Security Blog- 2026 2025 2024 2023 2021 2020 2019 2018
AI blog APT blog Attack blog BigBrother blog BotNet blog CyberCrime blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog
DATE | NAME | Info | CATEG. | WEB |
|
24.10.26 |
How practical is 100k requests per second? Introducing h3fuzz | There was some research that the PortSwigger team released in late September that revealed that they were able to reach 100k requests per second over WiFi using HTTP/3. This caught my attention as a hacker that has always tried to find speed with fuzzing attempts. The context of the blog post stuck to how this worked with Turbo intruder inside Burp Suite, and how it could be used to perform time of check time of use (TOCTOU) attacks. | Security blog | SEARCH LABS |
|
24.10.26 |
Eight Compromised Certificate Authority Keys Have Put The Internet At Risk - Checkmarx | What happens when your random function returns just one byte? It depends: if you’re issuing intermediate CA certificates, you create a global security failure, as the Go language maintainers discovered. Learn about the issue, how it impacts your organization, and what to do next. | Security blog | Checkmarx |
|
24.10.26 |
Comply with PCI 6.4.3 & 11.6.1 Through Client-Side Security Tools | The PCI DSS v4 is a critical defense against growing web skimming attacks (also known as e-skimming and digital skimming) and data leakage risks. | Security blog | JSCRAMBLE |
|
24.10.26 |
eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update | On October 20, 2026, Python’s security team advised users to update Python packaging tools following the eMudhra / emSign certificate authority incident. The immediate concern is the certificate trust used when those tools connect to package indexes and other HTTPS services. Python security announcement | Security blog | StepSecurity |
|
24.10.26 |
eMudhra CA Key Compromise: Weak Keys, Risks and Fixes | The eMudhra CA key compromise is a certificate authority (CA) security incident in which eight intermediate certificates issued by eMudhra, an Indian digital trust provider, carried private keys that anyone can recover from the public certificate. An independent researcher reported the weakness on October 17, 2026, and Chrome and Firefox blocked the intermediates within hours. | Security blog | SOCRADAR |
|
17.10.26 |
A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline | During a security audit of Discourse, a popular open-source forum platform powering over 22,000 communities including OpenAI, Atlassian, and Cloudflare, we discovered two vulnerabilities affecting default configurations. | Security blog | SEARCHLIGHT |
|
17.10.26 |
Session Cookie Authentication Bypass: Predictable Signing Secret Enableds Account Impersonations | During a security review of a yard management system (YMS) used to optimize supply chain operations, Resecurity identified an authentication bypass caused by two independent weaknesses in the application's session-cookie design. | Security blog | Resecurity |
|
17.10.26 |
Best KnowBe4 Alternatives & Competitors | Adaptive Security is backed by OpenAI as its first and only cybersecurity investment, and is used by companies including Figma, Ramp, Lennar, and Plaid. | Security blog | Adaptive Security |
|
17.10.26 |
Inside Help TDS: Hotejka and Cloudflare Abuse | Threat research is always a bit of a cat-and-mouse game, and it’s often made more so when an actor survives years in the face of scrutiny. The actors behind the so-called Help Traffic Distribution System (TDS) are one such case. They’ve been active since at least April 2017 and have been largely unaffected by the cybersecurity world around them. | Security blog | Adaptive Security |
|
17.10.26 |
Behind Closed Doors: How Physical Penetration Testing | Protecting confidential conversations takes more than closing a conference room door. Physical penetration testing reveals whether unauthorized people can reach sensitive spaces, interfere with equipment, or leave a device unnoticed. Define the test around the spaces and information you need to protect, then use the results to improve access checks, reporting, and response. | Security blog | Bishop Fox |
|
17.10.26 |
Variola: From ClickFix to a Modular Implant | Blackpoint’s Adversary Pursuit Group (APG) traced a ClickFix intrusion to a previously unclassified modular Windows implant, which APG is tracking as Variola. | Security blog | Blackpoint Cyber |
|
17.10.26 |
Mobile Device Management Alone Cannot Address Every Mobile Security Threat | In an article published by HackRead, the limitations of Mobile Device Management (MDM) are examined as organizations face increasingly sophisticated threats targeting employee smartphones and corporate data. While MDM helps enforce device policies and manage access, it does not eliminate risks from mobile phishing, malicious applications, and compromised devices. | Security blog | ZIMPERIUM |
|
17.10.26 |
Akamai Named a Leader in IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment | Akamai has been named a Leader in the IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment. This is the second time that Akamai has been recognized as a Leader in this assessment. | Security blog | Akamai |
|
17.10.26 |
Comply with PCI 6.4.3 & 11.6.1 Through Client-Side Security Tools | As the payment landscape evolves, compliance with PCI DSS v4 (v4.0.1 is the latest) is now a reality, with the deadline to adopt the future-dated requirements behind us. It is a critical defense against growing web skimming attacks (also known as e-skimming and digital skimming) and data leakage risks. | Security blog | Akamai |
|
17.10.26 |
