud data must become non-negotiable; second, AI should be used deliberately to defend, not just to automate; third, compliance and regulatory pressure are reshaping how and where data lives.
Here are four hard-edged predictions from Keepit’s expert voices — each built on real trends and a clear roadmap, not marketing fluff.
- AI offense evolves faster than defense — unless leaders demand transparency
Kim Larsen, Chief Information Security Officer
AI-driven attacks will become highly adaptive. By 2026, adversaries will use AI systems that map entire infrastructures in seconds, identify weak links deep in the supply chain, and shift tactics in real time to bypass defenses. Hybrid warfare will amplify this trend as hostile actors blend geopolitical intent with AI-enabled automation at scale.
Defenders will match this only if they adopt AI with intention and transparency. Security teams will use AI to understand exposure, strengthen detection, and model where risk concentrates. But success will depend on knowing how an AI system works, what data it relies on, and how decisions are made. CISOs will demand clarity, control, and accountability. The organizations that win will be those that use AI to enhance—not replace—human judgment.
- Hybrid is back—and so is the race for skills
Jakob Østergaard, Chief Technology Officer
Hybrid environments will grow faster than anyone expected. After years of cloud-first narratives, companies are re-evaluating what belongs where. Political instability, rising sovereignty requirements, and cost pressures are pushing critical workloads back on-premise. Servers, storage systems, and licensed software are seeing a resurgence because organizations want balance, not absolutism.
This shift exposes the growing skills gap. Demand for deep technical expertise in networking, Linux, and systems engineering is accelerating while talent inflow is shrinking. By 2026, this shortage will influence everything from innovation speed to resilience planning.
Meanwhile, quantum and AI will face a public reckoning. The promise of crypto-breaking quantum machines and near-term AGI will give way to more realistic timelines. Investments will continue, but the narrative will mature as enterprises look for practical, defensible value rather than speculative breakthroughs.
- AI stays practical in 2026, while modernization remains the real priority
Niels van Ingen, SVP Business Development and Strategy
AI adoption in 2026 will feel familiar. Most enterprises will continue using agentic AI to automate repeatable tasks and augment existing processes, not reinvent them. Only one in 5 organizations report getting meaningful value from their AI tools at the current time with key adoptions challenges being cost and lack of control mechanisms in context of the desired outcomes. Autonomous business intelligence will remain niche because the foundations including infrastructure required are simply not ready: data quality, governance maturity, and organizational skills still lag far behind the ambition.
Modernization efforts will remain the primary focus. Companies will keep working through the practical realities and motions to replace platforms like VMware and Citrix, while using SaaS to accelerate outcomes where it makes sense. At the same time, compliance and regulatory pressure will intensify. Leaders will need a clear understanding of sovereignty requirements, new operating models, and the talent divide between “old way” and “new way” practitioners.
In 2026, CIOs will be planning for what IT must look like in 2030. The problems they solve today will not be the ones they face next and there is a lot of pressure on the IT suite to ensure companies are ready and competitive as the AI transformation gains momentum.
- Compliance goes default: NIS2 and DORA will reshape every SaaS RFP
Jan Ursi, VP Global Channels
By 2026, compliance expectations will become embedded in nearly every SaaS data protection RFP. Requirements tied to NIS2 and DORA will shift from “requested” to “assumed,” especially in finance, energy, healthcare, and the public sector. Organizations will insist on local digital sovereignty: data stored in-region, zero sub-processors, and guaranteed access even if the original SaaS platform is unavailable.
Because many companies are still in the early stages of meeting these regulations, demand will rise sharply as deadlines tighten. Local partners will play an essential role. They understand national sovereignty rules, infrastructure constraints, and the operational realities of regulated industries. As a result, the channel will become a core enabler of compliant SaaS adoption, not an afterthought.
About Keepit
Keepit provides a next-level SaaS data protection platform purpose-built for the cloud. Securing data in a vendor-independent cloud safeguards , boosts cyber resilience, and future-proofs data protection. Unique, separate, and immutable data storage with no sub-processors ensures compliance with local regulations and mitigates the impact of ransomware while guaranteeing continuous data access, business continuity, and fast and effective disaster recovery. Headquartered in Copenhagen with offices and data centers worldwide, over 20,000 companies trust Keepit for its ease of use and effortless backup and recovery of cloud data.
Outpost24 Secures New Investment to Scale its Exposure Management and Identity Security Solutions
Posted in Commentary with tags Outpost24 on December 17, 2025 by itnerdOutpost24 today announced a new investment from Vitruvian Partners to fuel its next phase of global growth. This significant new funding will accelerate innovation across the company’s platform, with a focus on integrating AI capabilities to optimize how security teams identify and neutralize critical vulnerabilities.
The only European vendor recognized as an overall leader in the 2025 KuppingerCole Leadership Compass Report for Attack Surface Management, Outpost24 delivers a distinct approach to cyber defence that empowers security teams to gain a complete understanding of their digital and human risk landscape.
