📋 Curated Intelligence
November 1, 2026 LATEST
Forensic Analysis
13 items
- Compression in the Windows Page Filecclsolutionsgroup.com/post/compression-in-the-windows-page-file
- Windows CBS Logforensafe.com/blogs/windows-cbs-log.html
- Apple Podcastsforensafe.com/blogs/apple-podcasts.html
- Apple Walletforensafe.com/blogs/apple-wallet.html
- Linux Software RAID Superblocksrighteousit.com/2026/10/27/linux-software-raid-superblocks
- Clearing History Does Not Clear Chromium’s File System Storageleapps.org/blog-post
- Everything You Need To Know Before An Azure Cloud Incident Responsehackmd.io/@M4shl3/Everything-You-Need-To-Know-Before-Doing-an-Azure-Cloud-Incident-Response
- How to investigate business email compromise (BEC): from fraudulent email to full scopemagnetforensics.com/blog/how-to-investigate-business-email-compromise-bec-from-fraudulent-email-to-full-scope
- AI agents have few qualms with log tamperingmanifold.security/blog/agent-log-tampering
- Tampering with timelines – injecting false leadsosdfir.blogspot.com/2026/10/tampering-with-timelines-injecting.html
- Extracting Timestamps from ChatGPT IDshindsig.ht/blog/decoding-chatgpt-ids
- How Do You Investigate Windows Event Logs?sumeshi.github.io/posts/knowledges/windows-eventlog-analysis-101-en
- The Screenshot Is Real, But the Timeline Might Not Besecjuice.com/the-screenshot-is-real-but-the-timeline-might-not-be
Threat Intelligence/Hunting
166 items
- What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explainedaikido.dev/blog/what-are-shell-vulnerabilities
- The day after tomorrow: After PHP2Shell, it gets worse, then defenders winaikido.dev/blog/php2shell-day-after-tomorrow
- PHP2Shell Is a Reminder: The Endpoint Only Tells Half the Storybinalyze.ai/blog/php2shell-endpoint-network-evidence
- Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)bishopfox.com/blog/responder-guidance-for-php2shell
- PHP2Shell: Critical PHP RCEs and How to Respondbloo.io/blog/php2shell-critical-php-rces-and-how-to-respond
- PHP2Shell: 168 URL inizialmente segnalate dichiarano ora una versione aggiornatacert-agid.gov.it/news/php2shell-168-url-inizialmente-segnalate-dichiarano-ora-una-versione-aggiornata
- PHP2Shell: diminuiscono le URL potenzialmente vulnerabili. Disponibili gli strumenti AgIDcert-agid.gov.it/news/php2shell-diminuiscono-le-url-potenzialmente-vulnerabili-disponibili-gli-strumenti-agid
- CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructurecyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure
- Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Serversdreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers
- PHP2Shell Critical RCE Vulnerabilities: Threat Analysis & Remediation Guideforegenix.com/blog/php2shell-critical-rce-vulnerabilities-threat-analysis-remediation-guide
- PHP2Shell One Week Later: Honeypot Shells on the Web, a Path to Root on Palo Alto Firewallshunt.io/blog/php2shell-honeypot-shells-root-palo-alto-firewalls
- PHP2Shell Is Already Here: How the Infoblox Platform Helps Uncover and Mitigate the Riskinfoblox.com/blog/security/php2shell-is-already-here-how-the-infoblox-platform-helps-uncover-and-mitigate-the-risk
- Testing a PHP2Shell exploit in the era of AI-hallucinated PoCsintel471.com/blog/testing-a-php2shell-exploit-in-the-era-of-ai-hallucinated-pocs
- PHP2Shell Is Hitting Windows Servers in the Wild. We Stopped It.morphisec.com/blog/php2shell-is-hitting-windows-servers-in-the-wild-we-stopped-it
- php2shell: how we protected more than 6 million websitesblog.ovhcloud.com/en/posts/php2shell-php-vulnerability-response
- PHP2Shell, Day 5: The Panic Hasn’t Turned Into Patchingox.security/blog/php2shell-day-5-the-panic-hasnt-turned-into-patching
- php2shell in Practice: Exploitable, Conditional, and Hard to Mass-Exploitpraetorian.com/blog/php2shell
- PHP2Shell Was Exploited Before the Patchsekoia.com/blog/php2shell-was-exploited-before-the-patch-expect-more-of-it
- PHP2Shell Won’t Be the Last. Here’s Where the Next One Will Show Up First.snyk.io/blog/php2shell-where-next-one-will-show-up-first
- php2shell one week later: Why one exploit doesn’t work everywheretenable.com/blog/php2shell-one-week-later-why-one-exploit-doesnt-work-everywhere
- Patched, Not Over: PHP2Shell Exploits Keep Spreading Undergroundthreatmon.io/patched-not-over-php2shell-exploits-keep-spreading-underground
- PHP2Shell: Exploitation Attempts and Remediation Trendswiz.io/blog/php2shell-exploitation-so-far
- PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing Mostwordfence.com/blog/2026/10/php2shell-update-still-no-confirmed-wordpress-compromises-and-answers-to-the-questions-were-hearing-most
- PHP2Shell and the Limits of Patching: A SecOps Playbook for Layered Responsezscaler.com/blogs/cybersecurity-best-practices/php2shell-and-limits-patching-secops-playbook-layered-response
