Two critical PHP flaws, php2shell, give attackers code execution with no click from anyone. The patch list, quick mitigations and the lure to warn staff about.
Device code phishing steals OAuth tokens instead of passwords. Learn how real Microsoft login pages, dynamic codes, and token persistence bypass familiar defenses, plus how to train employees to stop the handoff.
Recent cyberattacks against municipal water systems show why no single security control can protect an organization. Effective defense requires secure technology, well-designed processes, and a prepared workforce working together.
Passkeys are phishing-resistant at sign-in, but not at enrollment. See how the Pink vishing campaign hijacks Microsoft Entra passkey registration and how to train your team to stop it.
Voice phishing is now a leading breach entry point. Inside the ShinyHunters vishing playbook hitting Salesforce customers and how to defend your help desk.
From the FBI-flagged Kali365 phishing kit to ransomware hidden in "legal documents," here are this week's top social engineering threats and how to stop them.
The Verizon 2026 DBIR confirms that people remain central to breach risk, but attackers are no longer relying on email alone. Security awareness programs need to evolve from annual training and basic phishing tests into continuous, behavior-based human risk management.
Artificial intelligence, human risk, cyber resilience, and post-quantum security dominated discussions at the Gartner Security & Risk Management Summit 2026. Explore key takeaways on agentic AI governance, Shadow AI, spear phishing, security awareness training, and the evolving role of humans in cybersecurity defense.
PhishingBox is heading back to Gartner Security & Risk Management Summit 2026 in National Harbor, Maryland. Visit booth 952 from June 1–3 to meet our team and preview a major new product reveal focused on the future of security awareness, phishing simulation, training, and human risk management.
