What’s New in Rapid7 Products and Services: Q2 2026 in Review
If Q1 set the pace for Rapid7's tools, Q2 accelerated it. This quarter brought a steady stream of product enhancements, platform investments, and customer-dr...
vendor
20 articles
Inside a TrickBot Variant Using DNS Tunneling for C2
FortiGuard Labs analyzes a TrickBot variant that uses DNS tunneling for C2 communication, modular execution, and employs persistence and obfuscation techniques
Proofpoint Research Finds 65% of Organizations Affected by Ransomware Say AI Made Attacks More Effective
CrowdStrike Falcon Platform Helps Meet U.S. Government Mandates for CISA BOD-26-04
CrowdStrike Falcon Platform Helps Meet U.S. Government Mandates for CISA BOD-26-04
Oracle July 2026 Critical Patch Update Addresses 1235 CVEs
Oracle addresses 1235 CVEs in its third quarterly update of 2026 with 1449 patches, including 261 critical updates. Key Takeaways The third Critical Patch Up...
Do more with AWS WAF labels using dynamic label interpolation
AWS WAF classifies web traffic by attaching metadata to each request it evaluates. Managed rule groups such as AWS WAF Bot Control and AWS WAF Fraud Control ...
Manual Patching Can’t Outrun AI. Automated Remediation Can.
Executive Summary AI is rapidly transforming vulnerability discovery, outpacing many security teams’ ability to adapt. Microsoft’s July 2026 Patch Tuesday ad...
CVE-2026-8933: Local Privilege Escalation in Set-Capabilities snap-confine
The Qualys Threat Research Unit (TRU) has identified a Local Privilege Escalation (LPE) vulnerability in snap-confine (CVE-2026-8933). This flaw allows an un...
Your AI agent’s config is now the payload: How attackers are targeting the developer agent harness
Attackers have shifted from hiding from AI tools to running inside them. By poisoning the config files that govern AI coding assistants, a new worm class ach...
How the 2026 World Cup affected Internet traffic
We analyzed global HTTP traffic to explore how kickoff times, streaming habits, and hydration breaks reshaped online activity worldwide. From late-night traf...
Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain Attacks
Introducing the Amazon GuardDuty investigation agent: on-demand AI-powered threat assessment
The new Amazon GuardDuty investigation agent (now in public preview) investigates security findings across your Amazon Web Services (AWS) environment, reduci...
wp2shell Aftermath: The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade
wp2shell is a critical unauthenticated RCE chain in WordPress Core, patched July 17, 2026. See who's affected, the exploitation timeline, and what to do now.
Cloudflare Internal DNS is now generally available
Cloudflare Internal DNS brings authoritative and recursive DNS for private networks to the same global network and control plane that runs Cloudflare's Zero ...
Is Your Security Program Ready for AI-Speed Application Exploitation?
Why public-facing applications are now the top breach path, and why traditional vulnerability management was not built for it. Key Takeaways Shift to Primary...
2026 ISO and CSA STAR certificates are now available with two additional services
Amazon Web Services (AWS) successfully completed an onboarding audit with no findings for ISO 9001:2015, 27001:2022, 27017:2015, 27018:2019, 27701:2019, 2000...
Top Five Compliance Audit Software and Tools: Mastering Modern Regulatory Risk
Executive Summary Manual audit preparation no longer scales across hybrid, cloud, endpoint, and application environments. Compliance monitoring software must...
wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Core
An unauthenticated attacker can chain two WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, to achieve remote code execution against affecte...
The Agentic SOC: Transforming Data into Defensive Velocity
Transform SOC data chaos into autonomous intelligence with modern AI pipelines and agentic AI to empower human analysts.