Why is Preemptive Cyber Defense Important in 2026 | Preemptive cyber defense is a prevention-first security strategy that stops threats before they execute, rather than detecting and responding to them after they have already run. Instead of recognizing an attack in progress, it removes the conditions an attack needs to succeed, blocking malicious code deterministically at the moment of execution. | Security blog | Morphisec Blog |
|
17.10.26 |
MSSP Growth: How to Scale Investigations Without Adding More Work | But growth also brings more alerts, suspicious files and URLs, investigations, escalations, reports, and SLA commitments. And if too much of that work still depends on manual analyst effort, those 10 new clients can put pressure on the SOC faster than expected. | Security blog | ANYRUN BLOG |
|
17.10.26 |
What Can ANY.RUN Reveal About Your Threat Landscape? | Every day, thousands of SOC and IR teams worldwide analyze suspicious files, emails, and links with ANY.RUN. Beyond individual investigations, this activity generates valuable data on emerging threats, industry trends, and SOC operational performance. | Security blog | ANYRUN BLOG |
|
17.10.26 |
DORA TLPT Requirements: Where Threat Intelligence Fits | The DORA TLPT requirements push selected EU financial entities beyond standard penetration testing. TLPT must be based on realistic threat scenarios, relevant threat actors, and current intelligence about how attacks are actually carried out. | Security blog | ANYRUN BLOG |
|
17.10.26 |
What to do when a data breach notice tells you almost nothing | Data breach notifications are telling victims less than ever. What the company leaves out can still shape what you do next. | Security blog | Eset |
|
13.10.26 |
Auditing the auditor: Unmasking Apex Accelerator | REF8801 exposes how Apex Accelerator combines convincing Web3 services with malicious npm packages, attacker-controlled AI infrastructure, and cross-platform malware delivery. | Security blog | Elastic Security Labs |
|
10.10.26 |
Beyond Vendor Assessments: Managing Third-Party Risk | In recent years, organizations have made real progress here. SBOMs (Software Bill of Materials) are now a standard deliverable. Software Composition Analysis (SCA) tools run in CI/CD. Vendor security questionnaires are longer and more rigorous than ever. | Security blog | JSCRAMBLE |
|
10.10.26 |
Bridging technical depth and usability: The story behind Radar’s redesign | Radar provides a real-time view into global Internet trends, powered by Cloudflare’s global network. We support Cloudflare’s mission to help build a better Internet by making web data visible, clear, and actionable for everyone. Since launching in 2020, Radar has found a natural audience amongst expert users with technical backgrounds, such as network operators and academic researchers who rely on Radar data to observe industry trends and global events. | Security blog | Cloudflare Blog |
|
10.10.26 |
New on the Map — September 2026: 22 Protocol and Endpoint Scanners | Most organizations do not have a complete picture of what is reachable from the Internet. A router, a camera system, a data warehouse, a building access controller — any one of these could be answering requests from anywhere in the world right now, and your security team might not know. Attackers scan for these services systematically, every day. | Security blog | Censys |
|
10.10.26 |
From Threat Intelligence to SOC Action | So, what actually makes threat intelligence useful in daily SOC work? During our discussion, we narrowed it to three things: | Security blog | ANY.RUN & Elastic |
|
7.10.26 |
Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR | The managed detection and response (MDR) market has reached a turning point. We’ve gone beyond the baseline of 24/7 monitoring focusing on the speed of detection and moved to a world with a convergence of exposure management and response to deliver measurable, outcome-based defenses of a larger, AI-driven attack surface. | Security blog | RAPID7 |
|
7.10.26 |
5 SOC Pain Points Putting US Security Teams Under Pressure | US SOC teams are under pressure to detect and contain threats faster, but the real challenge is often not a lack of security solutions. It’s the growing amount of alerts, fragmented investigation data, evasive attack techniques, and the time analysts spend connecting the dots. | Security blog | ANYRUN BLOG |
|
6.10.26 |
47-Day TLS Certificates: 5 Steps to Prepare | Somewhere in your organization is a spreadsheet of certificate expiry dates, and someone who owns it. That is not a caricature. DigiCert’s 2026 research with Omdia surveyed more than 400 senior IT leaders and found that 47% still rely on manual tracking methods such as spreadsheets, and only 34% have a complete, current view of what they hold. | Security blog | Imperva |
|
6.10.26 |
Harvest Now, Decrypt Later: End-to-End PQC TLS | Somewhere, an attacker is recording your encrypted traffic. Not breaking it. Recording it. The bet is patient and simple: store ciphertext today, wait for quantum computers to mature, decrypt at leisure. The industry calls it harvest now, decrypt later (HNDL), and it is the rare security threat with a believable deadline attached: data with a ten-year shelf life, encrypted with algorithms on a countdown. | Security blog | Imperva |
|
3.10.26 |
When Productivity Extensions Become Attack Platforms | LayerX Research (now part of Akamai) discovered a coordinated campaign of 32 malicious browser extensions across the Chrome Web Store and Microsoft Edge Add-ons Store, affecting more than 6,150 users. | Security blog | Akamai |
|
3.10.26 |
September 2026 Security Release | An attacker-controlled, allow-listed remote URL can lead to Server-Side Request Forgery (for example to private IP ranges) during Image Optimization. If no images.remotePatterns are configured, your application is not affected. | Security blog | Next.js |
