Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

sophos

Malicious Claude Code extension distributed through Cursor marketplace

Oct 30, 2026 By Sophos X-Ops In Sophos
On October 29, 2026, Cursor reported that a malicious version of Anthropic’s Claude Code extension (2.1.313) was available in the Cursor extension marketplace between approximately 09:27 and 20:35 UTC. Cursor identified impacted macOS and Windows packages and estimates that up to 5,000 users were affected.
Read Post
sophos

AI used in Aur0ra ransomware testing and execution

Oct 29, 2026 By Sophos Counter Threat Unit Research Team In Sophos
In May 2026, Counter Threat Unit (CTU) researchers published a report on an AI-assisted post-exploitation framework that tested the capabilities of multiple vendors’ endpoint detection and response (EDR) solutions, including the Sophos agent. Following a testing phase, Sophos analysts observed the same infrastructure hosting Cobalt Strike in support of Aur0ra ransomware (also known as Aurora ransomware) operations.
Read Post

Sophos Network Security: Use Network Maps

Oct 29, 2026 By Sophos In Sophos
Network Map helps admins quickly visualize network topology, understand device relationships, and troubleshoot connectivity issues from a single interface. Learn how to access and use Network Maps in Sophos Fusion to locate devices, utilize Live Discover queries to retrieve device history, and block or release hosts with Active Threat Response (ATR) powered by Sophos Fusion APIs. Ask questions and get expert answers in the Sophos Community.
View Video
sophos

Physical Penetration Testing: When Human Trust Bypasses Layers of Security with a Simple Pretext

Oct 29, 2026 By Adrian Dinca In Sophos
This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI-era threats. Every physical penetration test starts with the same quiet hope: that somewhere, between the polished lobby, the badge readers, the CCTV domes, and the confident hum of office life, there is a tiny gap no one has noticed.
Read Post
sophos

'Node2Shell' vulnerability (CVE-2026-111497) in active exploitation

Oct 28, 2026 By Sophos Counter Threat Unit Research Team In Sophos
On October 21, 2026, Node.js released updates to address multiple vulnerabilities, including an issue in Brotli decoder (CVE-2026-111497). This critical buffer overflow vulnerability (CVSS score of 9.2) has become widely known as Node2Shell but has also been referred to Broccoli2Shell and HTTP2Shell. The issue exists in the Brotli decoder (c/dec/decode.c) in multiple Google Brotli versions, and products that rely on Brotli implementations are vulnerable.
Read Post
sophos

Never Bring a Knife to a Gun Fight!

Oct 28, 2026 By Chris Ahearn In Sophos
In the world of cyber incident response, experience teaches one truth over and over again: speed matters, precision matters, and coordination matters. But perhaps one of the most overlooked lessons, often learned the hard way, is this: Choosing the right legal counsel is just as critical as selecting the right Digital Forensics and Incident Response (DFIR) firm.
Read Post
sophos

Is "SIEM-less" really what it sounds like?

Oct 23, 2026 By Ratnesh Saxena In Sophos
SIEM-less security may sound like an escape from traditional SIEM complexity and costs, but the underlying capabilities still have to exist somewhere. A SIEM is a multipurpose tool. It brings together cyber and physical security use cases; drives threat detection, investigation, and response (TDIR); serves as a system of record for governance, regulatory, and compliance needs; and supports observability use cases tied to resilience and service degradation. The list goes on.
Read Post
manageengine

AI threat detection: From reactive alerts to proactive defense

Oct 22, 2026 By Sisupang S In ManageEngine
A suspicious login, an unexpected privilege change, and a surge in file downloads may reach your security team as separate alerts. Understanding whether they belong to the same attack requires context. For your IT and security operations teams, connecting these signals takes time. If you're a CIO or CTO, that delay can increase your exposure to operational disruption and data loss. AI threat detection helps you analyze security activity, identify suspicious patterns, and prioritize investigations.
Read Post
Corelight

Uncovering the eMudhra incident: A Zeek detection

Oct 22, 2026 By Johanna Amann In Corelight
This week, two big vulnerabilities are in the news. The first one is the PHP2Shell vulnerability, for which a Zeek detector was published yesterday. The second, equally important, vulnerability is the compromise of some intermediate certificates of the eMudhra Certificate Authority (CA).
Read Post