- How Fake DOT Portals Turn Carrier Records into Fuel Card Fraudabnormal.ai/blog/fake-dot-portals-fuel-card-phishing
- SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprisesany.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis
- Some help(er)!undertheho0d.medium.com/some-help-er-005e02eda8c2
- Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Accessarcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access
- 2026 Agentic Security Operations Reportarcticwolf.com/resources/report-au/agentic-security-operations-report
- RATatouille: Today’s Special: Impersonating Companies in Korea, Payments in Cryptocurrencyasec.ahnlab.com/en/96151
- Node2Shell: Taking Over a Server with a Single Compressed Data File (CVE-2026-111497)asec.ahnlab.com/en/96267
- September 2026 Infostealer Trend Reportasec.ahnlab.com/en/96183
- September 2026 Threat Trend Report on APT Attacks (South Korea)asec.ahnlab.com/en/96295
- New data reveals espionage focus of Insolent Hyenabi-zone.medium.com/new-data-reveals-espionage-focus-of-insolent-hyena-a8fa207e0ae6
- PackMyPayload: Containerized MOTW Bypass and How to Detect Itbloo.io/blog/packmypayload-containerized-motw-bypass-and-how-to-detect-it
- Beyond the model: backdoors in AI agent harnessescert.europa.eu/blog/beyond-the-model-backdoors-in-ai-agent-harnesses
- Phishing PagoPA: nuove campagne a tema multe diffuse tramite PEC compromessecert-agid.gov.it/news/phishing-pagopa-nuove-campagne-a-tema-multe-diffuse-tramite-pec-compromesse
- Sintesi riepilogativa delle campagne malevole nella settimana del 24 – 30 ottobrecert-agid.gov.it/news/sintesi-riepilogativa-delle-campagne-malevole-nella-settimana-del-24-30-ottobre
- Binance Exploit: Latest Findings and Responsechainalysis.com/blog/binance-exploit-latest-findings-and-response
- Chainalysis Security Incident Informationchainalysis.com/blog/security-incident-october-30
- 26th October – Threat Intelligence Reportresearch.checkpoint.com/2026/26th-october-threat-intelligence-report
- Tricks from the Past deployed via signed ChatGPT and Claude binariesresearch.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries
- Yoba Malware Abuses Signed ChatGPT and Claude Binaries to Target AI Usersblog.checkpoint.com/research/yoba-malware-abuses-signed-chatgpt-and-claude-binaries-to-target-ai-users
- HTTP2Shell: The Brotli Vulnerability That Extends Beyond Node.jsblog.checkpoint.com/security/http2shell-the-brotli-vulnerability-that-extends-beyond-node-js
- Backdoor or Confused Agent? What We Learned Replaying the Qwen Incidentblog.checkpoint.com/ai-security/qwen-incident-backdoor-ai-agents
- Audio Prompt Injection: What Voice Agents Hear That Text Guardrails Missblog.checkpoint.com/ai-security/audio-guardrails-voice-agents
- Cohere’s Qwen Story: Looks More Like Model Jaggednessresearch.checkpoint.com/2026/coheres-qwen-story-looks-more-like-model-jaggedness
- Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WANblog.talosintelligence.com/uat-11473-keydrift
- IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increasesblog.talosintelligence.com/ir-trends-q3-2026
- Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giantsblog.cloudflare.com/ddos-threat-report-2026-q3
- The Doorway Botnet: Inside a Large-Scale IoT and Network Device Compromise Campaigncloudsek.com/blog/doorway-botnet-global-iot-router-camera-enterprise-server-attacks
- Inside “MR ROBOT” – Anatomy of a Malware-as-a-Service Operation Targeting Indian Bank Customerscloudsek.com/blog/inside-mr-robot-malware-as-a-service-targeting-indian-bank-customers
- Fake “View & Sign” and Adobe Acrobat Lures Deliver Attacker-Configured ScreenConnect Clientscloudsek.com/blog/fake-adobe-acrobat-lures-deliver-screenconnect-remote-access-clients
- Locked and Loaded: Phishing through Fake Bids and Protected Documentscofense.com/blog/locked-and-loaded-phishing-through-fake-bids-and-protected-documents
- Would Your Employees Join a Fake Anthropic AI Preview?cofense.com/blog/would-your-employees-join-a-fake-anthropic-ai-preview
- The Trojan Horse in Your Repo: Inside the GhostAction Supply Chain Heistcqureacademy.com/blog/the-trojan-horse-in-your-repo-inside-the-ghostaction-supply-chain-heist
- CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifiescrowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report
- VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaigncrowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign
- New Prompt Injection Techniques Cover Agent-Planning Attackscrowdstrike.com/en-us/blog/new-prompt-injection-techniques-cover-agent-planning-attacks
- SiteGuard: preserve evidence before patching an exploited WAF flawcybersecurityunderpressure.com/analysis-siteguard-evidence-before-patching
- From Hijacked PBX to Stolen Trunk: INJ3CTOR3’s Campaign Evolvescyble.com/blog/hijacked-pbx-to-stolen-trunk-inj3ctor3s-campaign
