BLOG
Notes from the field
Threat analysis, detection engineering and hands-on training notes from the practice.
-
Threat digest: 2026-10-25
PHP exploitation attempts keep climbing, a leaked LiteLLM master key turned into a poisoned package release, a ten week token replay campaign slipped past MFA at 79 organisations,…
-
Threat digest: 2026-10-24
PHP2Shell exploitation attempts escalated into Mirai botnet delivery while researchers published a working ASLR bypass, CISA added two more exploited flaws to its KEV catalog, and an AI…
-
Threat digest: 2026-10-23
PHP2Shell exploitation was traced back four days before its patches shipped, attackers exploited a third VeloCloud Orchestrator zero-day, and an Indian certificate authority began exiting the TLS business…
-
Threat digest: 2026-10-22
PHP shipped emergency fixes for two critical PHP2Shell RCE flaws as exploitation attempts began, GitLab patched a CVSS 10.0 unauthenticated RCE, and a compromised LiteLLM release pushed a…
-
Threat digest: 2026-10-21
Two critical PHP remote code execution flaws leaked ahead of today's emergency release, CISA and partners count about 600 SafePay ransomware victims, and eight compromised eMudhra CA keys…
-
Threat digest: 2026-10-20
A backdoored Rank Math PRO release leaves WordPress sites needing a full clean-up, an unpatched Broadcom Wi-Fi flaw puts routers at risk from radio range, and F5 ships…
-
Threat digest: 2026-10-19
A quiet Sunday was led by three exploited flaws: a public Plex Media Server exploit chain, an actively attacked Japanese WAF, and a breach at AI coding tool…
-
Threat digest: 2026-10-18
A stolen ConnectWise backup credential opened Microsoft 365 tenants across its managed service provider customer base, while California confirmed that millions of student records were copied from a…
-
Threat digest: 2026-10-17
Two actively exploited flaws entered CISA's known exploited list on the same day, a BeyondTrust authentication bypass used by a China-linked group and a Fortinet path traversal tied…