Stories tagged “Incident Response.”
12 stories
A Tale of Two SOCs: Insights From Two Red Team Assessments
CISA conducted two simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A faile…
N-able has released a second hotfix for its N-central RMM product to address ongoing exploitation of a security flaw, CVE-2026-18577, which attackers are leveraging to gain administrative access and establish persistence on managed systems.
N-able said attackers exploited an authentication bypass in N-central to gain remote administrative access and reach the customer systems managed through those servers. Its first fix was incomplete.
Hackers modified a JavaScript file served by Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. Adform detected the incident on July 27, 2026, removed the malicious code, notified affected clients, and reported it to authorities.
A new survey suggests that many organizations lack the coordination, visibility, and executive alignment needed to withstand a serious cyberattack. Despite having incident response plans and security tools in place, 73% of organizations admit they would not be 'fully read…
5 ways SRE AI agents are set to augment human capabilities
Software reliability engineering (SRE) AI agents are poised to augment human capabilities in various ways, including improving incident response, reducing mean time to detect (MTTD), and enhancing collaboration between humans and AI systems.
Hugging Face, a leading open-source AI platform, disclosed a breach by an autonomous AI agent that exploited vulnerabilities in its data processing pipeline, gaining access to internal datasets and credentials.
SonicWall has issued a warning about the active exploitation of two zero-day vulnerabilities affecting its Secure Mobile Access (SMA) 1000 series appliances, with one flaw allowing arbitrary command execution. Urgent patches have been released, and CISA has added these vu…
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a recent data leak in which a contractor published dozens of internal CISA credentials in a public GitHub repository for almost six months. Experts say the gaps identified in the agency…
What an ex-NSA red teamer wants every SOC to stop doing
A former NSA red teamer suggests that Security Operations Centers (SOCs) should stop doing certain things to improve their effectiveness.
A survey finds that 94% of security incidents involve anonymized infrastructure, but teams remain reactive.
ServiceNow says attackers exploited a flaw to get deeper unauthorized access to some customer instances. The company patched it on June 5 and notified impacted customers.