Sophos Mobile Overview: Unified MDM and Mobile Threat Defense

Oct 22, 2026 By Sophos In Sophos
Mobile devices keep your business moving, but managing them's only half the battle. You've got to secure the users, apps, and business data that depend on them. Sophos Mobile brings mobile device management and mobile threat defense together in one intuitive experience, helping you simplify administration, protect corporate data, and guard users against mobile threats.
View Video

Defender Spotlight Ep. 2: Spotting Suspicious RDP with Corelight Anomaly Detection

Oct 21, 2026 By Corelight In Corelight
When a host suddenly starts serving RDP traffic, it’s time to investigate. See how a Corelight customer used ML-powered anomaly detection to flag unexpected network behavior that could indicate unauthorized remote access or lateral movement.
View Video
Corelight

Building "php2shell" detections before coordinated disclosure

Oct 21, 2026 By Ben Reardon In Corelight
We recently collaborated with OpenAI, PHP, and a number of other organizations to respond to a pair of serious remote code execution vulnerabilities in PHP that are likely to impact the majority of the world's public web servers. PHP underpins a large part of the web, powering content management systems, online stores, and business applications. Its security matters to vital services that millions of people and organizations rely on daily.
Read Post
sophos

Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Oct 21, 2026 By Sophos Counter Threat Unit Research Team In Sophos
In response to requests, this update consolidates the Sophos countermeasures that relate the PHP2Shelll vulnerabilities. SophosLabs has developed the following countermeasures to specifically detect activity associated with this threat. The next table lists additional pre-existing Sophos countermeasures that will likely address post-exploitation activity associated with these vulnerabilities.
Read Post
sophos

Web App Owners - You're on Notice. Your Low-Hanging Fruit Just Got Lower

Oct 21, 2026 By Chris Ahearn In Sophos
Recent incident response investigations reveal how AI-assisted attackers are chaining web application vulnerabilities, credential theft, privilege escalation, and lateral movement into autonomous intrusion workflows. This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI-era threats.
Read Post
sophos

Why Incident Response Demand Will Grow Faster than Expected

Oct 20, 2026 By Dan Levesque In Sophos
This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI-era threats. A 20% growth forecast for cybersecurity talent sounds significant. I believe it understates what we are going to see in Incident Response. The U.S.
Read Post
sophos

BRONZE SANDCASTLE deploys modified Meterpreter shells

Oct 20, 2026 By Sophos Counter Threat Unit Research Team In Sophos
The China-based threat group uses DLL sideloading in these attacks Counter Threat Unit (CTU) and SophosLabs researchers investigated a cluster of incidents attributed to the BRONZE SANDCASTLE threat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading.
Read Post
sophos

ConnectWise Cloud Backup application abused in cross-tenant token sweep

Oct 19, 2026 By Sophos X-Ops In Sophos
Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants On October 15, 2026, Sophos X-Ops researchers identified a series of service principal sign-ins in which a threat actor authenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants.
Read Post
sophos

Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion

Oct 19, 2026 By Andrew Bonwell In Sophos
Traditional business email compromise (BEC) is often thought of as a mailbox problem: a stolen account, unauthorized access to email, forwarding rules, and (sometimes) outgoing mail impersonating the compromised user. But more recent incidents show how far beyond “email only” these intrusions can extend once an attacker gains control of a cloud identity.
Read Post

Sophos Firewall: DNS enhancements

Oct 19, 2026 By Sophos In Sophos
Sophos Firewall v23 brings new DNS enhancements including DNS-over-HTTPS (DoH) support, DNS security extension (DNSSEC) support, and one-click Secure DNS set up, made possible through native integration with Sophos Fusion. Learn about the new enhancements and the steps to set up Secure DNS Protection, third-party DNS services, and DNSSEC protection. Ask questions and get expert answers in the Sophos Community.
View Video
sophos

