July 2026 Patch Tuesday: Largest Patch Tuesday 569 CVEs
56Critical 510Important 3Moderate 0Low Microsoft addresses 569 CVEs in the largest Patch Tuesday release yet. This month’s release includes three zero-days, two of which were…
Category: ThreatIntelligence-IncidentResponse
CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)
Overview Rapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated…
Cybersecurity Awareness Month is Ending, but Holiday Threats Are Just Getting Started
“Is Die Hard a Christmas movie?” At every holiday party, without fail, someone’s going to throw that question your way. And whether you’re willing to…
Threat Actors Achieve Persistence After SQL Injection
Acknowledgments: Special thanks to the efforts of Stephanie Fairless for the contributions to this investigation. “The call is coming from inside the house.” Defenders often…
No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack
Acknowledgments: Special thanks to Dave Kleinatland, Matt Kiely, Jamin Becker, Bryan Masters, Justin Allen, and Arnelle French for their contributions to this investigation. UPDATE @…
How the RaaS Business Model Actually Works
When most people hear the word “disruption,” they think about business growth, new markets, or a competitor making a bold move. Ransomware crews have their…
Celebrating Canada Day with Localized Managed Phishing
We hope all of our Canadian readers had a happy Canada Day! As you settle back in from what was hopefully a relaxing day off,…
Meta Phishers Abuse Business Account Manager Service
Beginning late last year, an unknown threat actor took advantage of a service offered by Meta meant to connect businesses who use Facebook or Instagram…
LoTL Abuse: How to Spot It vs. Normal Admin Activity
At 5:47 p.m. on a Friday, someone runs PowerShell in your environment. Maybe it’s a tired admin finishing one last task before signing off. But…
AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration
AI-augmented tradecraft is changing the threat landscape that defenders have operated in. For years, defenders have relied on identifying the signatures and behaviors of off-the-shelf…
How to Meet CISA BOD 26-04’s 3-Day Remediation SLA
Key Takeaways CISA BOD 26–04 mandates remediation of the publicly exposed, highest-risk, known-exploited vulnerabilities within 3 days. The directive applies a risk-based model evaluating exposure,…
Conditional Access Misconfigurations Exposed 55 Orgs with MFA On
In March 2026, our SOC caught a surge of anomalous Microsoft 365 logins across dozens of organizations simultaneously. The source: a handful of IP addresses…