- Threat Horizon Series Q3 2026 CHECK-IN · THE ROAD TO DECEMBERcyfirma.com/research/threat-horizon-series
- Adversary Unmasked: APT Profile – Star Blizzardcyfirma.com/research/adversary-unmasked-apt-profile-star-blizzard
- Weekly Intelligence Report – 30 Oct 2026cyfirma.com/news/weekly-intelligence-report-30-oct-2026
- Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decodersecuritylabs.datadoghq.com/articles/node2shell-cve-2026-111497-nodejs-brotli-decoder
- The Blind Spot You Created on Purpose. The Real Architecture of Microsoft Defender Exclusionsdetect.fyi/the-blind-spot-you-created-on-purpose-the-real-architecture-of-microsoft-defender-exclusions-20fb35287397
- Weekly Threat Infrastructure Investigation(Week44)disconinja.hatenablog.com/entry/2026/11/01/111054
- Unpacking ATT&CK With MalChela v4.4bakerstreetforensics.com/2026/10/31/unpacking-attck-with-malchela-v4-4
- Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platformelastic.co/security-labs/blog/windows-endpoint-security-platform-wesp
- How eSentire Responded to a Citrix NetScaler Zero-Day in One Dayesentire.com/blog/how-esentire-responded-to-a-citrix-netscaler-zero-day-in-one-day
- Fake Claude Code extensions in Cursor: Malicious activity after the exposure windowexpel.com/blog/blog-fake-claude-code-extension-cursor-ssh-backdoor
- How attackers keep reading mail after M365 session revocationlabs.eye.security/how-attackers-keep-reading-mail-after-m365-session-revocation
- Scattered LAPSUS$ Hunters : Profiling the Evolving Cybercrime Ecosystemfalconfeeds.io/blogs/scattered-lapsus-hunters-slh-cyberattacks-tactics-threat-actor-profile
- Who Pays When AI Makes Cybercrime Cheaper? Inside the New Economics of Ransomware and Extortionflare.io/learn/resources/blog/ai-cybercrime-economics-ransomware-extortion
- Beyond the Binance Attack: How Stealer Logs Can Link Corporate Sign-Ins to Developer and Monitoring Toolsflare.io/learn/resources/blog/binance-attack-stealer-logs
- DefenderKiller: How Vulnerable Drivers Are Being Abused to Disable Endpoint Securityflashpoint.io/blog/defenderkiller-how-vulnerable-drivers-are-being-abused-to-disable-endpoint-security
- How Criminals Abuse Claude’s Own Website to Spread Malwaregendigital.com/blog/insights/research/claude-content-sharing-malware
- GhostAction Crosses Paths With PolinRider: Inside the October Escalationblog.gitguardian.com/ghostaction-x-polinrider
- False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Appsgroup-ib.com/blog/cyberdakait-seven-android-trojans-indian-banking
- MadApe: The Code That Opens the Doorgroup-ib.com/blog/madape-microsoft-device-code-phishing-kit
- Incident Notification Deadlines: Who Needs Telling and Whenhalkynconsulting.co.uk/a/2026/10/incident-notification-deadlines
- Writing an Incident Response Report That Workshalkynconsulting.co.uk/a/2026/10/incident-response-report
- Covert Evidence Preservation in Insider Caseshalkynconsulting.co.uk/a/2026/10/covert-evidence-preservation
- Linux Namespaces: Where Evidence Hideshalkynconsulting.co.uk/a/2026/10/linux-namespaces-forensics
- Business Email Compromise Investigation in Microsoft 365halkynconsulting.co.uk/a/2026/10/business-email-compromise-investigation
- Finding a Model in Memory and Nowhere Elsehalkynconsulting.co.uk/a/2026/10/model-in-memory
- FortiBleed 2.0: 975 New Domains & 40,573 Exposed Secrets – Claim Your Ethical Disclosureinfostealers.com/article/fortibleed-2-0-975-new-domains-40573-exposed-secrets-claim-your-ethical-disclosure
- Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party Scriptinfostealers.com/article/polymarket-breach-alert-wallet-draining-code-found-in-a-third-party-script
- 68 GB Stolen From a Philippine Government Agency’s Overseas-Employment Databases, Exposed by the Operator’s Own Open Directoryhunt.io/blog/philippine-government-employment-agency-records-stolen
- AI, Scripts, Operator: Inside the ConnectWise Attackhuntress.com/blog/connectwise-attack-ai
- Camera Management Software Compromise Leads to Malware Deploymenthuntress.com/blog/camera-management-software-compromise-malware
- Borrowed Reputation: Domain Shadowing and Gambling SEOinfoblox.com/blog/threat-intelligence/borrowed-reputation-domain-shadowing-and-gambling-seo
- Pulse October 2026pulse.infra-trust.org/october-2026
- Planning for Russia’s escalating hybrid warintel471.com/blog/planning-for-russias-escalating-hybrid-war
- Les infostealers prennent l’IA en ligne de mireintrinsec.com/les-infostealers-prennent-lia-en-ligne-de-mire
- Binance attack: how DPRK targets developer laptopsjamf.com/blog/binance-attack-dprk-developer-laptop-security
- Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwidedoublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2
- Detection Rule Documentation: The ADS Framework Guidekravensecurity.com/detection-rule-documentation
