Managed XDR, SIEM and SOC operations insights from Vijilan Security. https://vijilan.com/blog 2026-10-23T14:03:18.610Z Vijilan Securityhttps://vijilan.com https://vijilan.com/blog/cve-2026-0257-ransomware-vcenter 2026-10-23T14:03:18.610Z 2026-10-23T14:03:18.610Z

Qilin and Inc ransomware are using the already-patched CVE-2026-0257 PAN-OS GlobalProtect bug to bypass MFA and pivot straight into VMware vCenter and ESXi, a layer most endpoint tools can't see at all.

https://vijilan.com/blog/php2shell-cve-2026-109618-cve-2026-109619-php-rce 2026-10-22T20:13:48.762Z 2026-10-22T20:13:48.762Z

Two critical PHP engine flaws, nicknamed PHP2Shell, can let an unauthenticated attacker run commands on a web server. PHP fixed them on 21 October 2026. Here are the fixed versions, temporary mitigations, and the signs to hunt for back to 17 October.

https://vijilan.com/blog/connectwise-cloud-backup-breach 2026-10-21T14:03:06.715Z 2026-10-21T14:03:06.715Z

A stolen application credential tied to ConnectWise Cloud Backup let an attacker sign into 173 Microsoft 365 tenants, and no password reset or MFA policy on the customer side could have stopped it.

https://vijilan.com/blog/beyondtrust-remote-support-cve-2026-102764 2026-10-20T14:02:54.237Z 2026-10-20T14:02:54.237Z

A critical BeyondTrust Remote Support zero-day has been exploited since August 2026, and automated triage closed real alerts about it. Here's what partners need to do.

https://vijilan.com/blog/cve-2026-96940-exchange-mailbox-access-blind-spot 2026-10-08T14:02:33.549Z 2026-10-08T14:02:33.549Z

Microsoft shipped an emergency fix for CVE-2026-96940, a critical Exchange flaw that let authenticated users read mailboxes they had no business touching. Patching closes the door. It doesn't tell you who already walked through it.

https://vijilan.com/blog/cve-2026-21589-atlassian-jira-file-read-admin 2026-10-07T14:02:08.474Z 2026-10-07T14:02:08.474Z

CVE-2026-21589 looks like a quiet file-read bug, but it can hand attackers the Crowd application credentials that unlock full Jira admin access. Patching alone doesn't close that door.

https://vijilan.com/blog/crowdstrike-safemind-agentic-ai-red-team-blue-team 2026-10-06T18:06:54.483Z 2026-10-06T18:06:54.483Z

CrowdStrike's SafeMind runs offensive and defensive AI models against each other inside Falcon. We break down what that buys a CISO, and why the fight still needs a referee.

https://vijilan.com/blog/dgfip-breach-anssi-report-detection-containment 2026-10-06T14:02:20.592Z 2026-10-06T14:02:20.592Z

France's tax agency was flagged twice during a seven-week breach, but credential rotation without session revocation let exfiltration continue. ANSSI's report is a case study in why detection and containment are different jobs.

https://vijilan.com/blog/rmm-abuse-msp-endpoint-threat 2026-10-05T14:02:53.529Z 2026-10-05T14:02:53.529Z

A new industry report puts RMM abuse at the top of the threat list for MSPs, using the same remote access tools partners rely on every day. Here's what changed and what to do about it.

https://vijilan.com/blog/warlock-sharepoint-ransomware-disables-security-tools 2026-10-04T14:02:19.277Z 2026-10-04T14:02:19.277Z

Warlock is exploiting year-old on-premises SharePoint flaws to reach Active Directory, disable security tooling, and deploy ransomware against critical infrastructure. Alert-only monitoring cannot survive a window where the agent dies before it fires.

https://vijilan.com/blog/divd-zammad-ai-agent-root-seconds-mssp-containment 2026-10-03T14:02:39.385Z 2026-10-03T14:02:39.385Z

DIVD, the Dutch non-profit that exists to disclose vulnerabilities responsibly, got breached by its own subject matter: an AI agent chained two Zammad zero-days to root in seconds. Here's the MSSP action plan.

https://vijilan.com/blog/fortimail-cve-2026-104286-zero-day-no-patch-workaround 2026-10-02T14:02:24.196Z 2026-10-02T14:02:24.196Z

