Sequretek

26/10/2026

Police just arrested 1,462 cybercriminals.

Good news 🌍 INTERPOL's Operation Serengeti III across Africa led to 1,462 arrests. 10,909 malicious networks were taken down. Coordinated enforcement is hitting criminal infrastructure, not just individuals. Source: https://thelaymansecurity.com/cybersecurity-news-this-week-2026-10-25/

Bad news ⚠ Capcom confirmed unauthorised access to more than 11.7 million CAPCOM ID accounts worldwide. The company is warning users about phishing. Credit card details are said to remain safe. Source: https://www.dbdigest.com/2026/10/data-breaches-digest-week-43-2026.html

What this means 🔐 Turn on MFA everywhere it is offered. One unique password per service. Treat surprise login or recovery emails as suspicious. Monitor for credential abuse and rotate exposed credentials.

Could your team spot a phishing email built on a real breach? 👀

25/10/2026

An AI prompt is also a data-handling decision.

A request to debug code, analyse a document or summarise internal information can create security risks when it includes credentials, confidential data or content from untrusted sources.

The risk doesn’t end when you hit submit. Prompt injection can manipulate how an AI system processes information, while unreviewed AI-generated code and commands can introduce further risks if executed without validation.

Our latest Cyber Awareness: What You Should Do carousel covers three essential practices:

Keep credentials and confidential information out of unauthorised AI tools.

Treat external content processed by AI as a potential source of malicious instructions.

Review and test AI-generated code, scripts and commands before ex*****on.

AI adoption needs more than effective prompts. It needs disciplined data handling, controlled access and security review.

Before your next prompt, ask yourself: what am I sharing, which tool am I using, and what could happen next?

Security

24/10/2026

When should a CISO enter the conversation: When the menu is being decided or when dessert is served?

Too often, security leaders are brought in after the business case is approved, vendors are selected, and critical technology decisions are already made.

By then, the CISO is expected to take accountability for risks they had little opportunity to influence.

In his latest article, our CEO & Co-Founder, Pankit Desai, explores why effective cybersecurity leadership requires more than technical expertise. It requires early involvement in strategic decisions, direct access to the board, and the authority to shape business outcomes.

Because security is not a final checkpoint. It belongs in the decisions that shape the business.

Read the full article: https://www.sequretek.com/resources/blog/Called-for-the-Menu-or-Called-for-Dessert

24/10/2026

Restoring encrypted files does not necessarily mean the threat is over.
Modern ransomware attacks can disrupt critical systems, interrupt business operations and involve data theft, followed by threats to expose sensitive information. The impact can extend well beyond the affected device, putting business continuity and trust at risk.

Prevention starts with disciplined security practices: treat unexpected links and attachments with caution, maintain protected backups, and isolate affected devices and alert your security team immediately when an attack is suspected.

This , look beyond the ransom note. Understand the operational risk behind it.

Watch here:

23/10/2026

Critical PHP vulnerabilities are already being exploited. Is your infrastructure patched?

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect the PHP runtime and carry a CVSS v4.0 score of 9.2 each.

The risk extends beyond vulnerable application code. Exploitation could enable unauthenticated remote code ex*****on , expose sensitive memory containing credentials and API keys, and allow attackers to compromise websites running on affected PHP versions.

With exploitation attempts reported before and after public disclosure, security teams should prioritize:

Updating PHP to the fixed versions or applying vendor-provided patches.

Verifying remediation at the server, host or container level.

Reviewing internet-facing PHP applications and monitoring for signs of compromise.

Patching the application is not enough when the vulnerability resides in the runtime.

Read Sequretek Labs’ Cyber Threat Advisory for affected versions, patch details and recommended actions- https://www.sequretek.com/resources/threat-advisories/Critical%20PHP%20Vulnerabilities%20Under%20Exploitation

23/10/2026

SBI's data exposure, with 3,897 customer records containing personal information found on the dark web, has shifted the conversation from how quickly breaches are reported to how quickly they are detected.

In an Economic Times Entrepreneur long read, Pankit Desai, our CEO & Co-Founder, shares how institutions can stay ahead of this kind of risk:

1. Start with an inventory. Many organizations still lack a complete list of outside parties with access to their data, and RBI's tighter third-party expectations only work if that list exists.
2. Execute well. Even the best technology fails if it is not implemented and run properly.
3. Look for exposure early. Continuous visibility and managed detection and response can help banks map outside access and spot leaked data before it reaches the dark web.

It is the kind of work we focus on every day at Sequretek.

What would your team find if it mapped every outside party with access to customer data this week?

Read Pankit's perspective here: https://entrepreneur.economictimes.indiatimes.com/news/long-reads/sbi-data-exposure-puts-indias-cybersecurity-ecosystem-under-scrutiny/135113832

The recent data breach at the State Bank of India (SBI) has raised alarms about vulnerabilities in India's cybersecurity landscape, emphasizing the need for improved detection and third-party access management to protect customer data.

22/10/2026

MFA Fatigue Attacks: Don't Let Repeated Prompts Catch You Off Guard

Multi-factor authentication helps protect your accounts, but attackers can exploit repeated sign-in notifications to pressure you into approving access you never requested.

If unexpected prompts keep appearing, don't give in to the pressure.

✔️ Deny requests you did not initiate.
✔️ Never share verification codes.
✔️ Report repeated prompts to your IT or security team.
✔️ If you approve a suspicious request by mistake, report it immediately.

This Cyber Awareness Month, remember that account security depends on both strong authentication and informed decisions.

Explore how to recognise MFA fatigue attacks and learn how to respond.

21/10/2026

That conference Wi-Fi might not be what it claims to be. 📶

A familiar network name. An automatic connection. A login page asking for your work credentials.

These small details can be warning signs of a fake hotspot designed to exploit your trust.

Before you connect:
🔎 Verify the official Wi-Fi name with event staff.
📱 Use mobile data or your personal hotspot when practical.
🔐 Use your organisation-approved VPN for work.
⚙️ Turn off automatic connections to unfamiliar networks.

Already connected to something suspicious? Disconnect and alert your IT team.

This Cyber Awareness Month, don't let convenience decide your security.

Swipe through to learn how to connect more safely.

21/10/2026

RedTail Threat Activity: Why PHP Application Monitoring Matters

Sequretek Labs has identified high-severity suspicious traffic associated with the RedTail threat family. The activity involved probing PHP application paths, including eval-stdin.php, with suspected attempts to exploit application vulnerabilities.

Organizations should block the reported malicious IP address, monitor HTTP/HTTPS traffic, investigate potentially vulnerable applications and verify that relevant security updates have been applied.

Most importantly, security teams should examine available logs to determine whether the activity resulted in successful exploitation or unauthorized access. Suspicious probing warrants investigation, even when a breach has not been confirmed.

Read the full threat intelligence report on Sequretek Times:
https://threatportal.sequretek.com/sequretek-times/265

20/10/2026

The victory of Goddess Durga over Mahishasura reminds us that good will always find the strength to overcome evil.

Wishing everyone a very Happy Dussehra! May the festival inspire hope, courage, and new beginnings for you and your loved ones.