The second pull from the honeynet surfaced a 2017-era WannaCry launcher delivered through DoublePulsar, more than 14,000 EternalBlue sessions from two hosts, and an attacker who planted an SSH key to reach back out to their own infrastructure.
Day one of running a honeynet produced two malware samples in twelve hours. Neither cared about the ICS disguise. Both came in through default and predictable credentials on SSH and Telnet.
The National Cybersecurity Alliance’s four habits for 2026 are sound advice. Checked against this year’s vishing, device code phishing, ClickFix, and fake update lures, each one shows where the attack has moved and which control has to hold when the user can’t see it coming.
Two late-September 2026 disclosures, an unsigned-token flaw in Microsoft’s internal Titan analytics service and cross-user leakage through OS file-notification APIs, show how easily the control you point to can differ from the control that actually enforces access.
SLEEPWALKER carries no command-and-control infrastructure and generates no outbound traffic on its own. That design puts it outside most of what a network-centric detection stack is tuned to catch, and moves the detection burden onto host integrity and configuration state.
Saying something positive about certifications now means arguing against the room. Here is that argument, followed by where to start, what each credential is actually good for, and what changed this year.
A preprint published on 10 August 2026 demonstrated instructions propagating between AI agents through ordinary messages. The propagation is interesting. Which file the payload had to land in is more useful.
Two August KEV additions put CISA’s most aggressive remediation tier into practice for the first time. The operational shift isn’t the calendar, it’s the requirement to determine whether an attacker got there first.
A three month investigation into a December 2025 attack on a Polish combined heat and power plant found something no one had documented before: attackers reaching an operational technology network through a private cellular APN. There was no exploited CVE and no malware. Every destructive step used a supported device function.
A threat-hunting report puts the gap between a public proof-of-concept and active exploitation at about 48 hours. Here is what that does to patch scheduling, why severity scores are the wrong primary signal, and a few adjustments worth making.