The HackIT Blog
Security alerts, explainers and a monthly look at Estonia’s cyber space, for the people who build and run web and mobile applications.
- >_ Monthly review
Estonia's cyber month: October 2026
What RIA reported for October 2026: 837 incidents, e-service outages, data leaks, critical PHP and GitLab flaws and fake LinkedIn job offers for developers.
Read the post - >_ Explainer
Supermarket freezer hacks: what happened in Estonia and Europe
Attackers have changed the settings of supermarket refrigeration controllers in Estonia, France and elsewhere. What is known about the attacks and the devices.
Read the post - >_ Explainer
Binance hack: what a compromised developer laptop can reach
How a fake job interview, a tampered developer tool and an internal AI tool led to the Binance theft of about $6.34 billion, and what one laptop can reach.
Read the post - >_ Security alert
Linux kernel TCP flaw (CVE-2026-98432): how to check your servers
A Linux kernel TCP flaw the kernel team scores 9.8 (CVSS 3.1) is fixed in some Debian, Oracle, SUSE and Amazon kernels, not Ubuntu or RHEL. How to check.
Read the post - >_ Security alert
Node2Shell (CVE-2026-111497): how to check Node.js and Brotli
A Brotli decoder flaw on CISA's exploited list can corrupt memory in Node.js and other software. Which versions are fixed, how to check yours, what to do.
Read the post - >_ Explainer
NIS2 in Estonia: who must do what
Who the Estonian Cybersecurity Act covers since NIS2, and what it asks: details for RIA, a responsible board member, security measures and incident reports.
Read the post - >_ Security alert
PHP2Shell (CVE-2026-109618): how to check your PHP servers
Two critical PHP flaws allow remote code execution without logging in, and are now exploited. Which versions are fixed, how to check yours, what to do today.
Read the post - >_ Explainer
What a web application penetration test covers
What testers check in a web application penetration test, area by area in OWASP ASVS 5.0, how deep each of its three levels goes, and what lies outside it.
Read the post