Forensic Analysis

• Arun Prasannan at CCL Solutions
  Compression in the Windows Page File

• Forensafe

  • Windows CBS Log
  • Apple Podcasts
  • Apple Wallet

• Hal Pomeranz at ‘Righteous IT’
  Linux Software RAID Superblocks

• Alexis Brignoni at LEAPPs Blog
  Clearing History Does Not Clear Chromium’s File System Storage

• M4shl3
  Everything You Need To Know Before An Azure Cloud Incident Response

• Jeff Rutherford at Magnet Forensics
  How to investigate business email compromise (BEC): from fraudulent email to full scope 

• Cody Nash at Manifold
  AI agents have few qualms with log tampering

• David André at Open Source DFIR
  Tampering with timelines – injecting false leads

• Ryan Benson at Hindsight Foundry
  Extracting Timestamps from ChatGPT IDs

• S.Nakano
  How Do You Investigate Windows Event Logs?

• Dan Parks at Secjuice
  The Screenshot Is Real, But the Timeline Might Not Be

Threat hunting/threat intelligence

• PHP2Shell continues!

  • What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained
  • The day after tomorrow: After PHP2Shell, it gets worse, then defenders win
  • PHP2Shell Is a Reminder: The Endpoint Only Tells Half the Story
  • Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
  • PHP2Shell: Critical PHP RCEs and How to Respond
  • PHP2Shell: 168 URL inizialmente segnalate dichiarano ora una versione aggiornata
  • PHP2Shell: diminuiscono le URL potenzialmente vulnerabili. Disponibili gli strumenti AgID
  • CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure
  • Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers
  • PHP2Shell Critical RCE Vulnerabilities: Threat Analysis & Remediation Guide
  • PHP2Shell One Week Later: Honeypot Shells on the Web, a Path to Root on Palo Alto Firewalls
  • PHP2Shell Is Already Here: How the Infoblox Platform Helps Uncover and Mitigate the Risk
  • Testing a PHP2Shell exploit in the era of AI-hallucinated PoCs
  • PHP2Shell Is Hitting Windows Servers in the Wild. We Stopped It.
  • php2shell: how we protected more than 6 million websites
  • PHP2Shell, Day 5: The Panic Hasn’t Turned Into Patching
  • php2shell in Practice: Exploitable, Conditional, and Hard to Mass-Exploit
  • PHP2Shell Was Exploited Before the Patch
  • PHP2Shell Won’t Be the Last. Here’s Where the Next One Will Show Up First.
  • php2shell one week later: Why one exploit doesn’t work everywhere
  • Patched, Not Over: PHP2Shell Exploits Keep Spreading Underground
  • PHP2Shell: Exploitation Attempts and Remediation Trends
  • PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing Most
  • PHP2Shell and the Limits of Patching: A SecOps Playbook for Layered Response

• Ryan Devendorf and Callie Baron at Abnormal Security
  How Fake DOT Portals Turn Carrier Records into Fuel Card Fraud

• Any.Run
  SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises

• Apramey Shurpali
  Some help(er)!

• Arctic Wolf

  • Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access
  • 2026 Agentic Security Operations Report

• ASEC

  • RATatouille: Today’s Special: Impersonating Companies in Korea, Payments in Cryptocurrency
  • Node2Shell: Taking Over a Server with a Single Compressed Data File (CVE-2026-111497)
  • September 2026 Infostealer Trend Report
  • September 2026 Threat Trend Report on APT Attacks (South Korea)

Threat hunting/threat intelligence

• Siddhant Mishra at Bloo
  PackMyPayload: Containerized MOTW Bypass and How to Detect It

• CERT EU
  Beyond the model: backdoors in AI agent harnesses

• CERT-AGID

  • Phishing PagoPA: nuove campagne a tema multe diffuse tramite PEC compromesse
  • Sintesi riepilogativa delle campagne malevole nella settimana del 24 – 30 ottobre

• Chainalysis

  • Binance Exploit: Latest Findings and Response
  • Chainalysis Security Incident Information

