Skip to content
Oluma Cyber Security Awareness
Join Us
Cyber Newsroom

News, alerts, vulns & breach files.

The cyber world moves daily — new breaches, new threats, new lessons. This is your briefing room: the news the pros read, the official alerts worth acting on, the vulnerabilities being exploited right now, plain-language articles, and the landmark breaches every defender should know.

Start your briefing →Study the breach files
8
Curated sections
30+
Trusted sources
6
Breach case files
24/7
Threat landscape
Jump to a section
Daily reading

Where the pros get their news.

Skip the hype. These are the outlets security professionals check every morning — bookmark a few, and fifteen minutes a day will keep you sharper than most of the industry.

All links open the official source in a new tab

🔎InvestigativeKrebs on Securitykrebsonsecurity.com · Brian KrebsDeep investigative journalism on cybercrime — the reporter who breaks breach stories before companies announce them. Long-form, meticulous, essential.CybercrimeBreach scoopsFraudIndependentVisit → 💻PracticalBleepingComputerbleepingcomputer.comFast, accurate reporting on ransomware gangs, malware campaigns and vulnerabilities, with practical detail. The best first read when something breaks.RansomwareMalwareHow-tosDaily coverageVisit → 📰High volumeThe Hacker Newsthehackernews.comConcise, high-frequency coverage of vulnerabilities, exploits and threat research — ideal for scanning headlines fast and catching what matters today.VulnsExploitsQuick readsHeadline scannerVisit → 🌑AnalysisDark Readingdarkreading.comAnalysis and commentary written for practitioners — strategy, threat intelligence and industry trends. Where the ‘why it matters’ gets explained.AnalysisStrategyCISO viewsPractitioner lensVisit → 🗞IndustrySecurityWeeksecurityweek.comBusiness-side security news — funding, M&A, enterprise risk and policy. Perfect for GRC pros who need the industry picture, not just the exploits.EnterprisePolicyBusiness riskIndustry watchVisit → 🎤Deep reportingThe Recordtherecord.media · Recorded FutureIn-depth reporting on cybercrime, nation-state activity and policy from a newsroom backed by threat intel — plus the excellent Click Here podcast.Nation-statePolicyPodcastBacked by intelVisit →
Act on these

Official alerts worth your attention.

News tells you what happened; alerts tell you what to do. These are the authoritative feeds that warn about active threats and exploited flaws — the ones worth wiring into your routine.

Government & vendor sources — subscribe by email where offered

🏛OfficialFreeCISA Advisoriescisa.gov · US GovernmentThe US government’s official alerts on active threats, exploited flaws and industrial-control issues. When CISA publishes, act on it.AdvisoriesICSCampaignsAuthoritativeVisit → 🛡OfficialUK NCSCncsc.gov.uk · UK GovernmentBritain’s national cyber authority — clear alerts, guidance and threat reports that are useful worldwide, not just in the UK.AlertsGuidanceReportsNational CERTVisit → 🏢OfficialENISA (EU)enisa.europa.eu · EU AgencyThe European Union’s cybersecurity agency — annual threat-landscape reports and coordinated advisories across the EU.EUThreat landscapePolicyEU authorityVisit → 📡DailySANS Internet Storm Centerisc.sans.eduA volunteer early-warning service posting daily diaries on emerging attacks and strange traffic — the internet’s neighborhood watch.Daily diaryEarly warningStormCastCommunity watchVisit → 🟩VendorMicrosoft MSRCmsrc.microsoft.comMicrosoft’s Security Update Guide and advisories — essential on the second Tuesday of every month and whenever a major Microsoft flaw drops.Patch TuesdayCVEsGuidanceVendor PSIRTVisit → 🛰Threat intelCisco Talosblog.talosintelligence.comOne of the largest commercial threat-intel teams — timely research and alerts on new malware, exploited CVEs and active campaigns.ResearchIOCsMalwareIntel teamVisit →
Track the flaws

Vulnerabilities, decoded.

Most breaches exploit known bugs that already had a fix. These are the databases defenders use to find, rate and prioritize vulnerabilities — starting with the ones under active attack.