|
26.9.26 |
How Automated Moving Target Defense Stops Attacks Before Execution | Automated Moving Target Defense (AMTD) is a prevention-first security technology that constantly morphs the runtime memory environment so attackers cannot find or exploit their targets. | Security blog | Morphisec Blog |
|
26.9.26 |
Enumerating Users and MFA via Microsoft's Password Reset Portal | Microsoft's Self-Service Password Reset (SSPR) portal is a legitimate feature designed to let users recover their accounts without calling the helpdesk. As it turns out, it also tells you quite a lot about the accounts in a tenant — whether they exist, what authentication methods they have registered, and in some cases, which ones are likely administrators. This post covers what the portal leaks, why it matters from both sides, and what defenders can do about it. | Security blog | LEVELBLUE |
|
26.9.26 |
MSP Approaches Compliance Architecture | Compliance is evolving beyond checklists. Learn how security enclaves, validated cryptography, and boundary ownership can simplify audits and reduce risk. | Security blog | WatchGuard Blog |
|
26.9.26 |
Voice Callers Exploit BYOD to Access Corporate Data | In a story recently reported by Dark Reading, threat actors are calling and texting employees on personal mobile devices, impersonating IT help desks and directing them to phishing pages designed to steal Microsoft 365 credentials and authentication tokens. By targeting unmanaged BYOD devices, attackers can bypass many corporate security controls and use compromised identities to access and exfiltrate sensitive data from services including SharePoint, OneDrive, and Exchange. | Security blog | ZIMPERIUM |
|
26.9.26 |
Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR | The managed detection and response (MDR) market has reached a turning point. We’ve gone beyond the baseline of 24/7 monitoring focusing on the speed of detection and moved to a world with a convergence of exposure management and response to deliver measurable, outcome-based defenses of a larger, AI-driven attack surface. | Security blog | RAPID7 |
|
26.9.26 |
The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 | At ReliaQuest, we believe that threat intelligence delivers the most value when it provides holistic context that drives action across security operations. In 2025, the fastest data exfiltration time we observed was just six minutes, down from over four hours the previous year. To keep up, security leaders must go beyond just collecting intelligence and use it to power automated action across detection, containment, investigation, and response. | Security blog | RELIQUEST |
|
26.9.26 |
No One Gets Phished: The New Group-IB Browser Agent Applies Predictive Intelligence At The Click | One employee reaches a phishing page. The tab closes, the domain is blocked for every browser in the company, and the targeted password is already being reset. The new Group-IB Browser Agent brings the corporate browser under XDR coverage, checking every page against predictive Threat Intelligence in real time. | Security blog | GROUP-IB |
|
26.9.26 |
Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure | The landscape of software supply chain security has undergone a significant shift. Recent campaigns demonstrate that sophisticated threat actors are systematically targeting the engineering lifecycle by compromising trusted security and programming tools. | Security blog | GTI |
|
26.9.26 |
A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity | Unit 42 researchers have identified an issue where using default configurations in Amazon Web Services (AWS) AgentCore Harness could allow attackers to steer an agent's actions through prompt injection to exfiltrate plaintext credentials managed by AgentCore Identity. | Security blog | Palo Alto |
|
26.9.26 |
Inside the Modern SOC: Defending the Cross-Environment Pivot | Across Unit 42 investigations, we continue to see adversaries move well beyond where an attack begins. They pivot across the enterprise, avoiding detection by exploiting the visibility gaps created by disconnected security tools. | Security blog | Palo Alto |
|
26.9.26 |
From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies | This article explores how AWS mitigates the security risks associated with publicly exposed Identity and Access Management (IAM) access keys through its AWSCompromisedKeyQuarantine managed policy. We discuss the evolution of the different versions of this AWS managed policy. We also show how the managed policy AWSCompromisedKeyQuarantine evolved over time to protect organizations by relating it directly to new cloud attacks against AWS environments. | Security blog | Palo Alto |
|
26.9.26 |
When the Directory Becomes the Weapon: Understanding NTDS.dit Theft | This blog focuses on a critical defense shift: moving from signature-based detection to a technique-driven approach that identifies malicious behavior regardless of the specific toolkit utilized. | Security blog | TRELLIX |
|
24.9.26 |
Exposed Medical Image Consoles: 40% Lack Passwords | To reach a hospital’s medical images the hard way, you need a DICOM (Digital Imaging and Communications in Medicine) client and some knowledge of a protocol designed in the 1980s for machines that were never supposed to face the internet. To reach a growing number of them the easy way, you can open a web browser and type an address. | Security blog | FLARE.IO |
|
24.9.26 |
The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 | In sports, a great defense must understand the offense. It is no different in security operations. It is not enough to just know threat intelligence—it needs to be acted on. Forrester recognizes ReliaQuest in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026, where ReliaQuest was named a Strong Performer. | Security blog | RELIQUEST |
