Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

How Network Discovery Tools Map Every Device on a Company Network

A company network changes as staff connect laptops, printers, phones, servers, and virtual machines. Some devices remain for years; others appear briefly during projects, maintenance, or seasonal work. An incomplete inventory can leave an unmanaged endpoint exposed or slow an investigation. Network discovery gives IT teams a repeatable way to identify equipment and record details they can verify and maintain. The process starts with scans, but a useful map depends on what happens after detection.

Cato CTRL Threat Brief: Cato AI native SASE delivers PHP2Shell protection at machine speed

On 21 October 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities known as PHP2Shell that can enable unauthenticated remote code execution. Cato’s self-evolving CVE mitigation agent helped turn the investigation into concrete research output by creating a proof of concept and generating an IPS signature in minutes. The agent connects vulnerability analysis, controlled lab testing and protection generation.

Uncovering the eMudhra incident: A Zeek detection

This week, two big vulnerabilities are in the news. The first one is the PHP2Shell vulnerability, for which a Zeek detector was published yesterday. The second, equally important, vulnerability is the compromise of some intermediate certificates of the eMudhra Certificate Authority (CA).

Defender Spotlight Ep. 2: Spotting Suspicious RDP with Corelight Anomaly Detection

When a host suddenly starts serving RDP traffic, it’s time to investigate. See how a Corelight customer used ML-powered anomaly detection to flag unexpected network behavior that could indicate unauthorized remote access or lateral movement.

Make Your SIEM Smarter with Cato

Effective security operations require more than isolated alerts. Analysts need context from across the environment to understand what happened, assess its significance, and decide what to do next. That is why accessing insights and telemetry from across your networking and security stack is critical to teams using a SIEM tool.

Building "php2shell" detections before coordinated disclosure

We recently collaborated with OpenAI, PHP, and a number of other organizations to respond to a pair of serious remote code execution vulnerabilities in PHP that are likely to impact the majority of the world's public web servers. PHP underpins a large part of the web, powering content management systems, online stores, and business applications. Its security matters to vital services that millions of people and organizations rely on daily.

The Benefits of Segmenting Visitor Wireless Access from Corporate Networks

Convenient internet access is available to visitors through guest Wi-Fi without granting them entry into internal systems. Risks to digital safety are present when guests utilize the same infrastructure as corporate computers and servers. Partitioning these connections is a method to safeguard private data and ensure consistent connection speeds. Network isolation is a functional component of a security plan for organizations that host clients or contractors.

Stop Guessing. Find the Root Cause with Cato DEM.

When a user says, “the application is slow,” IT has to answer a much harder question: where did the problem actually begin? The issue could be on the endpoint, local network, ISP, the network path, enterprise infrastructure, or application provider itself. That investigation often takes time because teams have to reproduce intermittent problems, collect evidence from separate tools, and hand cases between endpoint, network, and application owners.

Building a Network Appliance on RK3588? How Kiwi Pi 5 Pro and Orange Pi 5 Plus Compare

For gateways, edge nodes and remote monitoring boxes, the number of network paths a board offers often matters more than its benchmark score. Two popular RK3588 boards take noticeably different positions on that question.