Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Key Takeaways: Configuration drift can reopen attack paths. Changes to firewall rules, inspection settings, or endpoint policies can expose vulnerable systems that were previously protected. ‍ Vulnerability exposure changes even when the CVE doesn't. Security teams need to reassess reachability and existing protections as configurations and exploit intelligence evolve. ‍ Reach connects configuration drift to vulnerability exposure.

Key Takeaways: Reachability determines exposure. Two servers with the same PHP2Shell vulnerability can face different levels of risk depending on accessible attack paths and existing protections. CrowdStrike can help disrupt post-exploitation activity. Falcon capabilities can detect or block malicious behaviors, including suspicious processes and command execution, even when a vulnerable service remains reachable. Effective protection depends on configuration.

A security team can run more scans, open more tickets, and close more findings without knowing whether the organization is becoming harder to attack. Those activities matter, but they do not answer the question that should guide your Continuous Threat Exposure Management (CTEM) program: Are we reducing the exposures that matter most to the business?

Key Takeaways: Reachability determines exposure. Systems with the same vulnerability can face different levels of risk depending on accessible attack paths and existing protections. Security configurations determine which protections apply. Firewall rules and inspection settings can leave vulnerable systems exposed even when exploit-blocking controls are available. Compensating controls can mitigate vulnerabilities.

A new supply chain attack hits the news. A CVE with a dramatic name starts trending. A malicious package turns up in npm, PyPI, and Hugging Face. Within minutes, your Slack channels fill up, your CISO wants an update, and someone asks the question every DevSecOps professional dreads.

It's been 20 days since the PHP project disclosed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and many organizations have already put an action plan in place to patch their own environments. Regulators are also demanding faster responses than ever: U.S. federal agencies had three days to apply fixes under CISA BOD 26-04, and frameworks like PCI DSS, DORA, and NIS2 all set firm expectations for timely remediation.

When we announced that MCP Governance is generally available in Evo Agentic Development Security (ADS), the most common follow-up was practical: "Great. Where do I start on Monday?" It’s a fair question; across 10,000 developer environments, Snyk found 4,524 unique MCP servers in active use, and 1 in 12 developers with an MCP server installed had a confirmed high or critical finding.

Two PHP servers can carry the same critical CVE and require different immediate work. In an illustrative pair, one accepts requests from an untrusted network through a rule with no effective intrusion prevention. The other is denied on the assessed path. The first needs an immediate mitigation decision. The second needs that restriction preserved while software remediation continues.

OpenSSH is the most widely used implementation of the SSH protocol for remote login. CVE-2026-123158, named *sshole, was published on November 5, 2026, with a CVSS v3.1 score of 8.1 (High). An unauthenticated attacker with network access to the SSH port can log in to an account that has no usable password by sending an overlong password. Access carries the permissions of that account.