Security Operations Blog
Technical articles on vulnerability management, threat detection, compliance automation, and building a security program that works.
CVE-2026-18577 is an unauthenticated auth bypass in N-able N-central that survives the vendor's first hotfix, actively exploited to pivot into every endpoint an MSP manages via Take Control and Cloudflared tunnels. Mechanism, defender hunts on ui_access_control.log and BASupSrvc log gzips, and how to prove the 2026.3.1.7 hotfix actually held.
CVE-2026-20316 is a hardcoded low-privilege account in Cisco Secure FMC's web tier, actively exploited before the July 29 hotfix and chainable through the package_info.pl diagnostic wrapper to root. Mechanism, the /var/log/messages IoC Cisco is telling you to grep for, defender hunts, and how to prove the hotfix actually took.
CVE-2026-16812 is a CVSS 10.0 unauthenticated OS command injection in Arista VeloCloud Orchestrator on-prem, exploited as a zero-day and added to CISA KEV on July 27, 2026 with a July 30 federal deadline. The mechanism, why SD-WAN monitoring walks it past, defender hunts against the orchestrator host, and how to prove the patch actually held.
CVE-2026-16723 is an unpatched RCE in Fastjson 1.2.68 to 1.2.83 under active exploitation since July 21, 2026. The parser's own type validator fetches attacker-hosted JARs through getResourceAsStream, and the @JSONType annotation short-circuits the safety gate. Mechanism, defender hunts, and how to prove SafeMode actually took effect.
Check Point's SmartConsole login accepted an application token from unauthenticated callers, handing full firewall-management admin to anyone who could reach the Management Server. The mechanism, why no signature tooling catches it, defender hunts against the audit log, and how to prove the patch actually held before the July 25 CISA KEV deadline.
CVE-2026-6875 chains an unauthenticated POST to /assessment_thanks.do with a mutable Object.clone override that turns gs.include into Function(payload) inside ServiceNow's less restricted Rhino context. The mechanism, why signature tooling walks it past, defender hunts, and how to prove the fix held.
CVE-2026-63030 and CVE-2026-60137 chain a REST batch route confusion with a WP_Query author__not_in SQL injection into unauthenticated RCE on WordPress 6.9 and 7.0. The mechanism, why signature WAFs walk it past, defender hunts, and how to prove the patch actually held.
On July 14 an attacker used a pull_request_target misconfiguration in asyncapi/generator to steal the asyncapi-bot PAT, then pushed a module-load Miasma RAT through @asyncapi/specs, @asyncapi/generator, generator-components, and generator-helpers with valid SLSA provenance. Mechanism, defender hunts, and how to prove the fix actually held.
Microsoft's record July 14 Patch Tuesday hides three identity-forgery bugs. CVE-2026-56164 lets an unauthenticated caller reach a critical SharePoint function; CVE-2026-56155 hands the ADFS token signing keys to any low-privilege reader; CVE-2026-55040 chains a JWT bypass into the Pwn2Own SharePoint RCE. Mechanism, defender hunts, and how to prove the patch actually held.
CVE-2026-20896 is an authentication bypass in the official Gitea Docker image. A REVERSE_PROXY_TRUSTED_PROXIES=* default lets any network client set X-WEBAUTH-USER and log in as any account, admin included. Mechanism, Sysdig's ProtonVPN-scanner observation, defender hunts, and how to prove the patch actually held.
CVE-2026-48282 is an unauthenticated path traversal in ColdFusion's RDS FILEIO handler. One POST to /CFIDE/main/ide.cfm writes a CFML webshell anywhere the service account can reach, and CISA set today as the deadline. Mechanism, defender hunts, and how to prove the patch actually held.
CVE-2026-8451 is a pre-auth memory overread in NetScaler's custom SAML XML parser. An unquoted attribute followed by whitespace runs past the buffer, and the leaked bytes come back inside the NSC_TASS cookie. The mechanism, the exploit request, defender hunts, and how to prove the patch actually held.
SOCRadar tied the FortiBleed credential-harvest campaign to INC Ransom and Lynx. The FortigateSniffer mechanism abusing FortiOS's diagnose sniffer packet command, the CVE-2026-35616 EMS accelerator dropping EKZ Infostealer, the detection gap, and a blue-team playbook.
CVE-2026-45659 turns any authenticated Site Member into a SharePoint RCE via LosFormatter deserialization inside Update(). The mechanism, why normal blue-team tooling waves it through, the hunting queries and ATT&CK mapping, and how to verify the patch actually held.
CVE-2026-48558 is a CVSS 10 authentication bypass in SimpleHelp's OIDC login: the server never verifies the id_token signature, so attackers forge Technician sessions, self-register MFA, and use the RMM channel to drop TaskWeaver and Djinn Stealer on developer fleets. The mechanism, the detection gap, and a blue-team response playbook.
Three FortiSandbox CVEs (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) chain unauthenticated path traversal and OS command injection into root code execution on the appliance that grades every other Fortinet product's malware verdicts. The mechanism, the detection gap, and a blue-team response playbook.
