Forensic Analysis

• Hal Pomeranz at ‘Righteous IT’
  mtt.sh – Mounting Linux Images

• Heather Barnhart at Smarter Forensics
  More Hay On The Haystack: What Our AI Panel Disagreed On

• Howard Oakley at ‘The Eclectic Light Company’
  Can I browse log entries from 2 weeks ago?

• LEAPPs Blog

  • Dropbox DBX Decryption, Nine Years Later
  • Full File System extractions in Zip: MAC times, part two
  • KeepSafe for Android Caught an Intruder. It Was Me.

• Jeff Rutherford at Magnet Forensics
  RDP: Forensic analysis of Windows Remote Desktop Protocol artifacts

• Marco Neumann at ‘Be-binary 4n6’
  Ten Days of Android Battery History – and App Updates

• Matthew Plascencia
  Forensics is FIRE!: A Review of LAVA

• Mihir Singh Choudhary
  Your Browser Is Keeping Years of Your WhatsApp.

• Kilian Neumair and Louis Flamion at NVISO Labs
  Keystrokes in Disguise: Forensic Analysis of a Digispark HID Device

• Sujay Adkesar

  • One Reported Email, Two Payloads: A SOC Analyst’s Email Forensics Playbook
  • The Browser Kept a Receipt: Proving a Download Was the Same File with ETag

• Tim Korver at ‘Thesis Friday’
  From hits to a reconstruction: search term sets for the Unified Log (Part 2 of 2) – Thesis Friday #32

Threat hunting/threat intelligence

• PHP vulns!

  • Critical Remote Code Execution Vulnerabilities in PHP Core
  • Understanding PHP2Shell: Everything You Need to Know
  • Arctic Wolf Labs: Finding, Prioritizing, and Patching PHP2Shell Exposure
  • PHP2Shell: Critical PHP Vulnerabilities Enable Unauthenticated Remote Code Execution
  • Reproducing the PHP2Shell Vulnerability and Detection Using AhnLab EDR/XDR
  • Analysis of the GitHub “php2shell” Repository: Public PoCs and Defense Tools That Spread Immediately After the Disclosure of the PHP Vulnerability
  • “Approximately 110,000 PHP Servers” in Korea: How Were They Counted?
  • From PHP2Shell Monitoring to Customer Validation: A Day in Adversary Research
  • Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
  • Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
  • Investigating PHP2Shell after patching
  • Technical Advisory: PHP2Shell Pre-Auth RCE (CVE-2026-109618, CVE-2026-109619)
  • Widespread PHP Flaw May Cause Many Site Outages Today
  • A tale of two PHP remote vulnerabilities
  • PHP2Shell: strumenti per verificare l’esposizione alle vulnerabilità critiche
  • PHP2Shell: 650 URL potenzialmente vulnerabili tra gli indirizzi censiti in IPA
  • PHP2Shell: Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
  • PHP2Shell: Log4Shell at AI Speed — A CISO’s Perspective
  • PHP2Shell Update: One in ten organizations impacted as Europe bears the brunt
  • Critical Vulnerabilities in PHP Require Immediate Patching
  • Two critical RCEs in PHP core
  • php2shell: Zeek and Suricata Detections for PHP RCE | Corelight
  • CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
  • Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation
  • 【已复现】漏洞预警｜php2shell：PHP Core 远程代码执行漏洞（CVE-2026-109618/109619）
  • PHP2Shell: Critical PHP RCE
  • PHP Vulnerabilities, ARTEX and the Growing Role of AI in Cyber Attacks
  • PHP2Shell – Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
  • PHP2Shell: Two Critical PHP Vulnerabilities (CVE-2026–109618 and CVE-2026–109619) — Are Your…
  • php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
  • PHP2Shell and the October patch wave: a CISO’s view
  • PHP2Shell: Our assessment of the risk for systems running PHP
  • PHP2Shell Exploitation Attempts Observed
  • PHP2Shell Exposure: 73% of 2.2 Million Version-Disclosing PHP Services Run Unsupported Branches
  • Understanding PHP2Shell Vulnerabilities and Reducing Risk While You Patch
  • PHP2Shell: What the Vulnerability Means and Why Patching Is Urgent
  • PHP 원격 코드 실행 취약점 긴급 안내 보고서
  • Responding to php2shell PHP Vulnerability When You Don’t Know What Secrets Are Deployed
  • Keep Calm, and Patch PHP2Shell
  • PHP2Shell Exposure Depends on More Than Whether You Use PHP
  • Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)
  • PHP2Shell: How to Protect Your Server | Kaspersky official blog
  • PHP2Shell: Critical RCE Vulnerabilities Affect a Large Majority of Web Servers
  • PHP2Shell: What the Critical PHP Vulnerabilities Mean for Your Servers
  • Brace for Impact — php2shell
  • CVE-2026-109618 and CVE-2026-109619 affecting PHP
  • php2shell (CVE-2026-109618 & CVE-2026-109619): Fix & Mitigation
  • PHP2SHELL Detection Coverage in THOR
  • PHP2Shell Operational Guidance
  • Okta’s Response to PHP2Shell
  • Critical PHP2Shell vulnerabilities
  • Patching PHP2Shell: How to Find and Fix Your Exposure
  • Critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619): how to protect your Bare Metal and VPS servers
  • CVE-2026-109618 & CVE-2026-109619: Two Vulnerabilities Allow Unauthenticated RCE in PHP
  • PHP2Shell: 24 hours in, 99.3% of Measurable PHP Instances Are Still Unpatched
  • Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
  • Millions of PHP Instances Exposed – What Organizations Need To Do Right Now
  • PHP2Shell and what the AI headlines are missing 
  • CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
  • PHP2Shell Exploitation: Two Critical PHP Flaws Explained
  • PHP2Shell: PHP Remote Command Execution Flaw
  • Threat advisory: Critical PHP vulnerabilities dubbed ‘PHP2Shell’
  • October 2026 PHP vulnerabilities: Sandfly is not affected
  • Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
  • (Reliable)? php2shell exploitability, (Fri, Oct 23rd)
  • PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)
  • Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619
  • Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
  • PHP2Shell: Failed Requests, Memory Corruption and Remote Code Execution
  • PHP2Shell: The PHP Vulnerability a Version Scan Can’t Judge
  • PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now
  • PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
  • PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
  • Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)
  • Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619)
  • php2shell: Two Critical PHP Vulnerabilities Expose Web Servers to Remote Code Execution
  • PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution
  • PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Detecting unauthenticated remote code execution in PHP core
  • The adversary economy: How threat actors are reacting to PHP2Shell
  • PHP2Shell: Critical PHP RCE Flaws CVE-2026-109618 & CVE-2026-109619
  • ThreatMon From Underground Forums to SOC: PHP2Shell
  • PHP2Shell: What defenders need to know about CVE-2026-109618 and CVE-2026-109619
  • PHP2Shell: Critical PHP RCE Flaws (CVE-2026-109618 & CVE-2026-109619) Explained
  • What PHP2Shell Reveals About the Limits of Automated Pentesting
  • PHP2Shell: One Upload, Full Server
  • A patched PHP server can still be a compromised one by Lucie Cardiet
  • Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal
  • Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAF
  • PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
  • Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
  • Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet
  • CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks

• Abdul Mhanni
  From Vendor to Vulnerability: How Big-Name Products Degrade Your AD Security

• Ryan Devendorf and Callie Baron at Abnormal Security
  Athena StealthRoute: A Phishing Marketplace with Cloaking and AI Tools

• Acronis
  The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation

• Adam at Hexacorn

  • Solving practical problems with AI – Part 2 – the most popular, and most commonly used passwords for malicious archives…
  • ripgrep as a lolbin

• Aikido

  • LiteLLM compromised again: infostealer and RAT found in version 1.107.0
  • eMudhra CA compromise: eight private keys, and one of them is 4
  • Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
  • Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTPs.

• Stas Neyman at Akamai
  What ARTEX Reveals About Overlooked Attack Surfaces

• ASEC

  • Does It Stop When Someone Is Watching? The Suspicious Behavior of a New Type of Infostealer
  • September 2026 Threat Trend Report on Ransomware

• Wade Wells at Black Hills Information Security
  Detection Engineering: Stop Drowning in Alerts and Start Catching Bad Guys

• Rebecca Harpur at BlackFog
  DarkCore: A Data-Theft RAT With a Session-Hijacking Browser

• Bob Rudis
  Auditing the Auditors

• Brad Duncan at Malware Traffic Analysis

  • 2026-10-22: Seven days of scans and probes and web traffic hitting my web server
  • 2026-10-16: Coruna-like iOS exploit kit traffic
  • 2026-10-09: Pcap of infection from Macfinger Clickfix activity

• Brian Krebs at ‘Krebs on Security’
  Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