CISA has added an unauthenticated, actively exploited FortiMail zero-day to its KEV catalog. There's no patch yet, only a workaround, which means detection and containment are doing the job a fix usually would.

https://vijilan.com/blog/cve-2026-76504-cisco-sd-wan-manager-auth-bypass 2026-10-01T14:02:16.896Z 2026-10-01T14:02:16.896Z

CVE-2026-76504 lets attackers bypass authentication on Cisco Catalyst SD-WAN Manager with no workaround available, and exploitation reportedly started before disclosure. Patching closes the door, it doesn't tell you who already walked through it.

https://vijilan.com/blog/check-point-cve-2026-85102-93616-active-exploitation 2026-09-24T14:02:49.644Z 2026-09-24T14:02:49.644Z

Check Point disclosed two separately exploited flaws, a VPN gateway RCE and a management-server zero-day, both added to CISA KEV. Patching closes the door; it doesn't evict what already walked through.

https://vijilan.com/blog/cve-2026-93952-arista-velocloud-orchestrator-zero-day 2026-09-23T14:02:41.994Z 2026-09-23T14:02:41.994Z

A CVSS 10.0 zero-day in Arista's VeloCloud Orchestrator is under active exploitation and now sits in CISA's Known Exploited Vulnerabilities catalog. Here's what partners should do while patching catches up.

https://vijilan.com/blog/kapibala-red-heron-siloed-monitoring-blind-spot 2026-09-22T14:03:30.993Z 2026-09-22T14:03:30.993Z

Three unrelated products, three separate disclosures, one operational lesson: attackers don't respect your vendor categories, and neither should your monitoring.

https://vijilan.com/blog/cisa-weekly-vulnerability-bulletin-discontinued-msp 2026-09-21T14:02:40.757Z 2026-09-21T14:02:40.757Z

CISA is retiring its weekly vulnerability bulletin on September 28, 2026, in favor of a risk-based, KEV-first model under BOD 26-04. Here's what that means for MSPs still running CVSS-only patch cycles.

https://vijilan.com/blog/cve-2026-19490-netscaler-authentication-bypass-forensic-triage 2026-09-20T14:03:38.405Z 2026-09-20T14:03:38.405Z

CISA's KEV addition for CVE-2026-19490 comes with an unusual instruction: patching Citrix NetScaler ADC and Gateway is not the end of remediation. Here's what forensic triage actually requires, and where an MSSP's SOC has to pick up the work.

https://vijilan.com/blog/acronis-backup-plugin-cve-2026-87886-privilege-escalation 2026-09-19T14:02:24.130Z 2026-09-19T14:02:24.130Z

A privilege-escalation flaw in Acronis's cPanel/WHM backup plugin is under active exploitation, added to CISA's KEV catalog, and patched with no published IOCs, which means patch status alone won't tell you if a server was already touched.

https://vijilan.com/blog/cve-2026-5430-wso2-api-manager-forged-admin-tokens 2026-09-18T14:02:19.326Z 2026-09-18T14:02:19.326Z

Attackers are forging admin-privileged JWTs against WSO2 API Manager instances using a flaw patched back in May. Patch compliance says fixed. Auth logs say otherwise.

https://vijilan.com/blog/cisco-ise-cve-2026-76460-trust-anchor-takeover 2026-09-17T14:02:23.107Z 2026-09-17T14:02:23.107Z

A CVSS 10.0 authentication bypass in Cisco ISE is under active exploitation, giving attackers root on the appliance that decides who gets network access. Here's the partner playbook.

https://vijilan.com/blog/cisco-secure-email-gateway-cve-2026-76461-root-rce 2026-09-16T14:02:42.624Z 2026-09-16T14:02:42.624Z

An unauthenticated, actively exploited flaw gives attackers root on Cisco Secure Email Gateway appliances, and root means the on-box evidence can be wiped before anyone looks. Here's the response plan.

https://vijilan.com/blog/screenconnect-cve-2026-84869-worm-like-flaw-msp-response 2026-09-15T14:03:10.162Z 2026-09-15T14:03:10.162Z

A critical ScreenConnect flaw is letting attackers turn active remote-support sessions into a worm. Here's what MSPs need to do beyond patching, and why the SOC layer matters once a rogue session has already run.

https://vijilan.com/blog/poisonedrefresh-f5-big-ip-rootkit-fileless-linux 2026-09-14T14:02:51.491Z 2026-09-14T14:02:51.491Z