|
23.9.26 |
Email Threat Protection Across Messages, Identities and Accounts | Email threat protection is about preventing, detecting, and responding to attacks that reach people through email or use email as the first step in a larger attack. This includes phishing, business email compromise (BEC), malware, account takeover (ATO), supplier fraud, internal threats, and data loss. The work spans message analysis, authentication, behavioral detection, user reporting, and remediation. | Security blog | PROOFPOINT |
|
23.9.26 |
Operationalizing Security for the Agentic Era: Introducing Semantic Business Policies and Agentic Insights | Today at Protect 2026, Proofpoint is introducing Semantic Business Policies and Agentic Insights, two new capabilities that together deliver a continuous governance lifecycle for AI, connecting policy definition, runtime enforcement, and autonomous risk discovery into a single platform. No other vendor offers this today. | Security blog | PROOFPOINT |
|
23.9.26 |
Stopping Attacks Before They Reach the Inbox: Introducing the Proofpoint Agentic Collaboration Security System | At Protect 2026 in San Diego today, we introduced the Proofpoint Agentic Collaboration Security system. It is a single system that brings together intent-based detection, agentic investigation, and user risk agents to protect how people communicate and collaborate. | Security blog | PROOFPOINT |
|
23.9.26 |
Introducing Proofpoint Advanced Browser Protection: The First Unified Defense Across Email and the Browser | Email remains a primary delivery vector for cyberattacks, but it has also become one of the most heavily defended. As organizations continuously shore up their email defenses, attackers have begun shifting more attacks into the browser, where they can weaponize links after delivery, hide malicious content behind trusted authentication workflows, abuse OAuth permissions, hijack sessions, steal credentials, and use malicious browser extensions to evade defenses. | Security blog | PROOFPOINT |
|
18.9.26 |
Give every teammate and agent the right level of access to your Workers | As more teams — and now agents — build applications on Cloudflare's Developer Platform, having the right access controls is crucial to allow you to ship safely. After all, the last thing you want is for an agent to make a change in production, just because it was granted more access than it needs. | Security blog | Cloudflare Blog |
|
18.9.26 |
From Internet Exposure to Operational Disruption: A Red Team View of Connected Infrastructure | When people think about a cyberattack on water infrastructure, they often imagine the most dramatic outcome: a malicious actor changing a setpoint, stopping a pump, manipulating chemical treatment, or interfering with a physical process. | Security blog | COBALT.IO |
|
18.9.26 |
Top 14 JavaScript Libraries and Frameworks Compared | JavaScript, one of the most popular programming languages, has a wide ecosystem of libraries and frameworks that enhance its functionality and streamline development. With the rapid growth of the web and the increasing demand for more dynamic, interactive, and scalable applications, developers rely on these tools to build everything from simple websites to complex applications. | Security blog | JSCRAMBLER |
|
18.9.26 |
Why Are OSS Attackers Always After CI/CD Credentials? | CI/CD credentials are a prime target of malicious open source packages because of the sheer authority those credentials carry. Depending on their privileges, they can provide access to source code, build systems, package registries, cloud infrastructure, and production delivery. | Security blog | SONATYPE |
|
18.9.26 |
ATT&CK grew a 15th tactic: A practical DFIR field guide to the Stealth / Defense Impairment split | Artifacts and tooling for the new Enterprise MITRE ATT&CK matrix tactics, distilled from the field. | Security blog | SOPHOS |
|
15.9.26 |
ENISA's CRA Single Reporting Platform Just Went Live. Here's What You Actually Need to Know | September 11, 2026, the Cyber Resilience Act's (CRA) reporting obligations officially kicked in, and ENISA's Single Reporting Platform (SRP) went live right alongside them. | Security blog | VULNCHECK |
|
15.9.26 |
No One Inside The Machine | In 1770, Wolfgang von Kempelen unveiled the “Mechanical Turk”: a chess-playing automaton that stunned European courts. With gears, a cabinet, and an articulated arm that moved its own pieces, it looked like a machine. | Security blog | CENSYS |
|
12.9.26 |
Introducing automatic remediation policies with Cloudflare CASB | Today, we’re making Cloudflare CASB more powerful than ever by introducing automatic remediation policies. This means security teams can now design event-driven logic to revoke risky file shares and dispatch custom webhooks, without manual intervention. | Security blog | CLOUDFLARE |
|
12.9.26 |
1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it | 1.1.1.1 now validates DNSSEC signatures made with ML-DSA-44, a post-quantum signature algorithm standardized by the National Institute of Standards and Technology (NIST). This is a first step toward preparing DNSSEC for a future in which today’s signature algorithms are no longer secure. | Security blog | CLOUDFLARE |
|
12.9.26 |
How we rebuilt Cloudflare Workers’ module registry for Node.js compatibility | We’ve rewritten the module registry in workerd, the core open-source component of the Workers runtime, to be faster, more standards-compliant, and more closely aligned with Node.js' module registry. | Security blog | CLOUDFLARE |
|
12.9.26 |
Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting) | Every time Cloudflare opens a new TLS 1.3 connection to an origin server, we have to make a guess: the protocol requires us to commit to a key agreement algorithm in the very first packet we send, before the origin has told us anything about itself or what it can support. If we guess right, the handshake completes in one round trip. Guess wrong, and the origin replies with a HelloRetryRequest, we start over, and the connection costs two round trips. | Security blog | CLOUDFLARE |
|
12.9.26 |
New on the Map — August 2026: 14 Protocol Scanners | Most organizations don’t have a complete picture of what’s reachable from the Internet. A router, a camera system, a data warehouse, a building access controller — any one of these could be answering requests from anywhere in the world right now, and your security team might not know. However, attackers scan for these services systematically, every day. | Security blog | CENSYS |
|
12.9.26 |
Passkey-themed social engineering leads to identity and cloud compromise | Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks. | Security blog | Microsoft blog |
|
12.9.26 |
Safe word: What is it and why do you need one? | AI scams are now hyper-realistic. But there’s one simple way to see through them. | Security blog | Eset |
|
11.9.26 |
Wiz achieves GovRAMP High Authorization | Delivering unified cloud security and accelerating secure modernization to protect citizen data and critical infrastructure. | Security blog | Wiz Blog |
|
11.9.26 |
How to build a continuous penetration testing program | Headcount is the wrong lever. More security hiring, or more bought pentest days, feeds the one stream that can't scale, so coverage barely moves even when the budget clears. | Security blog | ESCAPE.TECH |
|
9.9.26 |
German Manufacturer Saves 15 Minutes Per Alert | To get an insider’s view on how teams navigate these industry demands, we sat down with Philipp Z., Security Lead at a leading German manufacturer. He shared how replacing complex manual analysis with ANY.RUN’s Interactive Sandbox helped his team accelerate incident response by 15 minutes per case, eliminate tedious routines, and strengthen their overall security posture. | Security blog | ANYRUN BLOG |
|
7.9.26 |
Attacking and Defending SCOM: Management Server Relay and Obtaining Run As Credentials | For organizations managing hundreds or thousands of servers, System Center Operations Manager (SCOM) provides a single pane of glass into system health, performance and availability. It is deeply integrated, broadly deployed and trusted with the access it needs to do its job. | Security blog | GUIDESECURITY |
|
5.9.26 |
CTEM vs BAS: The Difference and Why the Comparison Misses the Point | "CTEM vs BAS" is the wrong question. CTEM is a workflow. BAS is a product category that fits inside one stage of that workflow. The comparison peoWhat is CTEM (continuous threat exposure management)?ple actually need is BAS vs adversarial exposure validation (AEV), both of which sit inside CTEM's Validation stage. | Security blog | ETHIACK |
|
5.9.26 |
How we could save petabytes of cache storage with Zstandard and Pingora | Memory costs are increasing dramatically. Both RAM and hard disk drive prices have exploded over the past year. At Cloudflare, we run several massively distributed storage products (including our famous CDN) that rely on making efficient use of the memory we have deployed so we can continue to serve all of our customers. | Security blog | CLOUDFLARE |
|
5.9.26 |
Your ATS Is Now Part of Your Attack Surface | The attack that should worry your security team most this quarter didn't start with a phishing email. It started with a job application. | Security blog | ABNORMAL |
|
5.9.26 |
Introducing Agentic Code Scanning: The Holistic Cycode System Around Any Model | TL;DR: Agentic Code Scanning is the fourth dimension of Cycode’s code scanning spectrum, not a separate product bolted on. Deterministic SAST, AI SAST, SAST + AI Exploitability, and Agentic Code Scanning run as one single system that decides what runs where, so you stop trading precision vs. cost vs. model. It caught both authorization CVEs in our benchmark that no rule engine can express, and all on an affordable open-weights model. | Security blog | CYCODE |
|
5.9.26 |
Recent Update to FAQ Regarding SAQ Eligibility Criteria Could Affect Your PCI DSS Compliance | The PCI Security Standards Council (PCI SSC) updated FAQ 1331 on its website. This FAQ governs the use of Self-Assessment Questionnaire (SAQ) eligibility criteria as a guide for determining applicability of PCI DSS requirements for Report on Compliance (ROC) assessments. | Security blog | GUIDESECURITY |
|
5.9.26 |
Attacking and Defending SCOM: Management Server Relay and Obtaining Run As Credentials | For organizations managing hundreds or thousands of servers, System Center Operations Manager (SCOM) provides a single pane of glass into system health, performance and availability. It is deeply integrated, broadly deployed and trusted with the access it needs to do its job. | Security blog | GUIDESECURITY |
|
5.9.26 |
How attackers abuse PowerShell, WMI, and LOLBins | Windows environments already contain powerful tools capable of executing commands, changing configurations, communicating across networks, and managing operating systems. For administrators, these capabilities are essential, but they also provide attackers with a clear route to breach an environment. | Security blog | THREATLOCKER |
|
5.9.26 |
How to correlate Kubernetes audit logs with container runtime data | Two fields join the Kubernetes API to what ran inside the pod, and one turns up a container escape your process events never recorded. | Security blog | ELASTIC |
|
5.9.26 |
