What MSPs Need to Know about CIRCIA Final Rule | Todyl
Is your MSP ready for CIRCIA? Covered clients must report cyber incidents in 72 hours. Learn who's covered and how to deliver compliance services.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,461 matching stories — announcement, in Managed Detection & Response (MDR) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Huntress Employee Spotlight: Meet Ben Bernstein
Meet Ben Bernstein, cybersecurity advisor and security badass, in this employee spotlight. See how he makes a difference every day.
5 Things to Look for in an Enterprise Cybersecurity Partner
The post 5 Things to Look for in an Enterprise Cybersecurity Partner appeared first on Secure Halo.
Breaking the IT Bottleneck: A Market Access Checklist for Medtech Leaders
Pricing and reimbursement are high on the medtech executive agenda this year. In Deloitte’s 2026 Life Sciences Executive Outlook, 37% of medtech leaders identified these areas, along with contracting and access, as a key focus for the year.1
24/7 Network Monitoring Benefits for Small Businesses
See how 24/7 network monitoring benefits small businesses by reducing downtime, spotting threats early, and keeping teams productive and protected daily. The post 24/7 Network Monitoring Benefits for Small Businesses appeared first on mPoweredIT.
PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE
PaperCut NG and PaperCut MF are under active exploitation. Huntress reproduced a pre-auth RCE chain and shares urgent patching, exposure, and detection guidance.
New research raises questions around Log4j 2 LogEvent deserialization
At a glance: Researchers published proof-of-concept (POC) code demonstrating code execution against applications that deserialize serialized Apache Log4j 2 LogEvent objects received from remote systems. The research applies to a specific application architecture rather than all Log4j 2 deployments. Exposure is limited to applications that receive serialized LogEvent data from other systems and deserialize that data into Java objects. Apache Log4j maintainers reviewed the report, closed the assoc
Security Bulletin: Memory Overflow Vulnerability in Citrix NetScaler ADC and NetScaler Gateway
About: CVE-2026-8452 is a high-severity memory overflow vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances configured as a Gateway or AAA virtual server. The vulnerability affects appliances with Gateway functionality enabled. Administrators can determine potential exposure by checking the NetScaler configuration for add authentication vserver, indicating an AAA virtual server, or add vpn vserver, indicating a Gateway configuration. Successful exploitation may compromi
See More, Act Faster: Arctic Wolf’s Next Step in Accessible Security Operations
Security operations are complex. Teams are constantly balancing investigations, risk, operational health, and day-to-day priorities. Knowing what requires attention and deciding what to do next isn’t always easy. That’s why Arctic Wolf® is introducing new experiences designed to make security operations more accessible and easier to manage. We’re taking the next step forward with two ... See More, Act Faster: Arctic Wolf’s Next Step in Accessible Security Operations
What to do if you find someone else’s bank card | Kaspersky official blog
Found a bank card that isn’t yours? Here’s the right way to proceed — including who to reach out to, and why you shouldn’t try to track down the owner yourself.
10 Readiness Steps After the Okta Breach | Mitiga
Identity provider compromise puts every downstream app in scope. Ten steps to check your exposure and hunt for misuse in your Okta logs.
What Cloud Threat Hunting Is and How to Run One | Mitiga
Hunting in the cloud depends on data you collected before the incident. What to look for in cloud and SaaS logs, and where most hunts stall.
ShinyHunters & Rockstar: Snowflake Data Breach Leads to Compromise | Mitiga
Stop the next supply chain attack. See how ShinyHunters compromised Rockstar via a Snowflake data breach. Get the tactical threat hunting tips your SOC needs.
The AI CVE exploitation evidence story: Headlines are scarier than reality
Expel's vulnerability intel team is currently monitoring 1,250+ CVEs related to 50 unique AI vendors; here's what we think you should know.
What a 24/7 SOC Does (And Why It Matters for MSPs) | Todyl
A 24/7 SOC for MSPs means analyst-led threat monitoring and incident response at 3 a.m. See what a SOC does and why building one rarely pencils out.
