Focus Scroll Background

Sophos Blog

RSS

PHP advisory October 2026 feature image

Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

BRONZE SANDCASTLE deploys modified Meterpreter shells

The China-based threat group uses DLL sideloading in these attacks

Gabor Szappanos

ConnectWise Cloud Backup application abused in cross-tenant token sweep

Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants

Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion

No novelty required to be effective

siem less architecture.png

October 23, 2026

Is “SIEM-less” really what it sounds like?

Products & Services

October 21, 2026

Web App Owners – You’re on Notice. Your Low-Hanging Fruit Just Got Lower

The Frontlines

PHP advisory October 2026 feature image

October 21, 2026

Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Threat Research

BRONZE SANDCASTLE Meterpreter blog feature image

October 20, 2026

BRONZE SANDCASTLE deploys modified Meterpreter shells

Threat Research

October 20, 2026

Why Incident Response Demand Will Grow Faster than Expected

The Frontlines

October 19, 2026

Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion

Threat Research

ConnectWise Cloud Backup feature image

October 19, 2026

ConnectWise Cloud Backup application abused in cross-tenant token sweep

Threat Research

October 15, 2026

Sophos ITDR expands identity protection for the AI era

Products & Services

October 14, 2026

Show, don’t tell: Sophos AI at CAMLIS

AI Research