Category Archives: Bez kategorii

Android vs iPhone: Which Is More Secure? CVEs, Zero-Days, Exploit Prices and Patch Speed in Numbers (2026)

By | |
Leave a comment
Android vs iPhone: which one is more secure? 501 vs 317 CVEs, $5-7M zero-click iPhone exploit, phishing 16% vs 8%, 0 attempts on the iPhone at Pwn2Own 2024-2026

Today’s post answers the question I hear more than any other: “Michał, iPhone or Android?”. Instead of opinions, I gathered numbers: 501 vs 317 CVEs, 15 zero-days used in attacks on phones in 2025, 70 vs 72 days to patch according to Project Zero, $7M for an iPhone exploit and $5M for Android, 16% vs 8% of devices hit by a phishing attempt. There’s also the fresh Pwn2Own, where the Pixel 10 fell three times while nobody touched the iPhone for the third year running, and the Polish banking trojans you install yourself. The verdict is less obvious than fans of either camp suggest – and at the end you’ll find 7 things worth doing whatever logo is on the back of your phone. 🔓 Continue reading →

Safest browser in 2026? Chrome, Edge, Opera, Brave, Firefox and Safari by the numbers – three engines, 15 zero-days

By | |
Leave a comment
Graphic: 6 browsers, 3 engines, 15 zero-days - engine market share Blink/Chromium ~79%, WebKit ~16%, Gecko ~3%

Today’s post is for anyone who has ever wondered whether Chrome is “full of holes” and Firefox is “safe”. You have six browsers on your desktop, but under the hood there are only three engines – and it’s the engine, not the logo, that decides whether someone takes over your laptop after a single click on a link. This year Google has already fixed seven Chrome holes that were exploited in attacks before a patch existed, and every one of them also sat in Edge, Opera and Brave. I ran the numbers for 2025 and 2026: zero-days, CVEs, patch speed, money spent on security teams and where data really gets lost. At the end you’ll find my “seven laws of browser security” and what I would pick myself. Spoiler: the safest browser is the one that’s up to date. Continue reading →

“Don’t Do Security, It Pays Off” – What the Risk Calculator Says vs. What the Post-Attack Invoices Say

By | |
Leave a comment
Chart: Change Healthcare 2024 - $22M ransom paid vs. ~$2.9B total cost of the attack. Don't do security, it pays off?

Today’s post is a bit of a provocation. I took the formula from the CISSP exam – a safeguard must not cost more than the losses it prevents – and honestly checked whether it sometimes says security is better left undone. Then I tested it against real invoices and share prices: Equifax, SolarWinds, CD Projekt, Żabka, MyDr, Morele.net, Poland’s 2025 data protection fines, and how many customers really leave after an incident (spoiler: far fewer than say they will). There’s also a list of companies that never got back up after an attack – from a 158-year-old British haulier finished off by one guessed password to a Polish bike maker. The conclusions are uncomfortable for both sides: those who scaremonger and those who cut corners. 🔓 Continue reading →

Cyber Threats 2026 in Hard Numbers: A New Vulnerability Every 6 Minutes, Exploits Before the Patch

By | |
Leave a comment
Cyber Threats 2026 in hard numbers — a new vulnerability every 6 minutes, time-to-exploit at minus 7 days, 86% of phishing AI-driven

In 2018, an average of 63 days passed between a vulnerability’s disclosure and the attack. Today? Minus seven — the attack starts before the vendor manages to ship a patch. I’ve gathered hard numbers from more than twenty reports in one place: 53,800 vulnerabilities since January 2026 (more than in all of record-breaking 2025), 90 zero-days in real attacks, 86% of phishing AI-assisted, and Mozilla and Google bulk-patching holes found by AI agents. 💥 On top of that, my home turf, Poland: over 700 incidents a day and 96% of companies with an incident on record. At the end, 6 concrete takeaways for your company — straight from the data, no scaremongering. Continue reading →

Guide to Cybersecurity Certifications with Ranking — 2026 Update (the AI Era)

By | |
Leave a comment
Cybersecurity certifications 2026 — ranking, prices and the AI era (updated guide)

Two years ago I published a ranking of cybersecurity certifications — and a lot has come crashing down since. CASP+ formally no longer exists, OSCP got an expiration date, the free ISC2 exam is no longer free, and AI has started closing the industry’s door on juniors. I repeated my Indeed job-posting analysis after two years: some certifications grew by over 200%, others dropped by half. 💥 In the updated guide you’ll find the 6-level ranking, current prices for all 21 certifications, and hard data on what AI has changed. Continue reading →

Will AI Take Over Jobs in Cybersecurity? Quite the Opposite – Example of XSS in Zoomin!

By | |
Leave a comment
ai vs security

In the context of the growing role of artificial intelligence (AI) in various fields, the question of its impact on the job market in cybersecurity is becoming increasingly relevant. On one hand, automation and intelligent systems can significantly speed up and streamline processes related to data and IT infrastructure protection…. Continue reading →

Biometrics are safer – how malware robs Android users

By | |
Leave a comment
AndroidAtakOverlayBank

This post was inspired by the excellent presentation by Jan Seredynski from THS 2023. Cybersecurity is not a binary issue – there are no solutions that guarantee 100% security. In reality, it is more about risk assessment and choosing solutions that are less vulnerable to attacks. An example of such… Continue reading →

Cracking a password-protected PDF in seconds – PZU and their illusory protection. NN Investment Partners also repeats these bad practices.

By | |
Leave a comment
łamanie pdf z hasłem

The illusion of security is worse than the awareness of its absence because it leads to decisions made on false premises. Information conveyed by public trust institutions such as “We protect your personal data” often creates this illusion of security. Let’s study two examples of this using password-protected PDF files…. Continue reading →