Sophos ITDR expands identity protection for the AI era

Oct 15, 2026 By Marlene Jones In Sophos
Sophos ITDR now delivers deeper AI identity visibility, expanded Microsoft support, faster response, and seamless deployment. Identity has become one of the most targeted attack surfaces in cybersecurity, with attackers increasingly relying on stolen credentials, compromised sessions, excessive privileges, and identity misconfigurations to gain access.
Read Post

Sophos Fusion: Securing the AI Era for MSPs

Oct 15, 2026 By Sophos In Sophos
Discover how Sophos Fusion helps Managed Service Providers (MSPs) simplify operations, improve security outcomes, and grow profitability with an AI-native cybersecurity defense system. Chapters Introduction to Sophos Fusion Unified Defense vs. Disconnected Tools Connected Protection Stack (Endpoint, Firewall, Email, MDR, Identity, Network) Shared Intelligence and Unified Response Simplified Management (Multi-tenant, Automation, RMM/PSA Integrations)
View Video
sophos

AI governance needs more than a policy document

Oct 13, 2026 By Bud Ellis In Sophos
AI tools have made it remarkably easy for a company to expose its own data: None of these actions seem malicious, but each one moves sensitive information somewhere the security team cannot see. This new era of "move fast and break things”, a phrase famously coined by Mark Zuckerberg in the early Facebook days, benefits attackers. Company data now flows through more places, more third parties, and more delegated credentials.
Read Post

Introducing Sophos AI Defense

Oct 13, 2026 By Sophos In Sophos
Sophos AI Defense finds the AI tools employees and applications are using, including the ones security teams never approved, and enforces policy wherever they run. Every AI tool an organization can’t see is a potential gap in confidentiality, integrity, and availability. Delivered through Sophos Fusion, the AI-native cybersecurity defense system, Sophos AI Defense connects controls on the device, across the network, at sign-in, and in the browser into one line of defense, so teams can safely adopt AI faster without adding another disconnected tool to manage.
View Video
Corelight

CVE-2026-70111: How Corelight uncovered a 0-Day affecting Microsoft Distributed File System

Oct 13, 2026 By Travis Green & Labs Team In Corelight
In the process of fuzzing MS-RPC and Distributed File System (DFS) APIs, we discovered a one-packet mechanism set to crash an entire Windows server, which the Microsoft Security Response Center (MSRC) later assigned as CVE-2026-70111.
Read Post
sophos

Building intent-based access control without reading minds

Oct 13, 2026 By Nash Borges In Sophos
This article was first published on LinkedIn. In Minority Report, the Department of Precrime promised certainty. Three precognitives saw the future, the system picked the consensus, and police arrested people for murders they hadn't yet committed. The whole machine depended on one buried secret: sometimes the precogs disagreed, and the dissenting vision, the minority report, was quietly deleted. The system held together as long as the precogs agreed, but broke when it removed its own doubt.
Read Post
sophos

Stopping attackers who want your endpoint protection to go dark

Oct 13, 2026 By Sophos In Sophos
EDR Killers let attackers blind endpoint protection before the real attack begins, and Sophos Endpoint stops them with several layers that are on by default. Most people picture a cyberattack as something loud: files encrypting, screens locking, a ransom note. But the attacks that do real damage usually start quietly. Before an attacker steals data or deploys ransomware, they try to make sure nobody is watching. That means dealing with the endpoint protection on the device first.
Read Post
sophos

Sophos AI Defense is now generally available

Oct 13, 2026 By Bud L. Ellis In Sophos
Bring AI out of the shadows with visibility and control that help your organization adopt AI securely. When we introduced Sophos AI Defense in July, we focused on a challenge facing organizations everywhere: AI adoption is accelerating, often faster than security and IT teams can see or control it. New AI tools, embedded capabilities, and shadow AI are creating blind spots around where AI is being used and what information it can access.
Read Post
Sponsored Post
Endpoint Central through the AV-Comparatives lens

Endpoint Central through the AV-Comparatives lens

Oct 10, 2026 By Jeyarani S In ManageEngine
Getting certified by AV-Comparatives is not straightforward. The organisation runs one of the most thorough independent endpoint security evaluations available. Vendors must comply with comprehensive security software evaluations to receive unbiased feedback regarding their products and feature updates.
Read Post
Corelight