Ubiquiti patches three critical UniFi vulnerabilities
At a glance: Ubiquiti released patches on August 26, 2026 for three maximum-severity vulnerabilities affecting UniFi Protect, UniFi OS, and UniFi Talk. The vulnerabilities require little effort to exploit and do not depend on user interaction. Successful exploitation could allow unauthorized access to management functions, authentication bypass, or command execution on affected systems. Identify relevant deployments, prioritize internet-facing systems, apply the updates released in Security Advi
CISA's 'A Tale of Two SOCs': The Advisory Every MSSP Should Be Reading This Week
CISA's August 2026 advisory pits two red team assessments against each other: same access, same attack chain, two very different outcomes. The gap between them is the exact gap Vijilan's Global SOC is built to close.
New Huntress Managed ITDR Dashboard: Faster Identity Investigations
Huntress’ redesigned Managed ITDR dashboard adds Rapid Identity Triage, Failed Login Characterization, and Quick SIEM search for faster investigations.
MSP Pricing Guide: Security-Inclusive Tiers That Scale
Beginning on Friday, October 16, 2026, N-able’s Adlumin MDR and Nightscope Threat Research teams have been tracking the now-confirmed compromise affecting the ConnectWise/SkyKick Cloud Backup app for Microsoft 365. What we've done On Friday, we engaged in a proactive hunt to identify Adlumin partners and customers who are using this M365 app and have performed outreach if indicators associated with this event. N-able’s Adlumin MDR and Nightscope Threat Research teams have constructed
Izolować urządzenie czy najpierw zadzwonić? Jak ustalić scenariusze reakcji na incydenty
Detekcja pojawiła się o 3:11 w nocy. Wygląda poważnie – proces łączy się z zewnętrznym adresem, a wzorzec aktywności odpowiada możliwej próbie ruchu bocznego. Odpowiedź jest gotowa, izolacja urządzenia od sieci (technicznie, jedno kliknięcie). Tylko, że akurat to urządzenie obsługuje aktywny proces produkcyjny, którego przerwanie będzie miało koszt. Izolować czy najpierw zadzwonić? W praktyce to... Artykuł Izolować urządzenie czy najpierw zadzwonić? Jak ustalić scenariusze reakcji na incydenty p
One Adversary, Two Outcomes: The 0.027% Proof
One malware campaign, 11,000 compromised devices, two banks with very different outcomes. At the bank with fused defence, fraud succeeded on just 0.027% of compromised devices; nine times less than the market average. Regulators are taking notice too.
Know Every Way Back In
Reducing risk when users lose devices, passwords, and authenticators or… “When Plan B Becomes Plan Breach” Account recovery is necessary. People forget passwords, lose phones, replace devices, or otherwise lose every authenticator they have. But every legitimate way back into an account is another path an attacker can try to use. In May 2026, Microsoft […] The post Know Every Way Back In appeared first on infotex.
From Low-Privileged User to Multiple Domain Admin Paths - In Hours
How KomodoSec’s AigentX Penetration Tester and Red Teamer mapped an assumed-breach Active Directory environment, proposed an operator-approved attack plan, and autonomously demonstrated multiple routes toward full domain compromise inside a large enterprise company. Human-controlled strategy. Autonomous execution. Evidence-backed results. THE CHALLENGE One ordinary domain account. Multiple routes toward Domain Admin. AigentX was used in an authorized internal red team engagement against a...
The Feedback Loop: Empowering Detection Engineering
One of the architectural decisions in the Resolution Intelligence Cloud that I am most proud of is one that users rarely see directly: the feedback loop that allows the system to learn from every analyst interaction.
TWiC: vCenter Overrun, AI-Written PLC Exploits, & Citrix Patches Again
This Week in Cybersecurity (TWiC) Security Advisory vCenter Overrun, AI-Written PLC Exploits, & Citrix Patches Again Attackers went straight for the platforms that control critical parts of anyone’s environment: management planes, control systems, and edge appliances. 361 vCenter victim IPsacross 47 countries 5 days from disclosureto exploitation 22,000+ NetScaler ADC instancesexposed online A suspected China-nexus […]
A call for collective action on cyber defense
Sophos joins organizations worldwide in supporting a coordinated and responsible approach to cyber defense.
The State of Ransomware in Education 2026
Insights from 226 IT and cybersecurity leaders across the education sector in 17 countries whose organizations were hit by ransomware in the past year.
