PAN-OS CVE-2026-0257: GlobalProtect bypass becomes a ransomware door
Unit 42 says Qilin and Inc affiliates are exploiting a May GlobalProtect bypass, in one case pivoting to vCenter and a domain controller's disk.
AI in the hunt, part 1: Microsoft’s Project Perception and Codename MDASH
Microsoft's Project Perception puts red, blue and green AI agents inside Defender. Codename MDASH hunts bugs in source code. What each does, what hunters can use, and what to check before trusting the output.
OWASP agentic Top 10 meets MITRE ATLAS: a threat model
OWASP says what goes wrong with AI agents; MITRE ATLAS says what attackers do to them. We map one to the other and note what ATLAS added this autumn.
Free SIEM for small teams: Wazuh, Elastic Security and Security Onion compared
A documentation-based comparison of Wazuh, Elastic Security on Basic and Security Onion: licences, hardware, what is free, and which will alert you at 3am.
Four AI agent advisories, one lesson: prompt injection becomes code execution
Four October advisories in Flowise, PraisonAI, Vibe-Trading and LangAlpha share one chain: text the agent reads becomes code it runs. Patch, then fix the architecture.
Security events calendar: November 2026 to June 2027
Ten security events worth the diary space between November 2026 and June 2027, from CyberThreat and BSides London to CYBERUK and Infosecurity Europe.
Hunt: Plex2Shell implants in the Plex Codecs folder
Two untested draft Sigma rules for Plex2Shell on Linux: shared objects written to Plex's Codecs folder, and Plex spawning shells, downloaders or known miners.
Cyber Security and Resilience Bill: what to watch at Lords Report stage on 26 October
The Cyber Security and Resilience Bill reaches Lords Report stage on 26 October with a re-tabled vendor direction power. Where it stands and what it will ask of you.
