Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

sophos

Cisco Secure Email Gateway vulnerability (CVE-2026-76461) in active exploitation

Sep 15, 2026 By Sophos Counter Threat Unit Research Team In Sophos
On September 14, 2026, Cisco disclosed a vulnerability in Cisco Secure Email Gateway. CVE-2026-76461 is a critical (CVSS score of 9.8) SQL injection flaw in the email parsing functionality of Cisco AsyncOS Software. Successful exploitation “could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.” Cisco confirmed exploitation of the vulnerability in the wild, and the U.S.
Read Post
sophos

MSP Perspectives 2026: The evolution of the MSP cybersecurity value proposition

Sep 15, 2026 By Sophos In Sophos
MSPs are no longer simply being asked to manage technology; increasingly, customers are expecting them to provide cybersecurity leadership, deliver compliance programs, and guide security investment. Sophos’ 2026 MSP Perspectives Report reveals how demand for cybersecurity leadership, maturing compliance offerings, and the battle for scale are all shaping the managed services market.
Read Post
sophos

Devil's advocate? Uncensored Luciferus AI service advertised underground

Sep 14, 2026 By Sophos Counter Threat Unit Research Team In Sophos
On August 24, 2026, Counter Threat Unit (CTU) researchers observed an Exploit underground forum persona named “Optimus_Prime” advertising an uncensored AI subscription service named Luciferus. The persona joined Exploit on April 18, and their profile displays a “coding / coder” activity label. As of September 4, the persona has published 21 posts on the forum.
Read Post
sophos

ATT&CK grew a 15th tactic: A practical DFIR field guide to the Stealth / Defense Impairment split

Sep 14, 2026 By Marchelle David In Sophos
Artifacts and tooling for the new Enterprise MITRE ATT&CK matrix tactics, distilled from the field. This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI Era threats. If you’ve opened the Enterprise ATT&CK matrix recently, you may have done a double-take. The familiar Defense Evasion column is gone.
Read Post
Corelight

When the fuzzers come knocking on port 389: Hunting injection canaries in LDAP

Sep 11, 2026 By Ben Reardon In Corelight
It's easy to think of core infrastructure protocols like LDAP, Kerberos, DNS, SMB, and NTP as furniture. They're so old, so ubiquitous, and normally so quietly reliable that we almost stop seeing them. However, history teaches us that Infrastructure protocols can and do have serious vulnerabilities. They say when you kick a rock over, dozens of bugs crawl out from under it. In this vein, this blog delves into how I went looking for one security issue and uncovered 6 other ones.
Read Post
sophos

"Eye" spy: Cyclops Blink returns with extended capabilities

Sep 11, 2026 By Sophos Counter Threat Unit Research Team In Sophos
In August 2026, Counter Threat Unit (CTU) researchers analyzed a malicious 64-bit Linux executable named timezone_check that was discovered on multiple compromised Cisco Firewall Management Center (FMC) devices. The sophisticated modular implant provides persistent remote access to a compromised Linux system.
Read Post

Episode 23 - Inside Zeek 9: Modernizing Open Source Network Monitoring & Agentic Security Scanning

Sep 10, 2026 By Corelight In Corelight
In this episode, host Richard Bejtlich sits down with Christian Kreibich, Zeek's technical lead, to unpack the upcoming Zeek 9 release and what it means for practitioners. Christian explains how the project structures its three-releases-a-year cadence and how the team has spent recent cycles modernizing Zeek—including the shift to ZeroMQ for cluster messaging and new systemd-based cluster orchestration. A major thread is security.
View Video

Ungentlemanly behavior: Insights into a ransomware operation

Sep 9, 2026 By Sophos In Sophos
They call themselves The Gentlemen Behind the name is one of the most active ransomware operations of the past 12 months, linked to 683 victims and a playbook built around compromised credentials, legitimate tools, rapid privilege escalation, and aggressive defense evasion. In this video, Susie Evershed and Rafe Pilling break down the latest research from Sophos Counter Threat Unit (CTU), revealing how some affiliates can move from initial compromise to ransomware deployment in less than 24 hours.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.