Security Bulletin: Multiple Critical Vulnerabilities affecting Ubiquiti products
About: Ubiquiti has disclosed three critical vulnerabilities affecting UniFi Protect, UniFi OS devices, and UniFi Talk, each carrying a CVSS score of 10.0. CVE-2026-77537 and CVE-2026-77554 are unauthenticated command injection vulnerabilities in UniFi Protect and UniFi Talk. An attacker with network access can exploit improper input validation to execute commands on the underlying host device without privileges. CVE-2026-77550 is a CRLF injection vulnerability affecting multiple UniFi OS device
Mapping AI detections to MITRE ATLAS: How Expel does it
See how Expel MDR for AI labels AI-related detections against MITRE ATLAS tactics in Workbench, with a real mapping walkthrough.
VoluNteer Spotlight: Magdalena Jasinska
Cleanroom recovery is the missing layer that separates "we have backups" from "we can safely recover." This post explains why restoring an unverified backup straight into production can re-trigger a ransomware attack, what an isolated recovery environment (IRE) actually does, and how to build cleanroom recovery into your disaster recovery plan. If you own recovery outcomes for clients or your own organization, you'll leave knowing exactly what your current plan is missing. The dangerous assumpti
Dark Caracal Reloaded: New Malware, Same Hunting Grounds
Arctic Wolf Labs exposes Dark Caracal’s evolving tradecraft, linking 249 samples to two operational build profiles and a resilient Ethereum-based C2 architecture targeting Latin America. In June 2026, Arctic Wolf Labs investigated a targeted intrusion affecting a communications organization in Venezuela. We assess with medium confidence that this activity is linked to Dark Caracal, a ... Dark Caracal Reloaded: New Malware, Same Hunting Grounds
Par for the Course: A Golf Course IT Health Check in 10 Questions
If you’re a golf course operator and you don’t have time to dig into every technology issue, you can still spot warning signs before they become costly problems.
Lutte contre le Phishing : comment Intrinsec et GLIMPS automatisent le traitement des signalements utilisateurs
Malgré des solutions de filtrage de plus en plus performantes, des e-mails malveillants continuent d’atteindre […] L’article Lutte contre le Phishing : comment Intrinsec et GLIMPS automatisent le traitement des signalements utilisateurs est apparu en premier sur INTRINSEC.
Tortoiseshell: New Toolset and Operational Infrastructure Exposed
Group-IB Threat Intelligence performed enrichment and APT hunting based on recent public data about the Tortoiseshell APT group, leading to the discovery of new samples sharing similarities with known Tortoiseshell malware and additional operational infrastructure.
A Medical Practice IT Example That Reduces Downtime
See a medical practice IT example that shows how proactive support, secure access, backups, and clear planning protect patient care and uptime every day. The post A Medical Practice IT Example That Reduces Downtime appeared first on mPoweredIT.
Your Protect Surface Is Already Out of Date
Protect Surface metadata drifts continuously in cloud environments. The five-stage maturity model to keep it current, and what breaks when it doesn't.
Oracle WebLogic Server flaw enables server takeover via T3 and IIOP
At a glance: A critical vulnerability affecting Oracle WebLogic Server could allow a low-privileged threat actor with network access to WebLogic's T3 or Internet Inter-ORB Protocol (IIOP) services to compromise vulnerable servers. Oracle patched CVE-2026-60702 on August 18, 2026, as part of its August 2026 Critical Patch Update. The vulnerability affects Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation can result in takeover of the affec
What is GRC in Cybersecurity? Governance, Risk, and Compliance Explained | Todyl
What is GRC in cybersecurity? Learn the GRC meaning, the 3 pillars of governance, risk, and compliance, top frameworks, and how MSPs use GRC tools to protect clients.
Balonx Sistema: El Rostro Detrás del PhaaS que Impacta la Banca Mexicana
Group-IB expone una operación mexicana de PhaaS dirigida a más de 20 instituciones financieras, con capacidades de phishing en tiempo real, vishing con IA y RAT para dispositivos móviles.
EDR vs Antivirus: A Comparison for Modern Endpoint Security
Attackers used to work at human speed. A skilled researcher found a vulnerability, built an exploit, and chained it into an attack over days or weeks. That gave defenders room to scan, triage, and patch. That room is gone. AI hasn't just changed how IT teams work, it's changed how attackers operate. Vulnerability discovery, exploit weaponization, and attack chaining that once took weeks now happen in hours. Unfortunately, the monthly patch cycles and manual triage that most teams still run were