Resources
Blog
Resource Library
October 22, 2026
PHP2Shell Customer Advisory: CVE-2026-109618 and CVE-2026-109619 Remediation Guide
SecurityScorecard’s PHP2Shell advisory covers CVE-2026-109618 and CVE-2026-109619: SecurityScorecard patched its affected PHP site on release day and found no exploitation. See how the PHP2Shell vulnerability affects you and how to respond.
STRIKE Alert
STRIKE News
October 21, 2026
Shared Dependencies Turn PHP Flaws Into a Public Service Risk
Early reported attacks on two critical PHP flaws put organizations and public services at risk. Learn how to prioritize by mission impact and shared dependencies.
STRIKE Alert
STRIKE News
October 21, 2026
Patch the runtime. Then verify the footprint.
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, each rated 9.2 Critical under CVSS v4.0. The PHP security team says both can lead to unauthenticated remote code execution. Updating a WordPress plugin or application framework does not replace updating the PHP runtime.
STRIKE Alert
STRIKE News
October 20, 2026
フランスの約700店舗に影響、冷凍・冷蔵設備へのサイバー攻撃から学ぶ企業の5つの対策
フランスの約700店舗に影響した冷凍・冷蔵設備へのサイバー攻撃。世界で1万件超の管理画面が公開状態にあることが判明。企業が今すぐ取り組むべき5つの対策を解説します。
October 14, 2026
One Vendor, Millions Exposed: Lessons from Denmark’s CPR Breach
The Denmark Central Population Register (CPR) breach exposed 8.8 million records through approved vendor access. See how continuous third-party risk monitoring and risk tiering reduce third-party exposure.
October 14, 2026
The Simple Test That Separates Real AI Transformation From AI Theater
SecurityScorecard CEO and Co-Founder Dr. Aleksandr Yampolskiy shares the before-and-after test that separates real AI transformation from AI theater.
October 14, 2026
How Security Ratings Turn Supply Chain Risk Into Resolved Risk
SecurityScorecard ratings help 3,000 organizations and over 70% of the Fortune 100 strengthen supply chains, backed by 95% attribution accuracy and data-driven insights.
October 14, 2026
Hackers Turned Supermarket Refrigerators Into Heaters
The French attacks, the wider cold-chain footprint, and the path from internet intelligence to safe remediation.
October 13, 2026
CanOworms: How to Evict Hackers’ For-Rent Infrastructure
SecurityScorecard’s STRIKE Threat Intelligence Team uncovered CanOworms, a 633-server rental proxy network that lets attackers swap infrastructure in minutes rather than exposing their own infrastructure. Here is how the research team uncovered the network and the practical steps security teams can take to protect themselves.
STRIKE News
October 13, 2026
Scorecarder Spotlight: Amanda Smith
Amanda Smith, VP, Alliances & Channels, shares why she chose to work at SecurityScorecard, and how collaboration and innovation have helped shape her career.
Scorecarder Spotlight
October 7, 2026
Financial Services Is Banking on Third-Party Risk It Can’t See
The most interconnected financial institutions face the highest third-party breach risk. New research reveals why outsourcing-dependent supply chains create vulnerability.
October 6, 2026
Airlines Are Flying Blind on Third-Party Cyber Risk
Annual vendor questionnaires can’t stop aviation’s cyber threats. Discover how continuous monitoring protects flight operations and supply chain security.
October 5, 2026
6 Ransomware Myths Debunked: How to Prepare Your Security Team
Ransomware doesn’t spare small businesses, hospitals, or paying victims. SecurityScorecard debunks six myths with real incident data.
October 2, 2026
TITAN AI Now Runs Third-Party Risk Management End to End
Learn how TITAN AI now runs third-party risk management end to end, replacing disconnected tools with one connected workflow built on continuous intelligence and AI agents.
September 30, 2026
Data Centers Are the Backbone of AI. Their Cybersecurity Can’t Be an Afterthought.
Data center cybersecurity is a supply chain problem. Learn why continuous third-party risk monitoring matters more than ever in the AI era.
September 30, 2026
The Vanishing Window: Why We Built SecurityScorecard for What Comes Next
A response to IDC’s 2026 Spotlight on the shift from periodic to continuous, threat-informed third-party risk management.
September 25, 2026
How the EU AI Act Changes Vendor Risk Management
The European Union’s Artificial Intelligence Act has moved from preparation to enforcement. On August 2, 2026, the European Commission and national authorities gained enforcement powers under the AI Act. Transparency requirements also became applicable for certain artificial intelligence (AI) systems. For security leaders, the implications extend beyond the AI models their organizations build. AI increasingly
Third-Party Risk Management
Threat-Informed TPRM
September 15, 2026
AI Security Cannot Depend on Everyone Slowing Down
Frontier labs are calling for the industry to slow down. Our adversaries didn’t get the memo. The world’s first benchmark for AI in third-party risk management shows what we should be building instead: measurement, not just restraint.
September 4, 2026
How to Present Cyber Risk to the Board: A CISO’s Reporting Framework
CISOs now face direct board accountability for vendor risk. Here’s a practical framework for turning security data into a board-ready risk narrative — with a template to get started.
August 31, 2026
AI Agents in TPRM: What They Actually Do (and What They Don’t)
AI agents in TPRM do more than summarize findings. See what agentic AI actually automates in a third-party risk program — and how to tell real from hype.
August 31, 2026
New Hire Spotlight: Riché Zamor
Riché Zamor, VP, Product Operations & AI Innovation, shares his first impressions of working at SecurityScorecard, what drew him to the company and what he’s most excited to build with the team.
Scorecarder Spotlight