
Sophos Counter Threat Unit Research Team
Sophos Counter Threat Unit™ (CTU) researchers are recognized authorities in the cybersecurity field, regularly contributing expert analysis to global media, publishing technical analyses for the security community, and presenting about emerging threats at leading security conferences. Backed by Sophos’ advanced security technologies and a broad network of intelligence contacts and partners, the CTU™ plays a critical role in identifying and tracking threat actors and analyzing anomalous activity, uncovering new attack techniques, threats, and major shifts in the threat landscape.
Content by Sophos Counter Threat Unit Research Team

Threat Research
advisory
vulnerability
Node2Shell
Brotli
‘Node2Shell’ vulnerability (CVE-2026-111497) in active exploitation
October 28, 2026

Threat Research
advisory
vulnerability
php
Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)
October 21, 2026

Threat Research
BRONZE SANDCASTLE
Meterpreter
Sandboxie
BRONZE SANDCASTLE deploys modified Meterpreter shells
October 20, 2026

Threat Research
advisory
vulnerability
Citrix
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation
October 5, 2026

Threat Research
advisory
vulnerability
Citrix
Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation
September 28, 2026

Threat Research
advisory
Kiteworks
Kiteworks recommends server shutdown pending possible attack
September 25, 2026

Threat Research
advisory
vulnerability
Cisco
Cisco Secure Email Gateway vulnerability (CVE-2026-76461) in active exploitation
September 15, 2026

Threat Research
AI
Luciferus
underground
Devil’s advocate? Uncensored Luciferus AI service advertised underground
September 14, 2026

Threat Research
Cyclops Blink
Cisco
Linux
“Eye” spy: Cyclops Blink returns with extended capabilities
September 11, 2026