• Check Point

  • 26th October – Threat Intelligence Report
  • Tricks from the Past deployed via signed ChatGPT and Claude binaries
  • Yoba Malware Abuses Signed ChatGPT and Claude Binaries to Target AI Users
  • HTTP2Shell: The Brotli Vulnerability That Extends Beyond Node.js
  • Backdoor or Confused Agent? What We Learned Replaying the Qwen Incident
  • Audio Prompt Injection: What Voice Agents Hear That Text Guardrails Miss
  • Cohere’s Qwen Story: Looks More Like Model Jaggedness

• Cisco’s Talos

  • Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
  • IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

• Cloudflare
  Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants

• CloudSEK

  • The Doorway Botnet: Inside a Large-Scale IoT and Network Device Compromise Campaign
  • Inside “MR ROBOT” – Anatomy of a Malware-as-a-Service Operation Targeting Indian Bank Customers
  • Fake “View & Sign” and Adobe Acrobat Lures Deliver Attacker-Configured ScreenConnect Clients

• Cofense

  • Locked and Loaded: Phishing through Fake Bids and Protected Documents
  • Would Your Employees Join a Fake Anthropic AI Preview?

• Kajetan Porwolik at CQURE Academy
  The Trojan Horse in Your Repo: Inside the GhostAction Supply Chain Heist

• CrowdStrike

  • CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies
  • VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign
  • New Prompt Injection Techniques Cover Agent-Planning Attacks

• Antonio González at Cybersecurity Under Pressure
  SiteGuard: preserve evidence before patching an exploited WAF flaw

• Cyble
  From Hijacked PBX to Stolen Trunk: INJ3CTOR3’s Campaign Evolves

• Cyfirma

  • Threat Horizon Series Q3 2026 CHECK-IN · THE ROAD TO DECEMBER
  • Adversary Unmasked: APT Profile – Star Blizzard
  • Weekly Intelligence Report – 30 Oct 2026

• Sebastian Obregoso at Datadog Security Labs
  Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder

• Rohitashokgowd at Detect FYI
  The Blind Spot You Created on Purpose. The Real Architecture of Microsoft Defender Exclusions

• Disconinja
  Weekly Threat Infrastructure Investigation(Week44)

• Doug Metz at Baker Street Forensics
  Unpacking ATT&CK With MalChela v4.4

• Pavel Yosifovich at Elastic Security Labs
  Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform

• Nadine Abdulkarim at Esentire
  How eSentire Responded to a Citrix NetScaler Zero-Day in One Day

• Christine Billie at Expel
  Fake Claude Code extensions in Cursor: Malicious activity after the exposure window

• Martin Warmer at Eye Research
  How attackers keep reading mail after M365 session revocation

• Adharv K T at FalconFeeds
  Scattered LAPSUS$ Hunters : Profiling the Evolving Cybercrime Ecosystem

Threat hunting/threat intelligence

Threat hunting/threat intelligence

• Beyond the Binance Attack: How Stealer Logs Can Link Corporate Sign-Ins to Developer and Monitoring Tools

• Flashpoint
  DefenderKiller: How Vulnerable Drivers Are Being Abused to Disable Endpoint Security

Threat hunting/threat intelligence

• Gaetan Ferry at GitGuardian
  GhostAction Crosses Paths With PolinRider: Inside the October Escalation

• Group-IB

  • False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps
  • MadApe: The Code That Opens the Door

• Halkyn Security

  • Incident Notification Deadlines: Who Needs Telling and When
  • Writing an Incident Response Report That Works
  • Covert Evidence Preservation in Insider Cases
  • Linux Namespaces: Where Evidence Hides
  • Business Email Compromise Investigation in Microsoft 365
  • Finding a Model in Memory and Nowhere Else

• Hudson Rock

  • FortiBleed 2.0: 975 New Domains & 40,573 Exposed Secrets – Claim Your Ethical Disclosure
  • Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party Script

• Hunt IO
  68 GB Stolen From a Philippine Government Agency’s Overseas-Employment Databases, Exposed by the Operator’s Own Open Directory

• Huntress

  • AI, Scripts, Operator: Inside the ConnectWise Attack
  • Camera Management Software Compromise Leads to Malware Deployment

• Infoblox
  Borrowed Reputation: Domain Shadowing and Gambling SEO

• Paul Asadoorian and Chase Snyder at InfraTrust Pulse
  Pulse October 2026

• Intel 471
  Planning for Russia’s escalating hybrid war

• Gilbert Kallenborn at Intrinsec
  Les infostealers prennent l’IA en ligne de mire

