Threat Intelligence

A threat-hunting report puts the gap between a public proof-of-concept and active exploitation at about 48 hours. Here is what that does to patch scheduling, why severity scores are the wrong primary signal, and a few adjustments worth making.

Blockchain C2 removes the domain you’d normally report. Why that pushes defense to exactly where PCI DSS 6.4.3 and 11.6.1 already point.

How the traffic laundering economy turns jailbroken FireSticks into residential proxies, and what defenders can actually do about it.

A practitioner primer on protocol abuse: how data quietly leaves networks through DNS, ICMP, HTTPS/TLS, and the headers of TCP itself.

The largest DBIR ever published, read for signal. Where generative AI actually shows up in the data and where the fundamentals still rule.

Google caught the first AI-assisted zero-day in the wild. How attackers talked a model into helping, and why the method matters more than the exploit.

CISA and NCSC published a joint analysis of FIRESTARTER, a backdoor that survives reboots and evades signature detection on Cisco edge devices.

How the DNS hijacking attack chain worked across 120+ countries, and what practitioners should be checking in their own environments.

How the April 2026 compromise of CPUID’s site turned CPU-Z and HWMonitor downloads into a multi-stage malware delivery chain.

Why endpoint management servers are a high-value target, how both flaws were exploited, and the actions practitioners should take today.