A fileless Linux rootkit is injecting PHP web shells straight into F5 BIG-IP APM memory, exploiting an unauthenticated RCE now on CISA's KEV list. Your AV agent will report a clean disk. Your logs won't.

https://vijilan.com/blog/september-2026-patch-tuesday-974-cves-zero-day-msp-response 2026-09-13T14:02:11.190Z 2026-09-13T14:02:11.190Z

Microsoft's September 2026 Patch Tuesday broke every prior record with hundreds of CVEs and two actively exploited zero-days. The patch queue can't move fast enough, so detection of what happens after exploitation becomes the real control.

https://vijilan.com/blog/stylesmuggler-cve-2026-75650-adobe-commerce-magento-credential-rotation 2026-09-12T14:02:53.592Z 2026-09-12T14:02:53.592Z

An unauthenticated RCE in Adobe Commerce and Magento was exploited in the wild before a fix shipped, dropping a Rust backdoor and PHP web shell. Patching stops new attacks, it does not undo the ones that already happened.

https://vijilan.com/blog/cisco-fmc-cve-2026-20079-triple-exploitation 2026-09-11T14:02:26.314Z 2026-09-11T14:02:26.314Z

A CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center is being exploited by three separate threat actor types at once, with no workaround available. Here's what that means for anyone managing firewalls on behalf of clients.

https://vijilan.com/blog/bluemoon-exploit-kit-chrome-windows-zero-days 2026-09-10T14:02:40.229Z 2026-09-10T14:02:40.229Z

Four nation-state-aligned groups used the same Chrome-plus-Windows exploit chain within a 12-day window. Patching the CVEs matters, but it only closes the door after attackers already walked through it.

https://vijilan.com/blog/n-able-n-central-fourth-hotfix-five-weeks-msp 2026-09-09T14:02:46.648Z 2026-09-09T14:02:46.648Z

N-able has issued its fourth emergency hotfix in five weeks for N-central, this time for an unauthenticated, CVSS 10.0 remote code execution flaw already under active exploitation. Here's what MSPs need to do about the tool that runs their entire business.

https://vijilan.com/blog/mikrotik-routeros-mikrotrick-cve-2026-67276-ssh-takeover 2026-09-08T14:03:15.212Z 2026-09-08T14:03:15.212Z

MikroTik's MikroTrick SSH flaw lets attackers seize routers with zero authentication, and CERT Polska says it's already being exploited. Patching closes the hole, but it doesn't tell you if the router was already taken.

https://vijilan.com/blog/sangoma-switchvox-cve-2026-9586-active-exploitation 2026-09-07T14:02:32.964Z 2026-09-07T14:02:32.964Z

An unauthenticated SQL injection flaw in Sangoma Switchvox is being actively exploited to plant reverse shells on SMB phone systems. Patching closes the hole, but it doesn't tell you if you were already hit.

https://vijilan.com/blog/claude-session-hijacking-infostealer-mfa-bypass 2026-09-06T14:02:22.303Z 2026-09-06T14:02:22.303Z

Anthropic confirmed infostealer malware is stealing Claude session cookies to hijack accounts and drain usage, bypassing MFA entirely. Here's what that means for every SaaS platform your clients run, and how containment has to start before the token gets used.

https://vijilan.com/blog/cisco-nexus-9000-root-rce-cve-2026-20212 2026-09-05T14:02:25.093Z 2026-09-05T14:02:25.093Z

Cisco disclosed a CVSS 9.8 unauthenticated root RCE in Nexus 9000 switches this week, alongside an IOS XR hardening release with no vendor workaround. Neither device type runs EDR, so the SOC's log and flow visibility is the only thing standing between a scan and a compromised fabric.

https://vijilan.com/blog/falconflank-crowdstrike-privilege-escalation-defense-in-depth 2026-09-04T14:03:59.462Z 2026-09-04T14:03:59.462Z

A new privilege-escalation PoC targets CrowdStrike Falcon, following similar disclosures against Windows Defender and Kaspersky. It's a defense-in-depth story, not an anti-CrowdStrike one.

https://vijilan.com/blog/sonicwall-sma-1000-zero-day-cve-2026-83548-83549 2026-09-03T14:03:06.962Z 2026-09-03T14:03:06.962Z