Last week, Outpost24 announced the acquisition of Infinipoint, a specialist in device identity, posture validation, and secure workforce access. The acquisition marks the company’s entry into the Zero Trust Workforce Access market and lays the foundation for its identity security division, Specops, to offer a unified approach that evaluates both the user and the device before access is granted. Through the strategic integration of its solutions — spanning external risk, identity, and device trust — Outpost24 is setting a new standard for cybersecurity. The company’s roadmap is focused on next-generation AI capabilities to catapult businesses forward, enabling them to prioritize the most critical threats and secure their assets.
The recent acquisition followed by today’s funding announcement mark the conclusion of a stellar year for Outpost24. Earlier this year, the company launched CyberFlex, a flexible, next-generation solution that integrates External Attack Surface Management and Penetration Testing as a Service (PTaaS) to help organizations efficiently manage and secure external-facing applications. Built on a pay-as-you-go credit model, CyberFlex embodies the shift toward consumable cybersecurity — giving customers the flexibility to dynamically allocate testing resources, scale coverage, and control costs as their security priorities evolve.
With over two decades of expertise, a strong European foundation, and thousands of customers worldwide, Outpost24 is expertly positioned to help organizations stay ahead of evolving cyber threats. By combining its leading Attack Surface Management platform with Specops’ specialized identity and password security, and the newly added strength of device identity and secure workforce access, Outpost24 delivers a truly comprehensive security picture that moves beyond conventional scanning methods. This empowers security teams to instantly identify, prioritize, and remediate the most critical risks, fundamentally strengthening resilience across both digital and human attack surfaces.
From 2025 to 2026: Identity Security Insights and Priorities
Posted in Commentary with tags Specops on December 17, 2025 by itnerdSpecops Software analysts have published an analysis on the evolution of identity and password security in 2025, and the outlook for 2026.
The piece highlights several major shifts seen over the past year:
- Identity and access management is now being treated as an organization-wide business risk, not just an IT issue
- Third-party access and supply-chain relationships have emerged as one of the most significant identity threat vectors
- Regulatory pressure is increasing around MFA and supplier security, particularly in data-heavy sectors like healthcare
- Passwordless authentication is advancing, but operational realities mean passwords are unlikely to disappear in 2026
- Cybersecurity culture and user training are increasingly critical as AI-driven social engineering accelerates
For full details, please see the analysis here: https://specopssoft.com/blog/identity-security-insights-priorities-2026/
Samsung Serves Up Some Great Deals For The Holidays
Posted in Commentary with tags Samsung on December 17, 2025 by itnerdAs Boxing Week nears, I’m sharing some deals from Samsung that you can shop for before and after the holidays alike. This is a good time to pick up a few favourites at a lower price while they last:
| Model | Offer | Promo Period | Main Features |
| Galaxy Tab S10 Lite | Save $180 | Dec 17 – Jan 8 | S Pen Included256GB Storage (expandable to 2TB)Galaxy AI (Gemini, Circle to Search, Solve Math, Handwriting Help, Object Eraser, Generative Edit) |
| Galaxy Z Flip7 | Save $213 | Dec 17 – Dec 1 | 200MP cameraSlim designExpansive unfolding screenGalaxy AI (Gemini, Circle to Search, Solve Math, Handwriting Help, Object Eraser, Generative Edit) |
| Galaxy Z Fold7 | Save $400 | Dec 17 – Jan 1 | 200MP cameraSlim designExpansive unfolding screenGalaxy AI (Gemini, Circle to Search, Solve Math, Handwriting Help, Object Eraser, Generative Edit) |
| Galaxy S25 Edge | Save $279 | Dec 17 – Jan 1 | 200MP cameraSlim designGalaxy AI (Gemini, Circle to Search, Solve Math, Handwriting Help, Object Eraser, Generative Edit) |
| Galaxy S25 Ultra | Save $269 | Dec 17 – Jan 1 | S Pen included200MP camera100x space zoomLong lasting batteryGalaxy AI (Gemini, Circle to Search, Solve Math, Handwriting Help, Object Eraser, Generative Edit) |
| Galaxy S25+ | Save $239 | Dec 17 – Jan 1 | Snapdragon 8 EliteLong lasting batteryGalaxy AI (Gemini, Circle to Search, Solve Math, Handwriting Help, Object Eraser, Generative Edit) |
| Galaxy S25 | Save $249 | Dec 17 – Jan 1 | 200MP cameraSlim designGalaxy AI (Gemini, Circle to Search, Solve Math, Handwriting Help, Object Eraser, Generative Edit) |
For the full list of current Samsung deals check out Samsung.com/ca.
