Eighteen Active Directory compromise techniques, their Windows event identifiers, and the logging plan that has to come first.
Tag: CSIRT
Compliance & Standards, Projects & Governance
RFC 2350: describing your CSIRT in seven parts
by •
Published in 1998 and never replaced, RFC 2350 describes an incident response team in seven parts. What it demands, what has aged, how to write one.
Compliance & Standards, Projects & Governance
SIM3 v2 interim: 45 parameters to raise your maturity
by •
SIM3 v2 interim measures a team over 45 parameters and 5 levels. Free for internal use, tooled online, and soon extended to SOCs and PSIRTs
Vulnerabilities & Alerts
SQL injection exploited in Cisco Secure Email Gateway
by •
Cisco has published an unauthenticated SQL injection in Secure Email Gateway, already exploited. No workaround, and a second critical advisory the same day.
Vulnerabilities & Alerts
Six permission bypasses in Mistral Vibe
by •
HiddenLayer published six critical CVEs in Mistral’s coding agent. All target the same authorisation layer, and no fix has shipped.
CTI & OSINT
GreatXML: Technical and Defensive Analysis of a BitLocker Bypass via WinRE
by •
1. Executive summary GreatXML is a public proof-of-concept, released on 10 June 2026 by the researcher Nightmare Eclipse / Chaotic Eclipse / MSNightmare, claiming a BitLocker bypass. The technique abuses the Windows Recovery Environment (WinRE), the state left behind by Microsoft Defender’s Offline Scan feature, and the legitimate processing of unattended setup answer files (unattend.xml).…
CTI & OSINT, Vulnerabilities & Alerts
RoguePlanet: a new Microsoft Defender zero-day disclosed in the wake of Patch Tuesday
by •
RoguePlanet: a new Microsoft Defender zero-day disclosed in the wake of Patch Tuesday Threat Intelligence · Vulnerability June 10, 2026 · Marc-Frédéric Gomez · 6 min read Just hours after the June 2026 fixes shipped, the researcher Nightmare Eclipse published a new exploit targeting Microsoft Defender. It works against Windows systems that are already up…
Vulnerabilities & Alerts
Project Glasswing
by •
Artificial Intelligence — vulnerabilities-anthropic What the First Public Update on Claude Mythos Reveals Anthropic published on May 22, 2026 the results of the first month of its defensive initiative. More than 10,000 vulnerabilities of high or critical severity identified, a bottleneck that has shifted from detection to remediation, and an access strategy that draws a…
Open Source & Tools
Microsoft Patch Tuesday May 2026
by •
Patch Tuesday Analysis · May 2026 May 2026 Patch Tuesday: No Zero-Days for the First Time in 23 Months, but Three Unauthenticated 9.8 RCEs in the Queue Microsoft fixes 118 to 138 CVEs depending on methodology, including 16 critical, with no actively exploited or publicly disclosed vulnerability. First Patch Tuesday without a zero-day since June…
CTI & OSINT
MiniPlasma: Chaotic Eclipse Reopens cldflt.sys
by •
CTI Analysis · Unpatched Windows Vulnerability MiniPlasma: Chaotic Eclipse Reopens cldflt.sys and Revives the Question of Microsoft Patch Durability A fifth uncoordinated public disclosure in six weeks, a PoC targeting the Windows Cloud Files Mini Filter Driver, and an extraordinary claim: the CVE-2020-17103 patch would not be present on fully patched Windows 11 and Windows…