Data access: the hidden cost of security vendor lock-in | Getting data into a security platform is always easy; getting it back out is where vendors add cost, extra tooling, and latency, and it is the part of the evaluation most teams overlook. | Security blog | ELASTIC |
|
5.9.26 |
CrowdStrike Delivers the Next Evolution of the Agentic SOC | The agentic SOC provides a foundation that agents can reason over, teams of expert agents that learn each environment, and one workspace to build and govern it all, delivered on the Falcon platform. | Security blog | CROWDSTRIKE |
|
3.9.26 |
Docker OIDC connections for GitHub Actions available for Docker Orgs | Docker | TL;DR: Docker now supports OpenID Connect (OIDC) for GitHub Actions. Your workflows can authenticate with short-lived, per-run tokens instead of stored PATs or OATs. No secrets to rotate, no credentials to leak. | Security blog | DOCKER |
|
3.9.26 |
eSentire Wins 5 G2 Badges in the Fall 2026 Grid® Reports | eSentire | We are thrilled to share that eSentire has once again been recognized with multiple badges by G2 as part of their Fall 2026 Grid® Reports! The quarterly G2 Grid® Reports provide a high-level overview of the top leaders in any given product category, based on peer-to-peer feedback from real customers and market presence (based on market share, seller size, and social impact). | Security blog | ESENTIRE |
|
3.9.26 |
Release Notes: Faster TI Investigations & 650+ Threat Updates | Security teams need threat intelligence that helps them move quickly from a suspicious indicator to the context, evidence, and next action. ANY.RUN’s August updates focus on making that process faster and more practical, while expanding detection coverage across host, file, and network activity. | Security blog | ANYRUN BLOG |
|
2.9.26 |
Your Security Vendor May Not Be Telling You the Truth About Your MTTD – Here's Why | That would be inaccurate. The robbery did not start when the security guard called 911. It started when the attacker entered the building. Those first 45 minutes matter. They are the difference between understanding the full incident and reporting only the moment it becomes visible. | Security blog | RELIAQUEST |
|
2.9.26 |
Triage & Response Bottlenecks Eating into MSSP Margins: How to Remove the Friction | That gap shows up in triage and response first. Teams spend too much time checking IOCs, switching between tools, rebuilding context, and escalating cases that could have been closed earlier. Across thousands of investigations, those extra minutes turn into slower response, more pressure on Tier 2, and higher delivery costs. | Security blog | ANYRUN BLOG |
| 27.8.26 | ASIC Sounded the Alarm. Mobile is Where the Attack Starts. | On May 8, Commissioner Simone Constant of the Australian Security Investments Commission (ASIC) sent an open letter directly to every bank, superannuation fund, insurer, and financial services licensee in Australia. Not a report. Not a consultation. A direct instruction to boards and risk committees demanding urgent action on AI and cyber risk. Here's the full threat picture every CISO needs to add to that conversation. | Security blog | ZIMPERIUM |
| 27.8.26 | Why Financial Services Is the Canary in the Code Mine | Organizations have long known that attackers publish malicious packages to public open source registries. The more consequential question is if those packages are actually reaching enterprise development environments. | Security blog | SONATYPE |
| 27.8.26 | NHI Security: Is an Agent Just a Bot with PR? | I’ve recently spent time at identity-focused conferences and couldn’t miss all the messaging about agentic solutions. It got me thinking: agents are just bots with a better PR team. For over a decade, “bot” has been a dirty word. Botnets. Credential-stuffing bots. Bot traffic you pay to filter out. There is an entire security category designed to mitigate the impact of bots. And now, bot traffic now outnumbers human traffic. | Security blog | FLARE.IO |
| 27.8.26 | Agentic SOC alert triage: 60% to 92% AI accuracy | Elastic Security Labs | Elastic's InfoSec team runs three agents that read the detection rule's investigation guide and the closure reasons on 30 days of past cases. Analysts now clear most alerts with a single click in Slack. | Security blog | ELASTIC |
|
22.8.26 |
UNISOC T612 LPE | Summary UNISOC (Shanghai) Technologies Co., Ltd. is a top-three global fabless semiconductor company headquartered in Shanghai, specializing in 2G/3G/4G/5G mobile communication, IoT, and smart device chipsets. Formerly Spreadtrum, it serves major brands like Honor, realme, | Security blog | SSD-DISCLOSURE |
|
22.8.26 |
Rust Supply-Chain Attack: arrayref, internment, and append-only-vec Poisoned by the proc-macro1 Build-Time Dropper | A compromised maintainer account and a same-day impersonator of one of Rust's best-known authors turned a routine cargo update into silent remote code execution. Three crates from the same owner were poisoned in 23 minutes (arrayref, internment, and append-only-vec), alongside six attacker-owned crates now deleted from crates.io. | Security blog | STEPSECURITY |
|
22.8.26 |
Don’t Break the Agent: Lessons in Token Optimization | Measuring a token optimizer when your users are 1,000 engineers and your test suite is production | Security blog | JFROG |
| 22.8.26 | Every detection needs a next step: Why runbooks solve the investigation problem | An alert appears in the security operations center. It reports a suspicious sign-in from an unusual location, involving an account that matters. The analyst opens it and reviews the information provided by the detection. | Security blog | SEKOIA |
|
22.8.26 |