Nikon Releases New Firmware Update 5.30 for Z 9 Flagship Professional Mirrorless Camera
Posted in Commentary with tags Nikon on December 16, 2025 by itnerdToday, Nikon Canada Inc. is pleased to announce the release of firmware version 5.3 for the full-frame/FX-format flagship mirrorless camera, the Nikon Z 9. This free firmware is now available for download and adds improvements across the board to further enhance the capabilities of Nikon’s top-of-the-line mirrorless camera.
The new firmware adds multiple focus enhancements, starting with a significant improvement in subject acquisition, tracking and stability for fast-moving subjects such as athletes. The advanced subject detection created with Nikon’s deep learning technology now works in other focus modes, making it easier to track the intended subject reliably in either single point or dynamic AF modes. Subject detection can now quickly be toggled on/off using a custom function button, if desired. The firmware also adds a new in-camera focus limiter, which allows the user to restrict the focus range to specific distances.
Improvements have also been made in the Auto Capture function, with a new AF standby position, and other operability and performance updates like face detection. The Z 9 now gives users the ultimate and most intelligent remote camera setup, without the need for any third-party triggering devices. This offers an extreme advantage for those shooting wildlife or professional sports with limited access.
Firmware version 5.3 adds support for Flexible Colour Picture Control that allows users to easily craft their own unique looks using NX Studio, Nikon’s image browsing, processing, and editing desktop software. This new feature offers greater creative freedom by enabling intuitive adjustments to parameters such as colour hue, brightness, and contrast using tools like Colour Blender and Colour Grading. Settings configured in NX Studio can then be saved to a memory card and loaded onto the camera as Custom Picture Controls for shooting.
These settings are reflected in the live view display, allowing users to preview results in real time, reducing the need for post-processing.
Additional Improvements to Operability and Functionality
- Focusing is now possible with the maximum aperture in live view.
- A magnification option of [400%] has been added to [Zoom on/off] available for Custom Settings.
- Use of an external microphone (wired/wireless) is now possible when recording voice memos.
- Extended the dimensions of focus areas available with [Wide-area AF (C1)] and [Wide-area AF (C2)] AF-area modes.
- Added [Flat Monochrome] and [Deep Tone Monochrome] Picture Controls.
- Added [USB streaming (UVC/UAC)] to [USB] in the [NETWORK MENU].
- Changed the specifications for uninterrupted video output to HDMI devices such as external monitors when recording ended.
- The headphone volume level can now be adjusted in the “i” menu during video recording.
Z 9 owners can visit the Nikon download centre to get the new firmware for free. Nikon will continuously meet users’ needs through firmware updates that expand the functionality of its cameras.
New SantaStealer malware steals data from browsers, crypto wallets
Posted in Commentary with tags Hacked on December 16, 2025 by itnerdSanta apparently doesn’t just bring presents. I say that because a new malware-as-a-service information stealer named SantaStealer is being advertised on Telegram and hacker forums as operating in memory to avoid file-based detection.
Commenting on this is Ensar Seker, CISO at SOCRadar:
“SantaStealer is another reminder of how the threat landscape is evolving into a criminal SaaS economy. What’s particularly concerning is the move toward memory-only operations; this significantly lowers the detection footprint, bypassing traditional AV and EDR tools. The pricing tiers and marketing model mimic legitimate software services, further lowering the barrier to entry for cybercriminals. Attribution to a Russian-speaking developer, rebranding from BluelineStealer, and the use of Telegram for distribution all point to an increasingly professionalized cybercrime ecosystem. Organizations should prioritize behavioral monitoring and memory analysis as part of their defense-in-depth strategy.”
This is yet another case of the bad guys evolving faster than the good guys being able to keep up. That’s something that needs to change, and quickly.
Richmond, VA mental health service notifies 113,000+ people of data breach
Posted in Commentary with tags Comparitech on December 17, 2025 by itnerdComparitech has reported that The Richmond Behavioral Health Authority in Virginia has notified 113,232 people of a September 2025 data breach, according to the US Department of Health and Human Services.
Rebecca Moody, Head of Data Research at Comparitech, commented:
“While ransomware attacks have increased by 27 percent this year (rising from 2,865 in 2024 to 3,637 in 2025 to date), US healthcare providers haven’t seen the same influx. In fact, as it stands, it looks as though attacks in 2025 (280 noted so far) will be similar to 2024’s level (294 noted in total). Average ransom demands on this sector have also declined, dropping from $881,500 across the 294 noted in 2024 to $452,900 across the 280 noted so far this year.
Nevertheless, this latest breach notification from Richmond Behavioral Health Authority serves as a reminder that, even though the healthcare sector may be getting a small reprieve from ransomware gangs, the effects of these attacks when they do happen are no less significant. It also highlights how gangs are increasingly focused on data theft as part of their attacks. Qilin alone is responsible for 10 known data breaches following ransomware attacks on US healthcare providers this year with over 409,000 records breached in total.”
Once again, health care is the victim of a ransomware attack. The madness needs to stop with this sector. Though I could copy and paste that for education and government who are equally as vulnerable.
Leave a comment »