- LevelBlue TTP Briefing Q3 2026: Trusted Access Fuels Data Theftlevelblue.com/blogs/spiderlabs-blog/levelblue-ttp-briefing-q3-2026-trusted-access-fuels-data-theft
- BlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kitslevelblue.com/blogs/spiderlabs-blog/blackapex-spy-and-counting-the-emerging-wave-of-vibe-coded-phishing-kits
- Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic accesslumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework
- The Great Glyph Grift, and How to Detect It Without the Samplemsuiche.com/posts/the-great-glyph-grift-and-how-to-detect-it-without-the-sample
- Tracking AI adoption in North Korean threat actor tradecraftmicrosoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft
- From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion pathsmicrosoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths
- Inside a malicious Claude Code-branded extension and its persistent SSH backdoormicrosoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor
- Hunting on the Wire : A Practical Guide to Network Threat Hunting — Part 2medium.com/fmisec/hunting-on-the-wire-a-practical-guide-to-network-threat-hunting-part-2-74c73587eb5e
- How to Hunt Malicious IP-KVMs on Your Endpointsnebulock.io/blog/threat-hunting-for-malicious-ip-kvm-usage
- Hunting the Trojanized Claude Code Extensionnebulock.io/blog/threat-hunting-the-trojanized-claude-code-extension
- Trojanized Claude Code Extension on the Cursor Marketplacethreatlabs.netskope.com/blog/2026/10/trojanized-claude-code-extension
- Beyond Framework Signatures: Understanding AI-Driven Intrusionsnextron-systems.com/2026/10/29/beyond-framework-signatures-understanding-ai-driven-intrusions
- Detection Engineering: Implementing Detection-as-Code in an Existing Environment: Part 1 – Introduction and Conceptblog.nviso.eu/2026/10/30/detection-engineering-implementing-detection-as-code-in-an-existing-environment-part-1-introduction-and-concept
- Multi-agent attack tools leave no stone unturned | Threat Intelligenceokta.com/blog/threat-intelligence/multi_agent_attack_tools_leave_no_stone_unturned
- 420. This Ransomware Gang Abuse Litterbox to Store Malicious Filesknowyouradversary.ru/2026/10/420-this-ransomware-gang-abuse.html
- Trojanized Claude Code Extension Plants an SSH Backdooropensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor
- Earliest Known PolinRider Malware Found in 2025 npm Packagesopensourcemalware.com/blog/polinrider-malware-found-in-2025-npm-packages
- Malicious Claude Code Extension (2.1.313) in Cursor Marketplace Plants Attacker SSH Key and Persistenceox.security/blog/malicious-claude-code-extension-cursor-ssh-backdoor
- Unwrapping Retail Peak Season Cyber Threatsunit42.paloaltonetworks.com/unwrapping-retail-cyber-threats
- Official Claude Code Extension Compromise: Security Advisoryphorion.io/blog/offical-claude-code-vsx-compromise
- One Operator, Several AI Attack Agents: The Ultra Suite and ARTEXprofero.io/blog/ultra-suite-artex-ai-attack-agents
- PHP2SHELL:Vibe Opspwndefend.com/2026/10/30/php2shellvibe-ops
- Silent Ransom Group – Leak Analysisransom-isac.org/blog/silent-ransom-group-leak-analysis
- CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoderrapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder
- Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764
- Residential Proxies Mask Social-Engineering Attacksreliaquest.com/blog/threat-spotlight-residential-proxies-mask-social-engineering-attacks
- The Remote Session Columns in Defender Don’t Describe PowerShell Remotingridgelinecyber.com/blog/remote-session-columns-that-miss-powershell-remoting
- YARA-X 1.22.0 Release, (Sun, Oct 25th)isc.sans.edu/diary/rss/33454
- Looking for a Language [Guest Diary], (Wed, Oct 21st)isc.sans.edu/diary/rss/33442
- Apple Patches for October 2026, (Mon, Oct 26th)isc.sans.edu/diary/rss/33458
- Yet Another ClickFix Campaign, (Wed, Oct 28th)isc.sans.edu/diary/rss/33466
- Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)isc.sans.edu/diary/rss/33470
- Wireshark 5.0.0rc1 Release, (Sat, Oct 31st)isc.sans.edu/diary/rss/33476
- YARA-X 1.22.1 Release, (Sat, Oct 31st)isc.sans.edu/diary/rss/33474
- OneNote File Extraction, (Sun, Nov 1st)isc.sans.edu/diary/rss/33478
- Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analyticssansec.io/research/convertr-plausible-supply-chain-attack
- DeadTag: How Forgotten Website Tags Became a Delivery Network for iPhone Spywareblog.report-uri.com/deadtag-how-forgotten-website-tags-became-a-delivery-network-for-iphone-spyware
- Polymarket’s CSP Allowed Every Part of the $2.6 Million Crypto Theftblog.report-uri.com/polymarkets-csp-allowed-every-part-of-the-2-6-million-crypto-theft
- An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructuresecurelist.com/cloud-infrastructure-isolation-bypass/121609
- Millions of security cameras at risk: DoS vulnerability in Intelbras devicessecurelist.com/intelbras-camera-vulnerability/121131
- Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asiasecurelist.com/netamloader/121676
- Filter generation in practice: from algorithms to LLMssecurelist.com/practical-filter-generation/121697
- SEAL weekly stats: 20-27 Oct, 2026radar.securityalliance.org/seal-weekly-stats-20-27-oct-2026
- Inside Omega AI: The Rise of All-in-One Underground AI Servicesblog.securitybreak.io/inside-omega-ai-the-rise-of-all-in-one-underground-ai-services-e0a0f91199b4
- Omegatech Is Disrupted, and the Pressure on Bulletproof Hosting Keeps Buildingsilentpush.com/blog/operation-omegaline-fbi-seizes-virtualine
- North Korea’s Crypto Heists Start on the Open Internetsilentpush.com/blog/north-korea-crypto-heists-open-internet
- The Attack Nobody Claimed – From U.S. Military Bases to France’s Supermarketsmedium.com/@simone.kraus/the-attack-nobody-claimed-from-u-s-military-bases-to-frances-supermarkets-319352404af1
- Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplacesocket.dev/blog/claude-code-extension-compromise
- AI used in Aur0ra ransomware testing and executionsophos.com/en-us/blog/ai-used-in-aur0ra-ransomware-testing-and-execution
- Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machinesstepsecurity.io/blog/claude-code-extension-trojanized
- The Upgrade Ate My Timeline: Windows Feature Update Forensicsthelocalh0st.com/posts/windows-feature-update-evidence
- Did the Agent Do It? Incident Response for AI Coding Agentsthelocalh0st.com/posts/ai-coding-agent-forensics
- Sandbox Flipped to ‘Danger-Full-Access’: Unauthorized AI Relays Create Risk for Organizationssecurity.com/threat-intelligence/openai-claude-unauthorized-relays
- From Webshell to Proxy Exit: Inside an Exposed AhsayCBS Operationthreatmon.io/from-webshell-to-proxy-exit-inside-an-exposed-ahsaycbs-operation
- Vulntober 2026: PHP2Shell, GitLab, Cisco, PAN-OS & 15+ Critical Flaws to Patchthreatmon.io/vulntober-2026-php2shell-gitlab-cisco-pan-os-15-critical-flaws-to-patch
- The Difference Between Watching and Running: The Hidden Risk of Free Software and Games in P2P Sharesthreatmon.io/the-difference-between-watching-and-running-the-hidden-risk-of-free-software-and-games-in-p2p-shares
- C2 Environment and Targeted Data Extractionthreatmon.io/c2-environment-and-targeted-data-extraction
- Binance Lost $6.3 Billion Without Losing a Keythreatmon.io/binance-lost-6-3-billion-without-losing-a-key
- Process trees in Livehunt: YARA rules that know who launched whatblog.virustotal.com/2026/10/process-trees-in-livehunt-yara-rules.html
- Lessons from Cybersecurity Black Weekwelivesecurity.com/en/business-security/lessons-cybersecurity-black-week
- ESET APT Activity Report Q2 2026–Q3 2026welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026
- Amatera: How the prolific infostealer works and spreadswelivesecurity.com/en/malware/amatera-how-prolific-infostealer-works-spreads
- Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerabilitywiz.io/blog/cve-2026-111497-brotli-rce-node-js
- Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbleswiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles
- Who launched that process?virustotal.github.io/yara-x/blog/who-launched-that-process
- Silent Train: Volt Typhoon’s Sophisticated Infection Chain into US Targets Exposedzetter-zeroday.com/silent-train-volt-typhoons-sophisticated-infection-chain-into-us-targets-exposed
- CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCEzscaler.com/blogs/security-research/cve-2026-111497-node2shell-http2shell-vulnerability-may-allow-rce
- Возвращение IDFKA: как APT-группа NGC5081 провела работу над ошибкамиrt-solar.ru/solar-4rays/blog/7144
Upcoming Events
10 items
- Expanding Your Toolkit: Practical Workflows with Open Source and Freewaremonolithforensics.com/resources/workshop-wednesdays
- ADF Weekly Mobile Training Sessionsregister.gotowebinar.com/rt/5995208548160709981
- What’s New in ADF Pro 6.4? Expanded Artifacts, PhotoDNA Enhancements & Moreadfsolutions.com/adf-pro-6-4-whats-new-webinar
- ADF Weekly Computer Training Sessionsregister.gotowebinar.com/rt/8364955173180524123
- Threat Intelligence & Threat Modelling Hackathonapartresearch.com/sprints/threat-intelligence-threat-modelling-2026
- Poznaj Cellebrite Genesis: od cyfrowego przeciążenia do jasności w śledztwiecellebrite.com/en/resources/webinars/poznaj-cellebrite-genesis-od-cyfrowego-przeciazenia-do-jasnosci-w-sledztwie
- Cyber Unpacked S3:E2 // IR beyond malware: Investigating business email compromise and fraudmagnetforensics.com/resources/s3e2-ir-beyond-malware-investigating-business-email-compromise-and-fraud
- Get ahead of the deadline: Grant readiness for 2027magnetforensics.com/resources/get-ahead-of-the-deadline-grant-readiness-for-2027
- Federal Education Day 2026msab.com/events-webinars/federal-education-day-2026