Tip: start at the KEV catalog, then confirm severity on the NVD

🚨Must-patchCISA KEV Catalogcisa.gov/kevThe definitive list of vulnerabilities attackers are actively exploiting. If it’s on the KEV, patch it before anything else — US agencies are legally required to.Actively exploitedDeadlinesPriorityPatch firstVisit → 📊OfficialNVDnvd.nist.gov · NISTThe US National Vulnerability Database — CVSS severity scores, affected products and references for virtually every disclosed flaw.CVSSCPEReferencesSeverity sourceVisit → 🔖CanonicalCVE Programcve.org · MITREThe master catalogue that assigns every vulnerability its unique CVE ID — the shared language the whole industry speaks.CVE IDsCanonicalGlobalNaming authorityVisit → 💣ExploitsExploit-DBexploit-db.com · OffSecAn archive of public exploit code tied to known vulnerabilities — how defenders gauge whether a flaw is truly weaponized.ExploitsPoCsResearchExploit archiveVisit → 🐙Dev-focusedGitHub Advisory DBgithub.com/advisoriesVulnerabilities in the open-source packages you actually use — mapped to npm, PyPI, Maven and more. The core of supply-chain defense.Open sourceDependenciesEcosystemsSupply chainVisit → 📈PrioritizeFIRST EPSSfirst.org/epssThe Exploit Prediction Scoring System estimates the probability a vulnerability will be exploited — so you can patch what’s likely, not just what’s severe.ProbabilityTriageData-drivenSmart triageVisit →
Learn the why

Articles & explainers.

Headlines fade; understanding sticks. This is curated reading that explains how attacks work and what the standards mean — starting with Oluma’s own beginner-first articles.

⭐OlumaBeginner-firstOluma Articlesolumadigital.comOur own plain-language articles that translate cyber news, careers and concepts for people just starting out — no jargon walls, no paywalls, ever.ExplainersCareersAwarenessMade for youRead → 🛑Gov guideCISA StopRansomwarecisa.gov/stopransomwareThe US government’s one-stop hub of plain guidance on preventing and responding to ransomware — genuinely readable, and free.RansomwareGuidanceChecklistsPracticalRead → 🛡OpenOWASPowasp.orgThe open community behind the famous Top 10 web risks — the go-to explainers for how application attacks actually work.Top 10AppSecCheat sheetsCommunityRead → 📚StandardsNIST CSRCcsrc.nist.govWhere the frameworks live — the CSF, SP 800-53 and more, straight from the source, with readable summaries and quick-start guides.CSF800-53FrameworksThe standardsRead → 📄Deep diveSANS White Paperssans.orgA huge free library of practitioner white papers on nearly every security topic — great when you want depth beyond a news article.WhitepapersResearchFreeGo deeperRead → 🔬ResearchGoogle Project Zerogoogleprojectzero.blogspot.comGoogle’s elite bug-hunting team publishes deep technical breakdowns of real zero-days — advanced, but the best window into top-tier research.Zero-daysDeep techResearchAdvancedRead →
Threat watch

Know what’s hunting.

Behind almost every headline is one of these six threats. Learn how each works and you’ll understand most of the news — and every incident report you’ll read on the job.

🔒CriticalRansomwareEncrypt · Extort · RepeatSeverity 5/5Attackers encrypt your systems, steal your data, and demand payment twice — once for the keys, once to not leak it. Now a service industry with affiliates and help desks.Double extortionRaaSBackups save you
🎣#1 VectorPhishing & Social EngineeringHacking humans, not machinesSeverity 5/5Still the most common way attackers get in — fake emails, texts, calls and now AI-generated voices. Nearly every mega-breach starts with one person being tricked.BECSmishingDeepfakes
🔗RisingSupply Chain AttacksHack one, breach thousandsSeverity 4/5Instead of attacking you, adversaries compromise the software or vendors you trust — one poisoned update flows downstream to every customer. Why vendor risk is now a career.Vendor riskSBOMTPRM
💥Headline makerZero-Days & Unpatched VulnsThe race between patch and exploitSeverity 4/5A zero-day is a flaw with no fix yet — but most breaches exploit vulnerabilities that had patches available for months. Vulnerability management is unglamorous and priceless.CVEsKEV listPatch mgmt
🕵Hardest to seeInsider ThreatsThe danger with a badgeSeverity 3/5Malicious employees, careless clicks, or compromised accounts — insiders already have access, making them the hardest threat to detect. Least privilege exists because of this.Least privilegeUEBAOffboarding
🌊DisruptiveDDoS AttacksDrowning services in trafficSeverity 3/5Botnets flood a target with junk traffic until real users can’t get through. Cheap to launch, and increasingly used as cover for quieter intrusions happening at the same time.BotnetsAvailabilityCDN defense
The breach files

History’s most expensive lessons.

Every landmark breach is a free masterclass. Study these six and you’ll recognize their patterns in every incident that makes the news — and in every interview question about ‘lessons learned.’