• Jamf
  Binance attack: how DPRK targets developer laptops

• Kevin Beaumont at DoublePulsar
  Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide

• Adam Goss at Kraven Security
  Detection Rule Documentation: The ADS Framework Guide

• LevelBlue SpiderLabs

  • LevelBlue TTP Briefing Q3 2026: Trusted Access Fuels Data Theft
  • BlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kits

• Michael Horka at Lumen
  Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access

Threat hunting/threat intelligence

• Microsoft Security

  • Tracking AI adoption in North Korean threat actor tradecraft
  • From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
  • Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

• Digit Oktavianto at MII Cyber Security
  Hunting on the Wire : A Practical Guide to Network Threat Hunting — Part 2

• Nebulock

  • How to Hunt Malicious IP-KVMs on Your Endpoints
  • Hunting the Trojanized Claude Code Extension

• Gianpietro Cutolo at Netskope Threat Labs
  Trojanized Claude Code Extension on the Cursor Marketplace

• Florian Roth at Nextron Systems
  Beyond Framework Signatures: Understanding AI-Driven Intrusions

• Felix Hartmond at NVISO Labs
  Detection Engineering: Implementing Detection-as-Code in an Existing Environment: Part 1 – Introduction and Concept

• Brett Winterford at Okta
  Multi-agent attack tools leave no stone unturned | Threat Intelligence

• Oleg Skulkin at ‘Know Your Adversary’
  420. This Ransomware Gang Abuse Litterbox to Store Malicious Files

• OpenSourceMalware

  • Trojanized Claude Code Extension Plants an SSH Backdoor
  • Earliest Known PolinRider Malware Found in 2025 npm Packages

• Nir Zadok at OX Security
  Malicious Claude Code Extension (2.1.313) in Cursor Marketplace Plants Attacker SSH Key and Persistence

• Matt Brady and Christa McHugh at Palo Alto Networks
  Unwrapping Retail Peak Season Cyber Threats

• Calum Hall at Phorion
  Official Claude Code Extension Compromise: Security Advisory

• Profero
  One Operator, Several AI Attack Agents: The Ultra Suite and ARTEX

• Daniel Card at PwnDefend
  PHP2SHELL:Vibe Ops

• Ellis Stannard, Jon DiMaggio, M. Smith, Manny W, Nick Smart, Nikolai Kichatov, Rakesh Krishnan, Tammy Harper, and Valéry Rieß-Marchive at Ransom-ISAC
  Silent Ransom Group – Leak Analysis

Threat hunting/threat intelligence

Threat hunting/threat intelligence

• Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)

• Daniel Wroblewski at ReliaQuest
  Residential Proxies Mask Social-Engineering Attacks

• Ridgeline Cyber
  The Remote Session Columns in Defender Don’t Describe PowerShell Remoting

• SANS Internet Storm Center

  • YARA-X 1.22.0 Release, (Sun, Oct 25th)
  • Looking for a Language [Guest Diary], (Wed, Oct 21st)
  • Apple Patches for October 2026, (Mon, Oct 26th)
  • Yet Another ClickFix Campaign, (Wed, Oct 28th)
  • Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)
  • Wireshark 5.0.0rc1 Release, (Sat, Oct 31st)
  • YARA-X 1.22.1 Release, (Sat, Oct 31st)
  • OneNote File Extraction, (Sun, Nov 1st)

• Sansec
  Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analytics

• Scott Helme at Report URI

  • DeadTag: How Forgotten Website Tags Became a Delivery Network for iPhone Spyware
  • Polymarket’s CSP Allowed Every Part of the $2.6 Million Crypto Theft

• Securelist

  • An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure
  • Millions of security cameras at risk: DoS vulnerability in Intelbras devices

Threat hunting/threat intelligence

• Filter generation in practice: from algorithms to LLMs

• Security Alliance
  SEAL weekly stats: 20-27 Oct, 2026

Threat hunting/threat intelligence

• Silent Push

  • Omegatech Is Disrupted, and the Pressure on Bulletproof Hosting Keeps Building
  • North Korea’s Crypto Heists Start on the Open Internet

• Simone Kraus
  The Attack Nobody Claimed – From U.S. Military Bases to France’s Supermarkets