- Behind the Proxy: Real Attacks, Hidden Adversariesgo.spur.us/Webinar-BehindtheProxy.html
Presentations/Podcasts
23 items
- New CrowdStrike Report Spotlights Agentic AI Campaignscrowdstrike.podbean.com/e/new-crowdstrike-report-spotlights-agentic-ai-campaigns
- Hunting ScreenConnect Abuse With Claude Code (KQL + ES|QL)youtube.com/watch
- BHIS – Talkin’ Bout [infosec] News 2026-10-26youtube.com/watch
- Secure Networks Ep 68 – The Packet Forensics Files – with Traci Byrne from Cogent Securityyoutube.com/watch
- IR – SOC152 – Encrypted Files Detected (2026)youtube.com/watch
- Malware Analysis – Decompiling V8 JavaScript Galaxy Stealeryoutube.com/watch
- Mobile Unpacked S4:E2 // Harping on health datamagnetforensics.com/resources/s4e2-harping-on-health-data
- The Quantum Countdown: Why Certificate Testing Starts Nowthecyberwire.com/podcasts/microsoft-threat-intelligence/80/notes
- Evidence Files in Monolithyoutube.com/watch
- Adding Notes to a Case Report in Monolithyoutube.com/watch
- #MSABMonday – Test Pointsyoutube.com/watch
- How to Actually Get Better at SOC Investigationsyoutube.com/watch
- AI in Offensive Security: Discovery, Validation, and Autonomyyoutube.com/watch
- Update, Install, and Open LEAPPS With uLEAPP 1| Windowsyoutube.com/watch
- Update, Install, and Open LEAPPS With uLEAPP 2 | Linuxyoutube.com/watch
- The OpenSourceMalware Show #27opensourcemalware.com/blog/the-opensourcemalwareshow-episode27
- S2 E16: TN vs Ahmad Gatlin: Part 6youtube.com/watch
- Agent Dozier Would Like a Word (Word)buzzsprout.com/2445401/episodes/20022639-agent-dozier-would-like-a-word-word.mp3
- Sandfly YouTube Live: Is that Linux alert real?youtube.com/watch
- LABScon26 Replay | Keynote: A Sober Analysis of AI Impactsentinelone.com/labs/labscon26-replay-keynote-a-sober-analysis-of-ai-impact
- From Prompting to Autonomy: The Evolution of Adversarial AIbuzzsprout.com/1762840/episodes/20035478-from-prompting-to-autonomy-the-evolution-of-adversarial-ai.mp3
- Lumen’s Michael Horka on China’s ‘Silent Train’ Router Hackingsecurityconversations.fireside.fm/lumen-michael-horka-china-silent-train-router-hacking
- The Great Binance $6.34 Billion Crypto Heistsecurityconversations.fireside.fm/the-great-binance-billion-dollar-crypt-heist
Malware
11 items
- Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortionacronis.com/en/tru/posts/inside-qilin-ransomware-esxi-attacks-affiliate-networks-and-double-extortion
- My First Real Malware Sample Turned Out To Be LokiBotsecjuice.com/my-first-real-malware-sample-turned-out-to-be-lokibot
- Analysis of BAT file leads to a Trojan Dropper mostly attributed to RareWolfmedium.com/@shubhandrew/analysis-of-bat-file-leads-to-a-trojan-dropper-mostly-attributed-to-rarewolf-f354a6f91134
- Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secretssocket.dev/blog/firefox-wallet-impersonators
- KillerStrike: Inside an Open-Source Windows RATthreatmon.io/killerstrike-inside-an-open-source-windows-rat
- CCDS C2: Infrastructure and Payload Analysisthreatmon.io/ccds-c2-infrastructure-and-payload-analysis
- LiteLLM 1.107.0: From Startup Hooks to Credential Theftthreatmon.io/litellm-1-107-0-from-startup-hooks-to-credential-theft
- Unveiling Sirius Backdoor: A Multistage Fileless Campaign Disguised as FedEx Invoicestrellix.com/blogs/research/sirius-backdoor-fileless-campaign-fedex-invoices
- Linux hacking part 12: LD_PRELOAD function interposition. Simple C examplescocomelonc.github.io/linux/2026/10/26/linux-hacking-12.html
- Malware and cryptography 46 – a tiny neural distinguisher for Speck. C and PyTorch examples.cocomelonc.github.io/malware/2026/10/27/malware-cryptography-46.html
- Inside Coruna and DarkSword Chains: From Web Lures to iOS Exploitationzimperium.com/blog/inside-coruna-and-darksword-chains-from-web-lures-to-ios-exploitation
Miscellaneous
19 items
- Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving fasteraikido.dev/blog/ghost-php2shell-coordinated-disclosure-faster
- John Strand’s 11 Core Skills: For SOC Analystsblackhillsinfosec.com/soc-core-skills
- I Applied a DFIR Investigative Mindset to a Police Chief’s Retirement. Here’s What the Records Show.brettshavers.com/i-applied-a-dfir-investigative-mindset-to-a-police-chiefs-retirement-heres-what-the-records-show
- DFIR Jobs Update – 10/26/26dfirdominican.com/dfir-jobs-update-10-26-26
- Genesis Momentum Powers Cellebrite’s Autumn Release: More Evidence, Deeper Insight, Broader Access For Investigationsforensicfocus.com/news/genesis-momentum-powers-cellebrites-autumn-release-more-evidence-deeper-insight-broader-access-for-investigations
- Magnet Forensics Launches Magnet AI Research Lab To Provide Peer-Backed Evidence To The Communityforensicfocus.com/news/magnet-forensics-launches-magnet-ai-research-lab-to-provide-peer-backed-evidence-to-the-community