• BushidoToken
  UK Cybercrime Journal: Teenage Online Extremism Cases in 2026

• CERT-AGID

  • Sintesi riepilogativa delle campagne malevole nella settimana del 17 – 23 ottobre
  • PHP, nuova vulnerabilità RCE: rischio circoscritto e mitigazione disponibile

• Chamindu Pushpika at ChamX
  Inside a Romulus Campaign – How an MSI Drops a New LegionLoader Build

• Check Point

  • 19th October – Threat Intelligence Report
  • The Risk of AI-Powered Antidetect Browsers in Online Fraud and Influence Operations
  • Infostealer riding the AI Train

• CISA
  #StopRansomware: SafePay Ransomware

• Cisco’s Talos

  • Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
  • Compromised eMudhra intermediate certificates

• ClearSky Cyber Security
  Doppelgänger Russian Influence Campaign in Israel

• Christopher Patton, Bas Westerbaan, Trishna, and Jeremy Hartman at Cloudflare
  8 eMudhra certificates are compromised. Here’s what you need to know

• Cofense

  • Beyond Passwords: How Attackers Abuse Device Code Authentication
  • Threats Hidden in Replies: Threat Actors Deliver Malware and Credential Phishing in Email Threads

• Johanna Amann at Corelight
  Detecting Compromised eMudhra Certificates with Zeek | Corelight

• CrowdStrike
  CrowdStrike Uncovers New Agentic AI Campaigns

• CTF导航

  • APT-C-55（Kimsuky）组织多路径投递攻击活动分析
  • Cellebrite手握iPhone无线电0day漏洞？8米内隔空解锁设备
  • EtherHiding 后门样本分析

• Cyfirma

  • CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure – CYFIRMA
  • Crystal Ball Series – CYFIRMA
  • Weekly Intelligence Report – 23 Oct 2026 – CYFIRMA

• Ian Kretz at Datadog Security Labs
  LiteLLM supply chain compromise: What you need to know

• Detect FYI

  • Beyond IoCs: Start Hunting Their Patterns
  • Detecting GitHound Enumeration via the GitHub API

• Disconinja
  Weekly Threat Infrastructure Investigation(Week43)

• Elastic Security Labs
  How CVE-2026-73570 turns a Zimbra log file into remote code execution

• Bas van den Berg and Jos Huiting at Eye Research
  Cooldown or compromise: the three-day rule for npm and PyPI

• F5 Labs
  Unprompted: When AI Agents Expose Data Without an Attacker

• Gagan Jain at FalconFeeds
  ShinyHunters: From Stolen Databases to Global Data Extortion – Attacks, Tactics and Threat Intelligence in 2026

• Jon DiMaggio at Flare
  Arachnophobia: How Fear, Branding, and Bad Attribution Distorted The Com

• Sébastien Féry at FoxIO
  Header Accordions: QPACK amplification attacks against HTTP/3 servers – FoxIO | Cyber Innovation

• Group-IB

  • The Checker You Pay For
  • Stray Cat, Open Doors: How k0t Wanders Through the Network Edge

• Halkyn Security

  • The First 48 Hours After a Breach: Leadership Decisions
  • Build a Python Honeypot: A Hands-On Guide
  • Building an Insider Investigation Timeline
  • Linux Capabilities and Why ls Doesn’t Show Them
  • Entra ID Sign-in Logs: Scoping a Compromised Account
  • AI Coding Assistant Forensics on Linux

• Hunt IO
  Ukraine’s State Data-Exchange System Targeted by Russian-Speaking Operator via Graylog Log4Shell

• Huntress

  • Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
  • Unboxing Phishing Kits: Huntress Examines 3 Real Kits
  • M365 Token Spray and Replay Campaign Compromises Business Email Accounts

• Intel 471
  Building a Hunt Team the SOC Can Rely On

• iVerify

  • Dead Domains, Live Exploits: How Infected Ads and Expired Analytics Tags Deliver Coruna and DarkSword to iPhones
  • The Story of P7 DarkSword Variant

• Jeffrey Bell at Catching Phish
  You’re not that guy, PAL

• JPCERT/CC
  Recent AI-Assisted Cyber Attacks in Japan: Investigating Attack Infrastructure and Techniques

• Kroll
  Data Breach Outlook 2026: The Third-Party Domino Effect

• LevelBlue SpiderLabs

  • Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts
  • Securing the Software Development Lifecycle and Supply Chain in an AI-Forward World

