Welcome to The GRC Guy!
GRCGuy.io is a cybersecurity and compliance blog providing insights on governance, risk management, HIPAA, SOC 2, ISO 27001, AI security, and emerging cyber threats.
CVE-2026-119977 lets an unauthenticated attacker race a WordPress full-package core update. CISA added it to KEV on November 3. Here is what is confirmed, what is disputed, and what GRC teams should do.
Read more →Binance says a compromised DevOps laptop started the largest crypto theft on record. Here is what is confirmed, what is not, and how to test whether one endpoint in your environment can move money or data.
Read more →GMO Internet confirmed data theft, unauthorized customer trades and an extortion demand at its Onamae.com Desktop Cloud, and will not restore the platform. Here is what is confirmed, what is not, and what GRC leaders should check about credentials stored on vendor infrastructure.
Read more →Arista says a critical SQL injection flaw in VeloCloud Orchestrator, CVE-2026-114625, is already being exploited. It is reportedly the third exploited VCO flaw since July. Here is what is confirmed, what is unclear, and what GRC leaders should do about their SD-WAN control plane. Also covers HTTP2Shell (CVE-2026-111497), the Brotli decoder flaw that hit Node.js, Python and other stacks.
Read more →A broken certificate authority, an exploited remote support appliance, a poisoned AI gateway, a PHP flaw and a ransomware advisory in five days. What is confirmed, what it means for GRC, and how to prepare for larger disruptions.
Read more →
About me
As a dedicated educator in the realm of cybersecurity, I am excited to share my extensive 13 years of experience and knowledge in this field.
This blog is thoughtfully designed for individuals with a keen interest in cybersecurity, those who are contemplating a career change, or those who are embarking on their professional journey in this domain. Within this site, you can expect to find a series of informative videos in which I delve into various aspects of cybersecurity, covering not only Governance, Risk Management, and Compliance (GRC) but also delving into a wide array of cybersecurity topics.
Feel free to connect with me at any juncture if you have questions or seek further information. Your engagement and inquiries are always welcomed. Thank you for being a part of this cybersecurity community!
Additionally, from time to time, I will be conducting interviews with esteemed peers in the field, providing further insights into the subjects I've covered. You can count on this blog to be a valuable resource, featuring a repository of exceptional cybersecurity-related materials that I've thoughtfully curated over time.
Invitations to conduct talks, interviews or if you have general inquiries, please fill out the form below.