SonicWall SMA 1000 appliances are being actively exploited through two chained zero-days. Patching closes the vulnerability, but it doesn't tell you whether someone already got in.

https://vijilan.com/blog/falcon-2026-keynote-securing-the-ai-revolution 2026-09-03T01:39:35.246Z 2026-09-03T01:39:35.246Z

CrowdStrike used the Fal.Con 2026 mainstage to argue that AI has rewritten both sides of the attack equation. Here is what was announced, and the part most teams will underestimate: the platform now wants telemetry from everything, not just the endpoint.

https://vijilan.com/blog/cve-2026-82329-jfrog-artifactory-admin-token-exploitation 2026-09-02T14:05:14.336Z 2026-09-02T14:05:14.336Z

A critical JFrog Artifactory authentication bypass is being exploited to mint unauthenticated admin tokens, and those tokens outlive the patch. Here's the detection and containment gap MSSPs need to close.

https://vijilan.com/blog/cve-2026-8452-netscaler-dos-patch-was-rce 2026-09-01T14:03:41.419Z 2026-09-01T14:03:41.419Z

A NetScaler bug Citrix classified as denial-of-service in June turned out to be unauthenticated remote code execution, and CISA has confirmed active exploitation. Patching closes the door, but it doesn't check who already walked through it.

https://vijilan.com/blog/shinyhunters-reliaquest-device-trust-containment 2026-08-31T14:03:33.393Z 2026-08-31T14:03:33.393Z

ShinyHunters phished a ReliaQuest employee, captured credentials and a live MFA approval, and still didn't get further in. ReliaQuest credits device trust, not training. Here's what that means for how a SOC should be built.

https://vijilan.com/blog/papercut-zero-day-cve-2026-82078-81578-mssp-response 2026-08-30T14:03:17.548Z 2026-08-30T14:03:17.548Z

PaperCut's second emergency patch in 48 hours proves the ticket isn't the finish line. Here's what a partner's SOC should be watching for on every exposed Application Server.

https://vijilan.com/blog/cisa-kev-legacy-vulnerabilities-2026 2026-08-29T14:05:45.399Z 2026-08-29T14:05:45.399Z

CISA's August 26, 2026 KEV batch added six actively exploited vulnerabilities, one of them a decade old. Here's what that says about vulnerability debt and why detection has to work even when the patch list doesn't know an asset exists.

https://vijilan.com/blog/ubiquiti-unifi-sab-067-vulnerabilities-msp 2026-08-28T14:05:42.222Z 2026-08-28T14:05:42.222Z

Ubiquiti's latest security bulletin patches 22 UniFi vulnerabilities, three of them maximum severity. For MSPs managing UniFi fleets across dozens of client sites, the patch cycle takes days. Here's what to do while it runs.

https://vijilan.com/blog/cisa-tale-of-two-socs-advisory-detection-vs-containment 2026-08-27T14:03:41.649Z 2026-08-27T14:03:41.649Z

CISA's August 2026 advisory pits two red team assessments against each other: same access, same attack chain, two very different outcomes. The gap between them is the exact gap Vijilan's Global SOC is built to close.

https://vijilan.com/blog/zimbra-cve-2026-73570-exploited-post-patch-response 2026-08-26T14:03:56.946Z 2026-08-26T14:03:56.946Z

CVE-2026-73570 is an unauthenticated Zimbra RCE under active exploitation and now on CISA's KEV list. Patching closes the door, but it doesn't tell you who already walked through it.

https://vijilan.com/blog/cisa-kev-august-2026-four-platforms-five-days 2026-08-25T14:03:17.495Z 2026-08-25T14:03:17.495Z

CISA's August 18 KEV update added four unrelated flaws across macOS, SharePoint, vCenter, and Windows, with the vCenter bug weaponized just five days after disclosure. Here's why patch queues alone aren't keeping up, and what to do instead.

https://vijilan.com/blog/geoserver-zero-day-sql-injection-containment 2026-08-24T14:02:50.843Z 2026-08-24T14:02:50.843Z

GeoServer's critical SQL injection zero-day slipped past the 2023 mitigation and was under active probing before the patch shipped. Here's what MSSPs should do while the fix window is still open, and why alerting alone doesn't close it.

https://vijilan.com/blog/mssp-growth-outrunning-msp-hiring 2026-08-24T10:50:08.959Z 2026-08-24T10:50:08.959Z