• Microsoft Security

  • Agents are your newest insiders. Security must move at their speed. 
  • AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
  • Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks

• Ucha Gobejishvili at Mitiga
  Hunting Third-Party App Abuse in Entra

• Natto Thoughts
  The ZRON Leak, Part 2: What China’s Police Actually Bought and Where AI Fit In

• Oleg Skulkin at ‘Know Your Adversary’
  419. Threat Actors Leverage Multiple Techniques to Obtain Credentials in Linux

• OpenSourceMalware

  • Glassworm Hacks OVH Clouds CLI tool
  • LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python Backdoor
  • Python Packages Vulnerable to Node2Shell
  • Brotlipocalypse

• Raymond Ebonine at OSINT Team
  Anatomy of a Fake Job Offer: How I Investigated a LinkedIn Recruiter Malware Campaign

• Ovi Liber
  uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps

• Moshe Siman Tov Bustan and Vitalii Chepurko at OX Security
  LiteLLM 1.107.0 Compromised With A RAT InfoStealer

• Palo Alto Networks

  • “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities
  • EMudhra Intermediate CA Certificates Compromised
  • The Current Landscape of OAuth Attacks

• Alisha Kadam at Point Wild
  Q3 2026 Windows Cyber Threat & Malware Landscape Report

• Prashant Sheshnaryan Pawar at Qualys
  The Science of Exploitability: Decoding BlueHammer

• Rapid7

  • Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
  • Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days

• John P. Mello Jr. at ReversingLabs
  Graphalgo campaign moves upstream into infrastructure as code

• Ridgeline Cyber
  Your Break-Glass Account Is Excluded From Every Policy. It Still May Not Get You In.

• SANS Internet Storm Center
  Orphaned VBA Projects Inside DWG Files: YARA Rule, (Sun, Oct 18th)

• Sansec
  deepveindrilling.com: Magento CMS block loader hits 953 stores

• Securelist

  • The journey of a paper unicorn: adventures inside a modern warehouse
  • Operation FlashHole: Lazarus breaks security, defies control
  • How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

• Security Alliance

  • SEAL weekly stats: 13-20 Oct, 2026
  • Advisory: Fake White-Hat Researchers Target Solana Protocols With Malicious Exploit PoCs

• Akshay Gaikwad and Aaron Beardslee at Securonix
  TRUST#GRAFT : JavaScript-Compromised Sites Target WordPress Admin Browsers to Deploy a Persistent PHP Backdoor

• Sekoia
  Sekoia Honeypot Captures an Attack on GenAI Infrastructure

• Socket

  • LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
  • New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack

• Yağmur Ernalbant at SOCRadar
  New LiteLLM Supply Chain Attack Hits PyPI and Docker

• Sophos

  • ConnectWise Cloud Backup application abused in cross-tenant token sweep
  • Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion
  • BRONZE SANDCASTLE deploys modified Meterpreter shells
  • Web App Owners – You’re on Notice. Your Low-Hanging Fruit Just Got Lower

• Splunk
  What an Agentic Attack Looks Like in Splunk Attack Range

• Alastair Parr at Spur Intelligence
  Beyond the Traffic Count: How to Interpret and Act on Monocle Session Enrichment Data

• Step Security

  • OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond
  • litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader
  • eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update
  • OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found

• Stephan Berger
  Field Notes: Reconstructing an Attacker’s Workflow

• Marco A. De Felice aka amvinfe at SuspectFile
  Leadec Targeted by Anubis: 4 TB of Allegedly Stolen Data and an Initial $6 Million Ransom Demand

• Symantec Enterprise

  • Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries
  • Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks

• Sysdig

  • Node2Shell (CVE-2026-111497): Detecting the Node.js Brotli RCE
  • Detecting and mitigating ZDI-CAN-33367 and five other Linux flaws

• Team Cymru

  • Relaying to the Frontier
  • From Serengeti to Serengeti III: What Three INTERPOL Operations Reveal

• The Hunter’s Ledger
  Help Desks to Host Shells Across Brazil’s Public Sector

• ThreatMon

  • Ransomware Threat Landscape in Türkiye
  • Inside an Exposed ARTEX Workspace

• Joe Chen and John Fokker at Trellix
  What’s left standing when containment mode shuts everything down?