CrowdStrike Named Strongest Overall Leader in 2026 Frost Radar™: Cloud Workload Protection Platforms | Falcon Cloud Security earns the highest scores in both Innovation and Growth by connecting risk, adversary intelligence, and real-time protection to stop attacks. | Security blog | CROWDSTRIKE |
| 22.8.26 | Brand Impersonation Takedown: From Whack-a-Mole to Managed Response | Manual brand impersonation takedowns fail because attackers move faster than ticket-based abuse reports can resolve. Solution? Managed takedowns. | Security blog | Cyble |
|
15.8.26 |
Inside the Modern SOC: The Identity Front Door | In The 72-Minute Race, we explored how attackers are compressing the time between initial access and business impact. But as attacks continue to accelerate, another trend has emerged: Attackers are increasingly gaining access through compromised identities rather than exploiting technology vulnerabilities. | Security blog | Palo Alto |
|
15.8.26 |
Why metaphor may dictate your security strategy | In this week's newsletter, Martin looks at how the metaphors we use to describe AI "escaping" its sandbox can completely change how we react to the threat. | Security blog | CISCO TALOS |
|
15.8.26 |
Black Hat USA 2026: What the Hugging Face hack tells us about human responsibility | The incident involving OpenAI models shows that autonomous hacks make human oversight more important, not less | Security blog | Eset |
|
8.8.26 |
Benchmarking the Agentic SOC: How we evaluate LLMs for security workflows | Public leaderboards can't tell you which LLM to trust in your SOC, so Elastic built an evaluation framework that grades models on the work (tool calls, execution traces, blind judging) across Agent Builder, Attack Discovery, and automatic migration. | Security blog | ELASTIC |
|
1.8.26 |
Threat Coverage Digest: New TI Report, Threat Research and 750+ Detection Rules | July brought another set of threat coverage updates designed to help security teams work faster and with more confidence. ANY.RUN added 42 behavior signatures, 11 YARA rules, and 703 Suricata rules, giving SOCs broader visibility across files, malware behavior, and network activity. | Security blog | ANYRUN BLOG |
|
1.8.26 |
Infrastructure Health, Now Agentic: The IT Engineer Teammate Is Here | Technology and infrastructure health is the foundation of the SOC. Investigations, threat hunts, and detection engineering all assume the same thing: the tools underneath are up, generating telemetry, and functioning as intended. When that assumption breaks, the rest of the SOC breaks with it. | Security blog | RELIAQUEST |
|
1.8.26 |
Stop rewriting detection rules by hand: automatic Sentinel-to-Elastic migration is here | Elastic's first automatic migration from a modern SIEM. Translate your Sentinel detection rules into Elastic Security without rebuilding them. | Security blog | ELASTIC |
| 27.6.26 | Introduction to COM usage by Windows threats | Component Object Model (COM) is a fundamental Windows technology used by legitimate applications for object activation, inter-process communication, automation and language-independent component reuse. Those same qualities make it useful to threat actors. | Security blog | CISCO TALOS |
| 27.6.26 | SMB cyber readiness: the road to resilience starts here | Security blog | Eset | |
| 19.6.26 | Protecting legacy OT systems against modern cyberthreats | Many manufacturing plants depend on OT systems that stay in service for many years. That long run can hide significant cybersecurity risks. | Security blog | Eset |
| 6.6.26 | You do surprise me.exe: An unexpected executable in Hola Browser | Following a certification test, Sophos X-Ops found an unexpected guest had hitched a ride | Security blog | SOPHOS |
| 6.6.26 | Microsoft Secure Boot Certificates Expiring in 2026: Enterprise Impact | Three certificates expire, two UEFI stores are affected, and one permanent gap opens if you miss the deadline. You can use Eclypsium’s solution to identify these gaps that will inevitably affect your Windows fleet. | Security blog | Eclypsium |
| 6.6.26 | DICOM, Pydicom, GDCM, and Orthanc: A technical tour of what really happens in the heap | This white paper presents a concrete case study demonstrating the creation of a heap overflow vulnerability through the exploitation of the DICOM file format. | Security blog | CISCO TALOS |
| 23.5.26 | DBIR 2026: Network Asset Breaches Up 3x as Vulnerability Exploitation Accelerates | The Verizon Data Breach Investigations Report remains one of the most useful annual sources for understanding how real-world breaches are changing. The 2026 report analyzes more than 31,000 security incidents, including more than 22,000 confirmed data breaches, and shows a clear shift in attacker focus: exploitation of vulnerabilities is now the leading known initial access vector. | Security blog | Eclypsium |
| 23.5.26 | Inside the JDownloader Supply-Chain Attack: An r77 Rootkit Bot That Kills Your Antivirus | Malware that hid itself on infected systems and disabled antivirus protection. | Security blog | GENDIGITAL |
| 23.5.26 | Paved With Intent: ROADtools and Nation-State Tactics in the Cloud | ROADtools is a publicly available toolkit for offensive and defensive security purposes that attackers have integrated into cloud attacks. The tool is designed to: | Security blog | Palo Alto |
| 23.5.26 | The art of being ungovernable | In this edition of the Threat Source newsletter, William explores the value of being "ungovernable" in a professional setting, sharing how challenging the status quo and seeking out the smartest people in the room can lead to a more fulfilling and successful career. | Security blog | CISCO TALOS |
