When trust becomes the payload: Inside the threats, etc quarterly report
In the cybersecurity community, we build our defenses on a foundation of trust. We trust an AI coding assistant because it’s on our approved software…
Category: ThreatIntelligence-IncidentResponse
PHP2Shell on Windows and macOS: Fix Without a Patch
Executive Summary PHP2Shell (CVE-2026-109618 and CVE-2026-109619) allows unauthenticated remote code execution on exposed PHP servers. PHP has released fixed versions. On Linux, distribution packages carry…
Stay FedRAMP Authorized with Qualys Policy Audit
Key Takeaways FedRAMP authorization isn’t the finish line. Providers are expected to keep monitoring their security posture and give federal agencies the information they need…
CISA AA26-194A: Automate Cisco Router Checks
Key Takeaways CISA AA26-194A provides actionable guidance to improve the security of Internet-facing Cisco routers against real-world attack techniques. The advisory focuses on configuration hardening…
php2shell: Why One Exploit Doesn’t Work Everywhere
php2shell raised fears of mass exploitation. A week of testing by our research team found that working exploits had to be fitted to each target’s…
Can’t Patch Node.js Yet? Build a Stopgap with the Controls You Own
Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale…
Windows Endpoint Security Platform: Inside wesp.sys
Microsoft is building a way for EDR products to run outside the Windows kernel. It is called the Windows Endpoint Security Platform, and two of…
Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own
Executive Summary PHP2Shell’s fix is to update PHP, but patching at scale is slow. Only 199,000 of 156 million PHP installations were patched in the…
How CVE-2026-73570 turns a Zimbra log file into remote code execution
When we are building detections for various threats, we regularly run the exploits on representative systems to help us build high-quality rules. The Common Vulnerabilities…
Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do
Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated…
Elastic SIEM tags: Providing useful detection context for prioritization
Of Elastic’s 2100+ prebuilt detection rules, 385 are tagged Profile: Recommended and 296 are tagged Aggressive. The rest (62% of the list) are deliberately left…
Tenable: Single multilingual model, native detection in 10 languages
AI security tools that can only detect threats in English offer limited protection. Here’s how Tenable trained our threat detectors to process nine additional languages…