Author
Abdulaziz Alzamil
Founder & CEO, Fyntralink
Abdulaziz Alzamil is the founder and CEO of Fyntralink and writes the Fyntralink blog: analysis of vulnerabilities and cyber threats and what they mean for Saudi organisations, readings of regulatory frameworks such as the NCA Essential Cybersecurity Controls and the Personal Data Protection Law, and pieces on AI and software engineering.
400 articles
M-Trends 2026: Attackers Hand Off Access in 22 Seconds — What Saudi Bank SOC Teams Must Do Today
Mandiant's M-Trends 2026 report drops one number that should reshape every SOC in Saudi Arabia: 22 seconds. That's how long it now takes an attacker to hand off a compromised foothold to a secondary threat actor — down from over 8 hours just three years ago.
Breaches & Data LeaksShinyHunters Claims 3M+ Cisco Salesforce Records: The CRM Security Crisis Saudi Banks Must Act On Now
ShinyHunters claims 3 million Cisco Salesforce records stolen — FBI, NASA, and government agency data included. Saudi financial institutions using Cisco products face cascading vendor risk right now.
VulnerabilitiesCisco IMC CVE-2026-20093: CVSS 9.8 Authentication Bypass Puts Saudi Bank Data Centers at Risk — Patch Now
A critical authentication bypass in Cisco IMC (CVE-2026-20093, CVSS 9.8) lets unauthenticated remote attackers seize admin access with no workaround available. Saudi financial institutions relying on Cisco UCS infrastructure must patch firmware immediately.
VulnerabilitiesCVE-2026-3055: Citrix NetScaler's SAML IDP Flaw Is Being Actively Probed — What Saudi Banks Must Act On Now
A CVSS 9.3 memory overread in Citrix NetScaler is being actively probed by threat actors. Saudi banks using NetScaler as a SAML Identity Provider face credential exposure without any authentication required. Patch or isolate today.
Compliance & RegulationSWIFT CSP 2026: Mandatory Controls Saudi Banks Must Implement Now
SWIFT's 2026 security framework makes Control 2.4 mandatory and expands API connector scope. Saudi banks under SAMA oversight must attest by December 31, 2026 — here's what to prioritize now.
Software EngineeringTeamPCP's Trivy Supply Chain Attack Exposed 30 EU Entities — Is Your CI/CD Pipeline the Next Target?
A single compromised open-source tool gave attackers access to AWS secrets across 1,000+ SaaS environments. Saudi financial institutions running similar CI/CD pipelines face the same exposure.
Cloud & IdentityShinyHunters' 2026 Vishing Campaign: How Attackers Are Hijacking Okta SSO to Breach Bank-Grade SaaS Platforms
ShinyHunters used real-time voice phishing to steal Okta SSO credentials and MFA codes, then pivoted into Zendesk, Salesforce, and other SaaS platforms to steal millions of support tickets. Saudi banks running the same SaaS stack are directly exposed.
VulnerabilitiesCVE-2026-23813: Critical HPE Aruba AOS-CX Flaw Grants Unauthenticated Admin Access — What Saudi Banks Must Do Now
A CVSS 9.8 authentication bypass in HPE Aruba AOS-CX switches lets any remote attacker reset admin credentials — no authentication required. Saudi banks running this hardware in branch or data-center networks need to act before this changes exploitation status.
VulnerabilitiesF5 BIG-IP APM CVE-2025-53521: Unauthenticated RCE Puts 14,000+ Exposed Instances at Risk — What Saudi Banks Must Do Now
A critical F5 BIG-IP APM flaw reclassified from DoS to unauthenticated RCE is being actively exploited — with 14,000+ instances still exposed globally. Here is what Saudi financial institutions must patch immediately.
VulnerabilitiesChrome CVE-2026-5281: Fourth Zero-Day of 2026 Is Under Active Exploitation — What Saudi Financial Institutions Must Do Now
Google's fourth Chrome zero-day of 2026 is actively exploited in the wild. CVE-2026-5281 — a use-after-free in the Dawn WebGPU layer — allows remote code execution and is now on CISA's KEV list. Saudi banks running unpatched Chrome deployments face immediate exposure.
VulnerabilitiesstrongSwan CVE-2026-25075: 15-Year-Old VPN Flaw That Can Bring Down Your Financial Network
A critical integer underflow in strongSwan's EAP-TTLS plugin — present for 15 years — lets unauthenticated attackers crash VPN gateways. Here is what Saudi financial institutions need to know and do right now.
Malware & Threat ActorsDPRK Steals $285M via Drift Protocol: What Saudi Financial Firms Must Know
North Korean threat actors linked to the Lazarus Group stole $285M from Drift Protocol using a legitimate Solana feature as a weapon — here's what this means for Saudi financial institutions.