JFrog's PixelSmash is a heap out-of-bounds write in FFmpeg's MagicYUV decoder, with working RCE demonstrated against Jellyfin and Nextcloud through automatic library scans. The chroma-height rounding mismatch, the AVBuffer free-pointer hijack, the detection gap, and a blue-team response playbook.
CVE-2026-20253 is a CVSS 9.8 pre-authentication RCE in Splunk Enterprise's PostgreSQL sidecar, actively exploited and on CISA KEV with a June 21 deadline. The confused-deputy mechanism, the detection gap, and a blue-team response playbook.
The Hades sub-wave of the Mini Shai-Hulud cluster republished six PyPI bioinformatics packages in under sixty seconds on June 8, hiding a Bun JavaScript credential worm inside trojanized .abi3.so native extensions. Detection gaps, MITRE mapping, and a blue-team response playbook.
Attackers claimed 1,500+ orphan Arch User Repository packages through legitimate adoption, then chained a malicious atomic-lockfile npm dependency, an eBPF rootkit, and a credential sweep. Detection gaps, MITRE mapping, and a blue-team response playbook.
ShinyHunters spent two weeks exploiting CVE-2026-35273, a CVSS 9.8 pre-authentication RCE in Oracle PeopleSoft PSEMHUB, breaching 100+ organizations before Oracle's emergency patch landed. Detection gaps, MITRE mapping, and a blue-team response playbook.
An IKEv1 certificate validation flaw lets an unauthenticated attacker complete a Check Point VPN session without a valid password, and a Qilin ransomware affiliate is already inside. Detection gaps, MITRE mapping, and a blue-team response playbook.
An authenticated netadmin can ride a crafted CLI input into full root on Cisco Catalyst SD-WAN Manager with no patch yet shipped. Detection gaps, MITRE mapping, and a blue-team response playbook.
A Mini Shai-Hulud variant abused GitHub Actions OIDC to republish 96 malicious versions across 32 official @redhat-cloud-services npm packages on June 1, sweeping AWS, GCP, Azure, and CI/CD secrets while self-replicating. Detection gaps, MITRE mapping, and a blue-team response playbook.
An authentication bypass in PAN-OS GlobalProtect lets attackers forge override cookies and pull unauthorized VPN tunnels into internal networks. Active exploitation, detection gaps, MITRE mapping, and a blue-team response playbook.
The Megalodon campaign pushed 5,718 malicious commits across 5,561 repositories, injecting GitHub Actions workflow files that exfiltrate CI/CD secrets with stolen tokens. CISA advisory, detection gaps, MITRE mapping, and a blue-team response playbook.
A malicious Nx Console VS Code extension (nrwl.angular-console v18.95.0) ran for 18 minutes, stealing developer credentials and breaching roughly 3,800 GitHub internal repos. CVE-2026-48027 detection gaps, MITRE mapping, and a blue-team response playbook.
A live supply-chain campaign planted 34 credential-stealing packages and 384+ versions across three ecosystems, even poisoning AI assistant context files. Detection gaps, MITRE mapping, and a blue-team response playbook.
A supply-chain attacker rewrote git tags across four Composer packages to deploy a cross-platform credential stealer via autoload.files. Detection gaps, MITRE mapping, and response playbook.
BAS safely simulates real cyberattacks to test your defenses. How it works, BAS vs pentesting, MITRE ATT&CK mapping, and why every security team needs continuous validation.
Cloud SaaS security tools send your most sensitive data to third-party servers. Local-first means your logs, source code, and credentials never leave your hardware.
Enterprise SIEMs cost a fortune and small teams fly blind without log correlation. What a SIEM actually does, why it matters, and how local-first detection and BAS validation close the gap.
What MITRE ATT&CK actually is, how to map your detections, coverage gaps most teams miss, and how to validate your coverage with BAS.
Manual compliance is killing small teams. How to automate evidence collection across SOC 2, ISO 27001, HIPAA, PCI DSS, and NIST frameworks.
Phase 1: Visibility. Phase 2: Protection. Phase 3: Validation. Phase 4: Governance. The complete playbook for going from zero to a working program.
CVSS was designed for a world that no longer exists. Multi-layer scoring models factor in exploit maturity, business context, and threat intelligence.
Combining EPSS probability with CISA KEV binary signals produces a prioritization model that outperforms CVSS Base Score in every measurable category.
What SOC 2 actually requires for vulnerability management, how to automate evidence collection, and common audit findings to avoid.
A step-by-step operational guide: asset discovery, scanning cadence, triage workflow, SLAs, and board reporting.
Practical patterns for embedding static analysis into build pipelines without slowing developers down.
How local AI models generate context-aware remediation guidance -- complete with code snippets, deployment steps, and rollback procedures.
The vulnerability management market charges enterprise prices for problems that can be solved with better tooling.
Cross-referencing KEV, ransomware campaign data, and EPSS to build a prioritization list focused on the CVEs ransomware operators actively weaponize.
Most organizations face multiple compliance frameworks. Cross-mapping controls reduces duplication and simplifies evidence collection.