• Socket
  Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace

• Colin Cowie at Sophos
  AI used in Aur0ra ransomware testing and execution

• Rohan Prabhu at Step Security
  Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines

• Sujay Adkesar

  • The Upgrade Ate My Timeline: Windows Feature Update Forensics
  • Did the Agent Do It? Incident Response for AI Coding Agents

• Symantec Enterprise
  Sandbox Flipped to ‘Danger-Full-Access’: Unauthorized AI Relays Create Risk for Organizations

• ThreatMon

  • From Webshell to Proxy Exit: Inside an Exposed AhsayCBS Operation
  • Vulntober 2026: PHP2Shell, GitLab, Cisco, PAN-OS & 15+ Critical Flaws to Patch
  • The Difference Between Watching and Running: The Hidden Risk of Free Software and Games in P2P Shares
  • C2 Environment and Targeted Data Extraction
  • Binance Lost $6.3 Billion Without Losing a Key

• Joseliyo Sánchez at VirusTotal
  Process trees in Livehunt: YARA rules that know who launched what

• WeLiveSecurity

  • Lessons from Cybersecurity Black Week
  • ESET APT Activity Report Q2 2026–Q3 2026
  • Amatera: How the prolific infostealer works and spreads

• Wiz

  • Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
  • Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles

• Jose Luis Sanchez Martinez at YARA-X
  Who launched that process?

• Kim Zetter at ZERO DAY
  Silent Train: Volt Typhoon’s Sophisticated Infection Chain into US Targets Exposed

Threat hunting/threat intelligence

Threat hunting/threat intelligence

Upcoming events/webinars

• Matt Danner at Monolith Forensics and Jessica Hyde at Hexordia
  Expanding Your Toolkit: Practical Workflows with Open Source and Freeware

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • What’s New in ADF Pro 6.4? Expanded Artifacts, PhotoDNA Enhancements & More
  • ADF Weekly Computer Training Sessions

• Quinn Dougherty at Apart Research and SL5
  Threat Intelligence & Threat Modelling Hackathon

• Cellebrite
  Poznaj Cellebrite Genesis: od cyfrowego przeciążenia do jasności w śledztwie

• Magnet Forensics

  • Cyber Unpacked S3:E2 // IR beyond malware: Investigating business email compromise and fraud
  • Get ahead of the deadline: Grant readiness for 2027

• MSAB
  Federal Education Day 2026

• Dave Shackleford at Spur Intelligence
  Behind the Proxy: Real Attacks, Hidden Adversaries

Presentations/podcasts

• Adversary Universe Podcast
  New CrowdStrike Report Spotlights Agentic AI Campaigns

• Ayush Anand
  Hunting ScreenConnect Abuse With Claude Code (KQL + ES|QL)

• Black Hills Information Security
  BHIS – Talkin’ Bout [infosec] News 2026-10-26

• Endace
  Secure Networks Ep 68 – The Packet Forensics Files – with Traci Byrne from Cogent Security

• InfoSec_Bret
  IR – SOC152 – Encrypted Files Detected (2026)

• Karsten Hahn at Malware Analysis For Hedgehogs
  Malware Analysis – Decompiling V8 JavaScript Galaxy Stealer

• Chris Vance at Magnet Forensics
  Mobile Unpacked S4:E2 // Harping on health data

• Microsoft Threat Intelligence Podcast
  The Quantum Countdown: Why Certificate Testing Starts Now

• Monolith Forensics

  • Evidence Files in Monolith
  • Adding Notes to a Case Report in Monolith

• MSAB
  #MSABMonday – Test Points

• MyDFIR
  How to Actually Get Better at SOC Investigations

• Off By One Security
  AI in Offensive Security: Discovery, Validation, and Autonomy

• Open Source Forensics Lab

  • Update, Install, and Open LEAPPS With uLEAPP 1| Windows
  • Update, Install, and Open LEAPPS With uLEAPP 2 | Linux

• OpenSourceMalware
  The OpenSourceMalware Show #27

• Parsing The Truth: One Byte at a Time Podcast
  S2 E16: TN vs Ahmad Gatlin: Part 6

• Proofpoint
  Agent Dozier Would Like a Word (Word)

• Sandfly Security
  Sandfly YouTube Live: Is that Linux alert real?