• Umut Bayram at Picus Security
  Famous Chollima APT Group: Major Activities, TTPs, and Simulation

• Varonis
  StealC Is Back, and This Time It’s a RAT

• Anton Cherepanov and Peter Strýček at WeLiveSecurity
  MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration

• Wiz

  • From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
  • LiteLLM Compromised, Steals Credentials
  • ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors

• Nicolás Chiaraviglio at Zimperium
  Beyond the Sandbox: Leveraging Android Intrusion Logs to Expose Advanced Threats

• ZScaler

  • Inside a Global AI-Assisted Hacking Campaign
  • Ransomware Victimology: Redefining the High-Risk User
  • SEO Poisoning Campaign Delivers New Armorsteal Malware

• Блог Solar 4RAYS
  RFRx003: ранее неизвестный бэкдор замечен в атаках на IT-компании

Upcoming events/webinars

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • ADF Weekly Computer Training Sessions

• Black Hills Information Security

  • BHIS – Talkin’ Bout [infosec] News 2026-10-26
  • BHIS – Talkin’ Bout [infosec] News 2026-11-16
  • BHIS – Talkin’ Bout [infosec] News 2026-11-09
  • BHIS – Talkin’ Bout [infosec] News 2026-11-30
  • BHIS – Talkin’ Bout [infosec] News 2026-11-02
  • Free Lab Fridays – The Webcast

• Brett Shavers
  I’ve Spent Nearly 40 Years Learning How to Teach. Now I’m Putting My Investigative Methods Under the Microscope.

• Cellebrite

  • Inside the Autumn 2026 Release
  • Every Device Tells a Story: Turning contraband phones and drones into actionable intelligence

• Robert Fly at Detections.ai
  Detections.ai – Enterprise Walkthrough

• Huntress
  _declassified | Ep.4 Follow the Money: How Your Stolen Data is Banking the Black Market

• Magnet Forensics
  Mobile Unpacked S4:E2 // Harping on health data

• Spur Intelligence
  Inside Doppelganger: How Malware Turns Compromised Devices into a Criminal Proxy Network

Presentations/podcasts

• Belkasoft
  BelkaGPT Architecture Explained – Purpose-Built AI for DFIR | Belkasoft X

• Black Hills Information Security

  • 2026-10-19 BHIS – Talkin’ Bout [infosec] News
  • BHIS – Talkin’ Bout [infosec] News 2026-10-19

• Huntress

  • When a Hacker Accidentally Installs Your EDR
  • Session Hijacking, Phishing, and SSO Abuse Explained

• InfoSec_Bret
  IR – SOC145 – Ransomware Detected (2026)

• Karsten Hahn at Malware Analysis For Hedgehogs
  PortexAnalyzer GUI v1.0.0 – Interactive visualization of PE files

• Magnet Forensics

  • Magnet Autokey: Accelerating your vehicle investigations
  • Ask Me Anything: Accelerating incident response with digital forensics at scale

• Monolith Forensics

  • Tasks and Time Management Deep Dive [Monolith Mondays]
  • Evidence Progress – Monolith Settings
  • Overcome Vulnerabilities in Your Forensic Process [Part 2]

• MSAB
  #MSABMonday – Searching RAM

• MyDFIR
  Can You Investigate This SOC Alert?

• Open Source Forensics Lab
  Using LAVA to Triage Forensic Investigations | LEAPPs Forensics

• OpenSourceMalware
  The OpenSourceMalware Show #26

• Paraben Corporation
  Micro Webinar – Unified Multi-Source Data Analysis & Auto-Examination

• Parsing The Truth: One Byte at a Time Podcast
  S2 E15: TN vs Ahmad Gatlin: Part 5

• Patrick Wardle at Objective-See
  Heartbreaker 💔

• Team Cymru
  Financial services’ Amanda Lerner, Ph.D. on Why Russian Is Still the Lingua Franca of Cybercrime

• THE AI & Security Insights Show

  • WE’RE BACK! Episode – Kickstart the cool months! Security Insights – Foresight – Hindsight
  • Episode 299- Kickstart the cool months! Security Insights – Foresight – Hindsight

• Three Buddy Problem

  • Who’s Hacking Supermarket Fridges in France?
  • PHP2Shell Meltdown: AI Found It. Who’s Going to Patch It?