Corelight in the Black Hat USA NOC: A playlist of attendee mistakes

Oct 9, 2026 By Mark Overholser In Corelight
When I got back from Black Hat USA, I was stunned. Of course, it’s easy to be overwhelmed by Black Hat. There is so much going on. Las Vegas casinos are loud and flashy. Going outdoors feels like standing on the surface of the sun. Everywhere you walk there are strong smells, and you hope it’s a delicious meal, but sometimes it’s not.
Read Post
Corelight

Hunting Citrix NetScaler zero-days with Corelight: Part 2

Oct 9, 2026 By Deepali Prasad In Corelight
In Hunting Citrix NetScaler zero-days with Corelight, we explored how network evidence from Corelight’s Open Network Detection and Response (NDR) Platform can help identify candidate NetScaler appliances, observe DTLS use and hunt for suspicious activity.
Read Post
Securonix Introduces Advanced Behavioral Analytics to Detect Human and AI-Driven Threats

Securonix Introduces Advanced Behavioral Analytics to Detect Human and AI-Driven Threats

Oct 8, 2026 By Securonix In Securonix
New solution uses behavioural intelligence and governed Agentic AI to uncover human and AI-driven threats while keeping analysts in control, backed by new ISO/IEC 42001:2023 certification for responsible AI management.
Read Post

Episode 25 - Zeek at 30: Vern Paxson on Origins and Enduring Logs (Part 1)

Oct 8, 2026 By Corelight In Corelight
Richard Bejtlich sits down with Vern Paxson, Corelight co-founder and Chief Scientist, to explore Zeek's 30-year journey from a Berkeley Lab research project to a data-rich backbone of modern NDR. They unpack how Zeek evolved from early TCP health measurements into a flexible, scriptable network analysis platform, the value of neutral, long-term logs over real-time alerts, comparisons to intrusion-detection approaches like Snort, and the challenges and opportunities of visibility in enterprise gear.
View Video
sophos

Understanding Asymmetric Routing Risks in Modern Firewall Deployments

Oct 6, 2026 By Joe DeGon In Sophos
In modern network environments, maintaining both operational efficiency and strong security controls requires careful design and planning. One of the more common challenges Sophos Professional Services encounters, especially during firewall upgrades or redesigns, is asymmetric routing.
Read Post
sophos

Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation

Oct 5, 2026 By Sophos Counter Threat Unit Research Team In Sophos
On October 4, 2026, Citrix disclosed a high-severity (CVSS score of 8.7) memory overflow vulnerability (CVE-2026-88779) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway deployments that are configured as either a SAML Service Provider (SP) or SAML Identity Provider (IdP). Successful exploitation can cause a denial of service (DoS) condition, potentially disrupting authentication services and remote access functionality.
Read Post
sophos

Sophos Named a Leader in the IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises 2026

Oct 2, 2026 By Sophos In Sophos
Sophos has been named a Leader in the IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises 2026, recognizing the strength of our prevention-first approach and stopping AI-era threats as early as possible. Attackers using frontier AI models can now find vulnerabilities and generate exploits faster than organizations can patch them. And when malicious code is already running before an alert fires, detection alone is too late.
Read Post
Sophos Launches CISO Advantage, Bringing CISO-Level Security Strategy Within Reach of Every Organization

Sophos Launches CISO Advantage, Bringing CISO-Level Security Strategy Within Reach of Every Organization

Oct 1, 2026 By Sophos In Sophos
Delivered through Sophos Fusion, Sophos CISO Advantage uses agentic AI with human judgement to give every organization, with or without a CISO, a security program it can measure, fund, and prove.
Read Post
sophos

Sophos CISO Advantage is now generally available

Oct 1, 2026 By Sophos In Sophos
Take control of your security outcomes. Sophos CISO Advantage is now generally available to the market, giving CISOs and security teams without a CISO the solution they need to build, manage, and improve a compliance-driven cybersecurity program. In July, we introduced Sophos CISO Advantage, explaining how it enables organizations and Managed Service Providers (MSPs) to understand cyber risk, prioritize what matters most, and demonstrate measurable improvement over time.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.