- Agentic AI For Digital Investigations: Matt Goeckel Introduces Cellebrite Genesisforensicfocus.com/podcast/agentic-ai-for-digital-investigations-matt-goeckel-introduces-cellebrite-genesis
- End-To-End Digital Investigations: From First Access To Final Verdictforensicfocus.com/webinars/end-to-end-digital-investigations-from-first-access-to-final-verdict
- Preparing Digital Multimedia Evidence For Court: What To Consider Before Presentationforensicfocus.com/articles/preparing-digital-multimedia-evidence-for-court-what-to-consider-before-presentation
- Explore Cellebrite’s Autumn 2026 Release: Discover What’s Newforensicfocus.com/videos/explore-cellebrites-autumn-2026-release-discover-whats-new
- Forensic Focus Digest, 30 Oct 2026forensicfocus.com/news/forensic-focus-digest-30-oct-2026
- How A MacBook With A Broken Screen Helped Convict A UK Property Fraudster: Belkasoft X Case Studyforensicfocus.com/case-studies/how-a-macbook-with-a-broken-screen-helped-convict-a-uk-property-fraudster-belkasoft-x-case-study
- Microsoft Defender for Endpoint: Beyond default telemetry with Custom Data Collection Rulesjeffreyappel.nl/microsoft-defender-for-endpoint-beyond-default-telemetry-with-custom-data-collection-rules
- SANS DFIR Summit 2026 Recapstark4n6.com/2026/10/sans-dfir-summit-2026-recap.html
- Introducing the Magnet AI Research Lab: Our first peer-reviewed study puts AI in digital forensics to the testmagnetforensics.com/blog/introducing-the-magnet-ai-research-lab-our-first-peer-reviewed-study-puts-ai-in-digital-forensics-to-the-test
- Connecting OSINT and physical device forensics with Magnet Axiommagnetforensics.com/blog/connecting-osint-and-physical-device-forensics-with-magnet-axiom
- Walk before you run: The digital forensics fundamentals we’re still skippingmagnetforensics.com/blog/walk-before-you-run-the-digital-forensics-fundamentals-were-still-skipping
- Prompt injection will land. Secure what AI agents domanifold.security/blog/prompt-injection-action-risk
- Keep Those LEAPPs Fresh with uLEAPPmatthewplascencia.substack.com/p/keep-those-leapps-fresh-with-uleapp
Software Updates
23 items
- Release 4.2.0 – 10/25/2026dist.apache.org/repos/dist/release/tika/4.2.0/CHANGES-4.2.0.txt
- Atlas 1.0.3github.com/AtlasFO/Atlas-Community/releases/tag/v1.0.3
- iVe 5.1: Expanding Acquisition Supportberla.co/ive-5-1-expanding-acquisition-support
- Cyber Triage 4.0: New UI, Embedded AI, SentinelOne Importcybertriage.com/blog/releases/cyber-triage-4-0-new-ui-embedded-ai-sentinelone-import
- New Cyber Triage 4.0 UI: What Features Movedcybertriage.com/blog/new-cyber-triage-4-0-ui-what-features-moved
- Corrobora v0.2.0github.com/Gear-I/Corrobora/releases/tag/v0.2.0
- winfor-salt v2026.14.1github.com/digitalsleuth/winfor-salt/releases/tag/v2026.14.1
- so-crates v5.1.0github.com/dougburks/so-crates/releases/tag/v5.1.0
- crush-forensics v0.24.0github.com/kalink0/crush-forensics/releases/tag/v0.24.0
- MISP Modules v3.1.1: 33 New Expansion Modules and More Ways to Turn Threat Intelligence into Actionmisp-project.org/2026/10/25/misp-modules.3.1.1.released.html
- Management Center 4.3: A New Interface and Smarter THOR Exclusionsnextron-systems.com/2026/10/26/management-center-4-3-a-new-interface-and-smarter-thor-exclusions
- Analysis Cockpit 4.5: More Efficient Case Management and Improved Operationsnextron-systems.com/2026/10/26/analysis-cockpit-4-5-more-efficient-case-management-and-improved-operations
- Security Center 3.0: Multi-Tenancy, Advanced Access Control and User APInextron-systems.com/2026/10/26/security-center-3-0-multi-tenancy-advanced-access-control-and-user-api
- Plaso 20261027 releasedosdfir.blogspot.com/2026/10/plaso-20261027-released.html
- 7.261030.1github.com/OpenCTI-Platform/opencti/releases/tag/7.261030.1
- ExifTool 13.60exiftool.org/history.html
- Hayabusa-Bulk-Runner v0.11.0github.com/rorywag/Hayabusa-Bulk-Runner/releases/tag/v0.11.0
- unfurl v2026.11github.com/RyanDFIR/unfurl/releases/tag/v2026.11
- Announcing 010 Editor – Version 17.0sweetscape.com/010editor/latest_version.html
- masstin v1.3.4github.com/jupyterj0nes/masstin/releases/tag/v1.3.4
- YARA v4.6.0github.com/VirusTotal/yara/releases/tag/v4.6.0
- Hayabusa v4.3.1 – Vulnpocalypse Releasegithub.com/Yamato-Security/hayabusa/releases/tag/v4.3.1
- suzaku v3.0.0 – Vulnpocalypse Releasegithub.com/Yamato-Security/suzaku/releases/tag/v3.0.0
⚡ Recent Tech & Security Feed
- Looking for real-world cybersecurity problems for my degree final projectreddit.com/r/computerforensics/comments/1xjeva8/looking_for_realworld_cybersecurity_problems_for
- How to get into forensics for law enforcement? No degree, but 3.5 years of IT supportreddit.com/r/computerforensics/comments/1xinxr5/how_to_get_into_forensics_for_law_enforcement_no
- Some questions as a newbies studying Forensicsreddit.com/r/computerforensics/comments/1xile44/some_questions_as_a_newbies_studying_forensics