Malware analysis

• Carter Perez at Lisdex
  Vivisection of an Active Russian-Market Spyware Malware-as-a-Service and Its PyMapper Distribution Chain

• Shmuel Uzan at Morphisec
  Same Vulkan Host, Different Payload: Inside VulcanRAT207.B

• Aman Singh Gill at OSINT Team
  Reverse Engineering LockBit 3.0 Ransomware — From Encrypted Binary to Full Dissection

• Pepe Berba
  MacOS Infostealer “adapts” to new Keychain Protection

• RexorVc0
  Inside DarkVision RAT

• Secjuice
  Artificial Intelligence and Reverse Engineering: Defeating DoNex by Automating Analysis with REA and MCP Protocol

• Bernardo Quintero at VirusTotal
  How Some Malicious AI Skills Hide Instructions from Reviewers

• Zhassulan Zhussupov
  Reversing embedded WebAssembly: part 3. Recovering native cross-references from WAMR relocations in pure C.

Miscellaneous

• Cellebrite

  • Contraband Phone Triage: How Cellebrite Genesis Turns Device Backlogs into Investigative Intelligence
  • Lessons From the Forensic Examiners Behind the University of Idaho Murders Investigation

• Christopher Eng at Ogmini
  BSides NYC 0x06 – CTFd Challenges

• Kevin DeLong at Cyber Social Hub
  Making AI Defensible: What Every Examiner Should Take From the DFRWS Practitioner Report · The Cyber Social Hub

• Fabian Mendoza at DFIR Dominican
  DFIR Jobs Update – 10/19/26

• Forensic Focus

  • Atola TaskForce Gets A Massive Update Including A New Compare Module
  • Investigating WMI Permanent Event Subscription Persistence
  • How Semantics 21 Is Changing The Way Investigators Work With Digital Evidence
  • Passware Kit 2026 v4 Simplifies BitLocker Decryption And Adds E01 Export
  • Detego Global Strengthens Its Presence In Brazil With Detego Day São Paulo 2026
  • MD-RED v4: AI-Powered Mobile Forensic Analysis, From Raw Evidence To Case Insight
  • Forensic Focus Digest, 23 Oct 2026
  • Cellebrite Genesis vs. ChatGPT: Why You Need Purpose-Built Investigative AI
  • Amped Podcast Episode 4 – User Needs, Forensic Minds: How New Features Are Born

• Andrew Garrett at Garrett Discovery
  “Digital Forensics Corp.” allegedly sold $60 million in fake investigations to sextortion victims. A federal judge just froze its assets.

• Alexis Brignoni at LEAPPs Blog
  DFIR Thoughts: Put AI in the code, not the conclusions

• Kevin Schell at Paraben Corporation
  Why Digital Evidence Needs a Behavioral Read, Not Just a Technical One

• Sekoia
  ISOC, AI Agents, And The New Shape Of Security Operations

Software releases/updates

• Akhil Dara

  • SQLite GUI Analyzer 3.0.0
  • WebCache-Forensic-Analyzer WebCache Forensic Analyzer 5.0.0

• Andrew Rathbun
  KAPE-EZToolsAncillaryUpdater 4.6

• Arkime
  v6.9.1

• Arman Gungor at Metaspike
  Enterprise Remediation with Obliterator 3

• Binalyze
  Binalyze AIR 5.29

• Jordan Wiens at Binary Ninja
  6.0 Release 2

• C. Peters
  ALEX 0.7

• Cellebrite
  Genesis Momentum Powers Cellebrite’s Autumn Release: More Evidence, Deeper Insight, Broader Access for Investigations 

• David Augros
  sigwood v1.2.0

• DFIR-IRIS
  IRIS-Web v3.0.0-beta.18

• DFIRe
  1.13.4 — October 20, 2026

• Digital Sleuth
  winfor-salt v2026.13.3

• Eric Zimmerman
  2026.10 (October 2026)

• Erik Hjelmvik at Netresec
  CapLoader 2.2 Released

• Get-Sybers
  DX_DFIR v0.7.0 — flat per-asset lane output + evidence-asset identity

• LEAPPs

  • ALEAPP v2026.4.4
  • iLEAPP v2026.4.5
  • RLEAPP v2026.4.4
  • VLEAPP v2026.4.4

• Mandiant
  flare-floss v4.0.0-alpha.2

• MISP
  MISP v3.0 Early Access: a first look at what’s new

• MSAB
  Q3 2026 Release Now Available

• OpenCTI
  7.261023.1

• Passware
  Passware Kit 2026 v4 Now Available

• Rory Wagner
  Hayabusa-Bulk-Runner v0.10.0

• Yaniv Radunsky
  DFIR Companion v0.44.0