• SentinelOne
  LABScon26 Replay | Keynote: A Sober Analysis of AI Impact

• The Defender’s Advantage Podcast
  From Prompting to Autonomy: The Evolution of Adversarial AI

• Three Buddy Problem

  • Lumen’s Michael Horka on China’s ‘Silent Train’ Router Hacking
  • The Great Binance $6.34 Billion Crypto Heist

Malware analysis

• Darrel Virtusio and Eliad Kimhy at Acronis
  Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion

• Adithya V at Secjuice
  My First Real Malware Sample Turned Out To Be LokiBot

• Shubho57
  Analysis of BAT file leads to a Trojan Dropper mostly attributed to RareWolf

Malware analysis

• ThreatMon
  • KillerStrike: Inside an Open-Source Windows RAT
  • CCDS C2: Infrastructure and Payload Analysis
  • LiteLLM 1.107.0: From Startup Hooks to Credential Theft

Malware analysis

• Zhassulan Zhussupov

  • Linux hacking part 12: LD_PRELOAD function interposition. Simple C examples
  • Malware and cryptography 46 – a tiny neural distinguisher for Speck. C and PyTorch examples.

• Santiago Rodriguez at Zimperium
  Inside Coruna and DarkSword Chains: From Web Lures to iOS Exploitation

Miscellaneous

Miscellaneous

Miscellaneous

• Brett Shavers
  I Applied a DFIR Investigative Mindset to a Police Chief’s Retirement. Here’s What the Records Show.

• Fabian Mendoza at DFIR Dominican
  DFIR Jobs Update – 10/26/26

• Forensic Focus

  • Genesis Momentum Powers Cellebrite’s Autumn Release: More Evidence, Deeper Insight, Broader Access For Investigations 
  • Magnet Forensics Launches Magnet AI Research Lab To Provide Peer-Backed Evidence To The Community
  • Agentic AI For Digital Investigations: Matt Goeckel Introduces Cellebrite Genesis
  • End-To-End Digital Investigations: From First Access To Final Verdict
  • Preparing Digital Multimedia Evidence For Court: What To Consider Before Presentation
  • Explore Cellebrite’s Autumn 2026 Release: Discover What’s New
  • Forensic Focus Digest, 30 Oct 2026
  • How A MacBook With A Broken Screen Helped Convict A UK Property Fraudster: Belkasoft X Case Study

• Jeffrey Appel
  Microsoft Defender for Endpoint: Beyond default telemetry with Custom Data Collection Rules

• Kevin Pagano at Stark 4N6
  SANS DFIR Summit 2026 Recap

• Magnet Forensics

Miscellaneous

Miscellaneous

• Walk before you run: The digital forensics fundamentals we’re still skipping

Miscellaneous

• Matthew Plascencia
  Keep Those LEAPPs Fresh with uLEAPP

Software releases/updates

• Apache
  Release 4.2.0 – 10/25/2026

• AtlasFO
  Atlas 1.0.3

• Berla
  iVe 5.1: Expanding Acquisition Support

• Cyber Triage

  • Cyber Triage 4.0: New UI, Embedded AI, SentinelOne Import
  • New Cyber Triage 4.0 UI: What Features Moved

• Dielle De Noon
  Corrobora v0.2.0

• Digital Sleuth
  winfor-salt v2026.14.1

• Doug Burks
  so-crates v5.1.0

• Marco Neumann
  crush-forensics v0.24.0

• MISP
  MISP Modules v3.1.1: 33 New Expansion Modules and More Ways to Turn Threat Intelligence into Action

• Nextron Systems

  • Management Center 4.3: A New Interface and Smarter THOR Exclusions
  • Analysis Cockpit 4.5: More Efficient Case Management and Improved Operations
  • Security Center 3.0: Multi-Tenancy, Advanced Access Control and User API

• Open Source DFIR
  Plaso 20261027 released

• OpenCTI
  7.261030.1

• Phil Harvey
  ExifTool 13.60

• Rory Wagner
  Hayabusa-Bulk-Runner v0.11.0

• Ryan Benson
  unfurl v2026.11

• SweetScape Software
  Announcing 010 Editor – Version 17.0

• Toño Diaz
  masstin v1.3.4

• VirusTotal
  YARA v4.6.0

• Yamato Security

  • Hayabusa v4.3.1 – Vulnpocalypse Release
  • suzaku v3.0.0 – Vulnpocalypse Release