| 16.5.26 | Undermining the trust boundary: Investigating a stealthy intrusion through third-party compromise | Microsoft Incident Response investigated an attack operated through legitimate and trusted administrative mechanisms to blend seamlessly into routine operations and remain undetected demonstrating that intrusions have increasingly avoided using noisy exploits, obvious malware, or custom tooling, instead leveraging systems that organizations already trust within their environments. | Security blog | Microsoft blog |
| 16.5.26 | What Is the Instructure Canvas Breach? Impact, Risks, and What Institutions Should Do | The Instructure Canvas breach affects universities, K–12 school districts, and teaching hospitals globally. This blog entry intends to provide context and practical guidance. | Security blog | Trend Micro |
| 16.5.26 | The time of much patching is coming | In this week’s newsletter, Martin reflects on what the next iteration of AI tools means for vulnerability discovery and our ability to manage large-scale patch releases. | Security blog | CISCO TALOS |
| 16.5.26 | Eyes wide open: How to mitigate the security and privacy risks of smart glasses | Smart glasses allow anyone to track and record the world around them. That could put your data and the privacy of those nearby at risk. | Security blog | Eset |
| 9.5.26 | Cyble Named a Challenger in the 2026 Gartner® Magic Quadrant™ for Cyber Threat Intelligence | Recognized for Completeness of Vision and Ability to Execute | Security blog | Cyble |
| 9.5.26 | Unplug your way to better code | Cybersecurity concepts — logs, packets, DNS exfiltration, and more — are usually intangible, and its practitioners are prone to mental fatigue, Amy takes a second to yell at you to go touch grass. | Security blog | CISCO TALOS |
| 9.5.26 | Fixing the password problem is as easy as 123456 | How come it’s still possible to ‘secure’ an online account with a six-digit string? | Security blog | Eset |
| 25.4.26 | Supply chain attacks hit Checkmarx and Bitwarden developer tools | Two supply chain attacks, same day, same command-and-control domain | Security blog | SOPHOS |
| 25.4.26 | Strengthening authentication with passkeys: A CISO playbook | Our passkey rollout took three tries. Here's a playbook to make your implementation smoother. | Security blog | SOPHOS |
| 25.4.26 | Sophos Firewall v22 MR1 is now available | Sophos Firewall v22 bolstered Secure by Design, taking it to a whole new level with major updates to the architecture and new features like the Health Check to help identify high-risk configurations. | Security blog | SOPHOS |
| 18.4.26 | More than pretty pictures: Wendy Bishop on visual storytelling in tech | Wendy shares the unique challenges and rewards of bridging the gap between artistic expression and highly technical research. | Security blog | CISCO TALOS |
| 28.3.26 | Virtual machines, virtually everywhere – and with real security gaps | Cloud VMs offer unmatched speed, scale and flexibility – all of which could eventually count for little if they’re left to fend for themselves | Security blog | Eset |
| 14.3.26 | CISOs in a Pinch: A Security Analysis of OpenClaw | Learn about OpenClaw (a sovereign agent) and how this can be viable for enterprises. | Security blog | Trend Micro |
| 7.3.26 | Firewall Vulnerability Exploitation: Why the Edge is Fraying | There is a reasonable assumption baked into most enterprise security strategies: the firewall is the defender. It sits at the edge, it inspects traffic, it keeps the bad stuff out. Organizations spend real money on these devices specifically because of that assumption. | Security blog | Eclypsium |
| 7.3.26 | How SMBs use threat research and MDR to build a defensive edge | We speak to Director of ESET Threat Research Jean-Ian Boutin about where solutions that blend advanced technology with human expertise provide the most practical value for businesses | Security blog | Eset |
| 7.3.26 | Protecting education: How MDR can tip the balance in favor of schools | The education sector is notoriously short on cash, but rich in assets for threat actors to target. How can managed detection and response (MDR) help learning institutions regain the initiative? | Security blog | Eset |
| 28.2.26 | Bring the Fight to the Edge: Turning Time Into an Advantage in OT Security | Industrial organizations are facing a growing paradox in cybersecurity. While operational technology (OT) environments are increasingly connected, most security strategies still assume threats will only materialize once attackers reach the plant floor. | Security blog | Palo Alto |
| 21.2.26 | Is it OK to let your children post selfies online? | When it comes to our children’s digital lives, prohibition rarely works. It’s our responsibility to help them build a healthy relationship with tech. | Security blog | Eset |
| 14.2.26 | SMS & OTP Bombing Campaigns: Evolving API Abuse Targeting Multiple Regions | Cyble analyzes expanding OTP/SMS bombing ecosystems using high‑speed APIs, SSL bypass, and cross‑platform automation. | Security blog | Cyble |
| 14.2.26 | When SPNs Go Rogue: Detection and Remediation with Trellix NDR | To address this detection gap, the blog shows how Trellix Network Detection and Response (NDR) detects Kerberoasting activity by analyzing deviations in identity behavior and comparing network-level telemetry. | Security blog | Trelix |
| 17.1.26 | AuraInspector: Auditing Salesforce Aura for Data Exposure | Mandiant is releasing AuraInspector, a new open-source tool designed to help defenders identify and audit access control misconfigurations within the Salesforce Aura framework. | Security blog | |
| 10.1.26 | How Cisco Talos powers the solutions protecting your organization | What happens under the hood of Cisco's security portfolio? Our reputation and detection services apply Talos' real-time intelligence to detect and block threats. Here's how. | Security blog |