Topic
Building alerts from host telemetry such as boot-mode event IDs, service stoppages, and registry persistence artefacts.
CVE-2026-64849 lets anyone who can reach an MLflow tracking server make it fetch EC2 instance metadata and hand back the response. The fix is 3.15.0; the exposure is a default.
Reality
CERT Polska says CVE-2026-73570 is already being exploited. Two of the three preconditions are configuration, not code, which makes reachability the control you can change now.
Reality
CVE-2026-15748 lets an unauthenticated attacker hide upload settings inside a Select field, so any site below 1.56.1 with a Select and a File Upload field is one request from a PHP file.
Reality
ReliaQuest says a custom JSP web shell decrypts LDAP admin secrets with Windchill's own API and indexes the design vault over existing database connections. Network telemetry sees very little.
Reality
CVE-2026-19478 needs no login and no click. CVE-2026-19650 needs a user to open a link. Self-managed operators on 18.11, 19.0, 19.1 and 19.2 have to patch anyway.
Reality
Two years of SIEM ingestion cuts left the data layer that agentic detection will run on, and 24% of security leaders now rank visibility above staffing as their top barrier.
Reality
Wiz says rogue device registrations are drifting toward benign names, while nearly one in seven Entra tenants saw such an attack in 90 days. Naming strings were never the signal.
Reality
Zscaler says a Rust backdoor tied to ransomware activity moved its command channel onto GitHub. The first version beaconed once a second to a bare HTTP endpoint. The second one does not need a domain at all.
Reality
A Defender research write-up turns MITRE ATT&CK procedures into synthetic process logs so rules can be exercised without range time. It also says synthetic logs are not attack reproduction.
Reality
CVE-2026-69414 is an unpatched local escalation in the Malware Protection Engine, and it exists because the fix for CVE-2026-50656 was incomplete. Applying that earlier update bought nothing.
Reality