Figures like victim counts are as reported publicly — verify the latest numbers at the sources above

2013🎯Target40M cards · via an HVAC vendorAttackers entered through a heating contractor’s stolen credentials and pivoted to point-of-sale systems. The lesson: your vendors’ security is your security — the breach that made third-party risk a discipline.Vendor accessSegmentationTPRM born
2017🏦Equifax147M people · one unpatched serverA known Apache Struts flaw sat unpatched for months while attackers quietly harvested nearly half of America’s credit files. The lesson: patch-management failures become congressional hearings.Patch mgmtAsset inventoryAccountability
2020🌪SolarWinds18,000 orgs · one poisoned updateNation-state attackers slipped malicious code into a trusted software update, reaching US agencies and Fortune 500s alike. The lesson: the supply chain is the battlefield — verify what you trust.Supply chainNation-stateSBOM push
2021⛽Colonial PipelineUS fuel supply · one old VPN passwordA single compromised VPN account without MFA shut down the largest fuel pipeline in America and triggered gas panic across the East Coast. The lesson: MFA on remote access is non-negotiable.MFAOT impactRansomware
2023📦MOVEit2,700+ orgs · one file-transfer flawA zero-day in a single file-transfer product cascaded into thousands of downstream victims — universities, agencies, pension funds. The lesson: know every product in your stack and who else it touches.Zero-dayMass exploitationCl0p
2024🏥Change HealthcareUS healthcare · $2B+ in falloutRansomware on a single processor froze pharmacy claims and payments nationwide for weeks — again traced to remote access lacking MFA. The lesson: concentration risk is real; critical services need depth.HealthcareResilienceSingle point
Build the habit

Stay current — podcasts & newsletters.

Websites are great; a routine is better. Pick one podcast for the commute and one newsletter for the inbox, and staying informed stops being a chore.

🎧PodcastDarknet Diariesdarknetdiaries.com · Jack RhysiderGripping, true-story episodes about hacks, breaches and cybercrime — the show that’s turned countless beginners into cyber careers. Start here.StorytellingBeginner-lovedTrue crimeStart hereListen → 😁PodcastSmashing Securitysmashingsecurity.comA funny, accessible weekly take on security news — proof that staying informed doesn’t have to be dry.WeeklyFunnyNewsEasy listeningListen → 🎤Podcast + newsRisky Businessrisky.bizThe industry’s favorite news podcast and newsletter — sharp analysis of the week’s biggest stories for people who work in the field.AnalysisWeeklyPro-levelIndustry stapleListen → ✉Newslettertl;dr sectldrsec.comA free weekly newsletter summarizing the best security tools, talks and posts — a huge time-saver for busy defenders.WeeklyCuratedToolsInbox briefSubscribe → ⏱Daily podcastSANS StormCastisc.sans.edu/podcast.htmlA ~5-minute daily podcast covering the latest threats and vulnerabilities — the fastest way to start your day informed.Daily5 minutesThreatsQuick dailyListen → 📬Free alertsCISA Subscriptionscisa.govHave official US government alerts and advisories delivered straight to your inbox — free, and straight from the source.Email alertsOfficialFreeGet alertsSubscribe →
If it happens to you

Report & respond.

Been targeted, scammed or breached? You’re not alone, and acting fast helps. Here’s where to report cybercrime and check your exposure — there’s no shame in it, only smart next steps.

In immediate danger or losing money now? Contact your bank and local police first. Reporting differs by country — search ‘[your country] report cybercrime’

👮Report · USFBI IC3ic3.govThe FBI’s Internet Crime Complaint Center — where to report online fraud, scams and cybercrime in the United States.FraudCybercrimeUSFile a reportReport → 🛒Report · USFTC Report Fraudreportfraud.ftc.govReport scams, dodgy businesses and identity theft to the US Federal Trade Commission — and get personalized recovery steps.ScamsID theftRecoveryGet stepsReport → 🏛Report · USCISA Reportcisa.gov/reportReport a cyber incident, vulnerability or phishing to the US cyber agency — especially important for organizations and critical infrastructure.IncidentsPhishingOrgsNotify CISAReport → 🛡Report · UKUK Action Fraudactionfraud.police.ukThe UK’s national reporting center for fraud and cybercrime — report online or by phone, around the clock.FraudUK24/7UK reportingReport → 🔓CheckHave I Been Pwnedhaveibeenpwned.comCaught in a breach? Check which of your accounts were exposed, then change those passwords and turn on MFA right away.Breach checkPasswordsMFACheck nowCheck → 🧰OlumaOluma Free Toolkitolumadigital.comNot sure if a link, file or site is safe? Our free toolkit gathers the tools that let you check before you click — no expertise needed.Scan linksCheck filesFreeOpen toolkitOpen →
Turn news into knowledge

Don’t just read the headlines — understand them.

Every breach above maps to a framework, a control, and a career. Learn the fundamentals in our Learning Hub, decode the standards in the Framework Files, and test yourself until threat reports read like plain English.

Start learning →Take the quiz