- Specs for work station?reddit.com/r/computerforensics/comments/1xg8uql/specs_for_work_station
- InfoSec News Nuggets – 11/02/2026aboutdfir.com/infosec-news-nuggets-11-02-2026
- InfoSec News Nuggets – 10/30/2026aboutdfir.com/infosec-news-nuggets-10-30-2026
- InfoSec News Nuggets – 10/29/2026aboutdfir.com/infosec-news-nuggets-10-29-2026
- InfoSec News Nuggets – 10/28/2026aboutdfir.com/infosec-news-nuggets-10-28-2026
- InfoSec News Nuggets – 10/27/2026aboutdfir.com/infosec-news-nuggets-10-27-2026
- How Detego Global’s AI Technology Is Transforming Child Abuse Investigationsforensicfocus.com/articles/how-detego-globals-ai-technology-is-transforming-child-abuse-investigations
- AI For Investigations: 5 Myths, Debunkedforensicfocus.com/articles/ai-for-investigations-5-myths-debunked
- Forensics StartMe Updates (November 2026)stark4n6.com/2026/11/forensics-startme-updates-november-2026.html
- Hero or hooligan: Orestes and the Furieseclecticlight.co/2026/11/02/hero-or-hooligan-orestes-and-the-furies
- Solutions to Saturday Mac riddles 384eclecticlight.co/2026/11/02/solutions-to-saturday-mac-riddles-384
- Lightest-weight macOS virtualisation with Vimy, an updateeclecticlight.co/2026/11/02/lightest-weight-macos-virtualisation-with-vimy-an-update
- A painted weekend in Egypt 2eclecticlight.co/2026/11/01/a-painted-weekend-in-egypt-2
- Last Week on My Mac: An insecure world built on trust storeseclecticlight.co/2026/11/01/last-week-on-my-mac-an-insecure-world-built-on-trust-stores
- A painted weekend in Egypt 1eclecticlight.co/2026/10/31/a-painted-weekend-in-egypt-1
- Saturday Mac riddles 384eclecticlight.co/2026/10/31/saturday-mac-riddles-384
- New products for new species, revisitedeclecticlight.co/2026/10/31/new-products-for-new-species-revisited
- Painting with impaired vision: Vincent van Gogheclecticlight.co/2026/10/30/painting-with-impaired-vision-vincent-van-gogh
- From click to action: how macOS does what you wanteclecticlight.co/2026/10/30/from-click-to-action-how-macos-does-what-you-want
- Windows Appapps.microsoft.com/detail/9n6npp5hdbz1
- Why are Soviet math textbooks so hardcore in comparison to US textbooks? (2017)quora.com/Why-are-Soviet-mathematics-physics-textbooks-so-insanely-hardcore-in-comparison-to-US-textbooks/answer/Scott-Miller-307
- WTF Ubuntu?chalmovsky.com/posts/wtf-ubuntu
- Anthropic releases amended IPO prospectus with third-quarter financialscnbc.com/2026/11/02/anthropic-ant-s-1-quarter-financials.html
- School has given straight-a grades to the student, who can't do masic mathnypost.com/2026/10/31/us-news/adriana-aviles-says-her-son-was-given-phony-grades-is-behind-in-math
- Pray for Chaosgeohot.github.io//blog/jekyll/update/2026/11/01/pray-for-chaos.html
- Last night an AI agent performed brain surgery on a mousetwitter.com/OcanaSantero/status/2115442964574908902
- Private Jet plane crashes in Floridacbc.ca/news/world/florida-plane-crash-9.7404996
- Never Complain, Never Explainen.wikipedia.org/wiki/Never_complain,_never_explain
- Supermarket freezers across Europe hit by second suspected cyber-attacktheguardian.com/world/2026/nov/02/supermarket-freezers-across-europe-hit-by-second-suspected-cyber-attack
- Supermarket freezers in Belgium and Sweden hit by suspected cyber-attackbbc.com/news/articles/cq1kd1nee80eo
- The future in old computer magazines (1984–2004)tomorrowasusual.substack.com/p/blast-from-the-past-the-future-in
- BioWare co-founder: game execs "have never made a game" and don't get itpcgamer.com/gaming-industry/none-of-these-people-have-ever-made-a-game-bioware-co-founder-greg-zeschuk-says-of-game-industry-executives-they-just-dont-know-how-it-works
- Wir müssen wissen – wir werden wissenremy.wang/blog/hilbert.html
- China's First Frontier AI Export Controls: Mofcom Announcement No. 48labs.cloudsecurityalliance.org/research/csa-research-note-china-ai-export-controls-announcement-48-2
- From Charlemagne to the Kitchen Boy: Reading the Hamburg Rathausalsterrunde.com/from-charlemagne-to-the-kitchen-boy-reading-the-hamburg-rathaus
- Show HN: Wikihack – HackerTube, but for Wikipedia articles mentioned on HNwikihack.netlify.app
🛡️ Community Channels
Community Channels
r/computerforensics
60k+ members
Case discussions, tool Q&A, and career advice for digital forensics practitioners.
r/blueteamsec
45k+ members
High-signal defensive security: threat intel, detection engineering, and incident response links.
r/netsec
500k+ members
Technical information security content — research papers, exploits, tooling, and write-ups.
r/Malware
85k+ members
Malware analysis, reverse engineering samples, and threat actor discussions.
r/cybersecurity
1M+ members
Broad security community: news, certifications, career paths, and industry happenings.
r/ReverseEngineering
200k+ members
Reversing tools, CTF write-ups, binary analysis, and low-level debugging techniques.