Log Analysis: From Raw Events to Detections
An enterprise environment emits events by the million every hour. During an incident, the responder rarely needs all of them. They need the few hundred that tell the story: the burst of 4625 failures...
View ArticleCVE-2026-102764: Critical BeyondTrust Remote Support Zero-Day Exploited by...
BeyondTrust has disclosed CVE-2026-102764, a critical vulnerability in Remote Support (RS) that was exploited as a zero-day by a suspected China-nexus cyber espionage actor. The flaw carries a CVSS...
View ArticleCVE-2026-99999: Critical PwnEscape Linux Kernel Flaw Enables Guest-to-Host...
A critical Linux kernel vulnerability tracked as CVE-2026-99999, dubbed PwnEscape, can break the isolation boundary between virtual machines and their underlying hosts. The flaw resides in the Linux...
View ArticleUnderstand Any Threat Report in Minutes: AI Summaries and Attack Flow in...
Every SOC analyst knows the feeling. A new threat report lands in your queue, dozens of pages long, packed with techniques, tools, and timelines. Somewhere inside is the information your team needs to...
View ArticleTurn Threat Reports into Behavior Rules in Minutes with AI
Every day, threat intelligence teams read reports describing new attacker campaigns, and every day detection engineers face the same question: how do we turn this into detection content before the...
View ArticleCVE-2026-76519: Critical Cisco Secure Email Gateway Zero-Day Exploited for...
Cisco has patched CVE-2026-76519, a critical zero-day vulnerability affecting Cisco Secure Email Gateway (SEG) that is already being exploited in real-world attacks. The flaw carries a CVSS score of...
View ArticleCVE-2026-0322: Actively Exploited PAN-OS RCE Flaw Enables Root Access
Palo Alto Networks has released security updates addressing CVE-2026-0322, a high-severity remote code execution vulnerability affecting the management interface of PAN-OS. The flaw carries a CVSS 4.0...
View ArticleCVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited for Unauthenticated...
Ivanti has disclosed CVE-2026-104935, a high-severity vulnerability in Ivanti Connect Secure (ICS) that is being actively exploited in real-world attacks. The flaw carries a CVSS score of 8.6 and...
View ArticleCVE-2026-96951: Actively Exploited Windows Shell Zero-Day Bypasses Mark of...
Microsoft has patched CVE-2026-96951, a high-severity Windows Shell security feature bypass vulnerability that is already being exploited in real-world attacks. The flaw carries a CVSS score of 8.8...
View ArticleIntroducing the Agentic Skills Marketplace: Curated AI Capabilities for the...
For years, SOC Prime has focused on one core problem: curating behavioral detection rules that cover both the threats that never go away and the new ones that emerge every day. As agentic AI changes...
View ArticleCVE-2026-97229: Critical GitLab RCE Flaw Enables Unauthenticated Code Execution
GitLab has released emergency security updates addressing CVE-2026-97229, a maximum-severity remote code execution vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE)....
View ArticlePseudonymizing Log Data in Cribl Detect with the LogTotal Sanitizer Pack
Summary Cribl Detect, released on September 29, 2026, is a SIEM that runs on Cribl’s data platform. The data it stores and searches is ingested through Cribl Stream Routes and Pipelines, so a...
View ArticleCVE-2026-107406: Critical NetScaler ADC and Gateway RCE Vulnerability
Citrix has disclosed CVE-2026-107406, a critical memory overflow vulnerability affecting NetScaler ADC and NetScaler Gateway appliances configured for specific SAML authentication roles. The flaw...
View ArticleCVE-2026-59346: Critical VMware Workstation and Fusion Flaw Enables...
Broadcom has addressed CVE-2026-59346, a critical integer-overflow vulnerability affecting VMware Workstation and VMware Fusion. The flaw carries a CVSS score of 9.3 and can allow an attacker with...
View ArticleCVE-2025-64393: Critical Veeam Backup & Replication RCE Vulnerability
Veeam has released a security update addressing CVE-2025-64393, a critical remote code execution vulnerability in Veeam Backup & Replication. The flaw has received a CVSS 4.0 score of 9.4 and...
View ArticleA Deployed Rule Is Not a Working Rule: How to Tell the Difference
Every detection team knows this moment. A rule is written or downloaded, reviewed, translated into the query language of the SIEM, and deployed. The status says enabled, the rule count goes up, and...
View ArticleCVE-2026-96940: Microsoft Exchange Vulnerability Allows Unauthorized Mailbox...
Microsoft has released an out-of-band security update addressing CVE-2026-96940, a high-severity vulnerability in Microsoft Exchange Server that could allow authenticated attackers to access other...
View ArticleCVE-2026-21589: Critical Atlassian Vulnerability Exposes Sensitive Files...
Atlassian has disclosed CVE-2026-21589, a critical arbitrary file access vulnerability affecting eight widely used Data Center products, including Jira, Confluence, and Bitbucket. The flaw, assigned a...
View ArticleCVE-2026-88779: Citrix NetScaler Zero-Day Exploited Against SAML Deployments
Only days after Citrix addressed actively exploited NetScaler flaws CVE-2026-88771 and CVE-2026-88772, defenders faced another urgent security issue. A newly disclosed vulnerability tracked as...
View ArticleCVE-2026-104286: Critical FortiMail Zero-Day Exploited for Unauthenticated...
Fortinet has disclosed a critical FortiMail zero-day vulnerability that attackers are already exploiting in the wild. Tracked as CVE-2026-104286 and rated 9.8 on the CVSS scale, the flaw enables an...
View Article