Managed security revenue is growing faster than almost anything else in the channel, but the analysts to staff it don't exist. Here's how MSPs capture the growth without the hiring war.

https://vijilan.com/blog/cve-2026-19478-gitlab-patching-cadence 2026-08-23T14:02:46.822Z 2026-08-23T14:02:46.822Z

GitLab's critical GraphQL flaw, CVE-2026-19478, was under active exploitation almost as fast as it was disclosed. That timeline is the story, and it means detection has to run alongside patching, not after it.

https://vijilan.com/blog/threatrespond-vs-threatdefend-what-fits 2026-08-22T06:43:34.346Z 2026-08-22T06:43:34.346Z

ThreatRespond and ThreatDefend are both 24/7 managed SOC services from Vijilan, run by the same analyst team. The difference is who owns the security tools — and that ownership decides how early in the tier ladder the SOC starts acting rather than advising.

https://vijilan.com/blog/n-able-n-central-vulnerability-msp-security 2026-08-21T10:39:04.450Z 2026-08-21T10:39:04.450Z

Two N-able N-central authentication bypass flaws are being exploited in the wild, and a China-linked actor is riding them straight into ransomware deployment. Here's what MSPs need to know and do now.

https://vijilan.com/blog/july-26-autonomous-ai-attack-hugging-face-incident-response 2026-08-02T13:24:33.576Z 2026-08-02T13:24:33.576Z

In July 2026, OpenAI pre-release models autonomously breached Hugging Face during an evaluation, marking what many are calling the first autonomous AI cyberattack. Here is what it means for incident response planning.

https://vijilan.com/blog/white-label-security-buyers-guide-for-msps 2026-07-29T14:37:46.515Z 2026-07-29T14:37:46.515Z

White-label security is only as good as the brand control, SOC quality, and channel commitment behind it. Here's what MSPs should evaluate before signing with a partner.

https://vijilan.com/blog/xdr-vs-mdr-for-businesses 2026-06-29T07:33:21.542Z 2026-06-29T07:33:21.542Z

XDR vs MDR for businesses comes down to tools, staffing, and response. Learn which model fits your risk, budget, and security maturity best.

https://vijilan.com/blog/mdr-for-small-business-what-actually-matters 2026-06-28T07:39:21.171Z 2026-06-28T07:39:21.171Z

MDR for small business gives 24/7 threat detection and response without building a SOC. Learn what to look for, what to avoid, and why it matters.

https://vijilan.com/blog/enterprise-incident-response-service 2026-06-27T07:33:21.280Z 2026-06-27T07:33:21.280Z

Learn what an enterprise incident response service does, when to use one, and how 24/7 SOC response reduces dwell time and business risk.

https://vijilan.com/blog/bring-your-own-tool-soc-what-fits 2026-06-26T07:33:06.247Z 2026-06-26T07:33:06.247Z

See when a bring your own tool SOC makes sense, where it adds risk, and how to choose a model that fits your stack, team, and response needs.

https://vijilan.com/blog/managed-security-services-for-var-growth 2026-06-25T07:27:25.616Z 2026-06-25T07:27:25.616Z

Managed security services for VAR help add 24/7 SOC coverage, recurring revenue, and stronger client retention without building security ops in-house.

https://vijilan.com/blog/how-to-outsource-security-operations-center 2026-06-24T07:27:29.136Z 2026-06-24T07:27:29.136Z

Learn how to outsource security operations center functions with the right model, tooling, SLAs, and response process for 24/7 protection.

https://vijilan.com/blog/co-managed-soc-services-explained 2026-06-23T07:21:17.357Z 2026-06-23T07:21:17.357Z

Learn how co managed soc services improve 24/7 detection, response, and coverage without the cost and staffing burden of a full in-house SOC.

https://vijilan.com/blog/what-ai-driven-mxdr-services-actually-do 2026-06-22T07:24:36.086Z 2026-06-22T07:24:36.086Z

Learn how ai driven mxdr services improve 24/7 threat detection, investigation, and response for MSPs, SMBs, and enterprise security teams.

https://vijilan.com/blog/soc-as-a-service-for-mssp-growth 2026-06-21T07:18:36.433Z 2026-06-21T07:18:36.433Z

SOC as a service for MSSP teams adds 24/7 detection, response, and scale without the cost of building a full security operations center in-house.

https://vijilan.com/blog/crowdstrike-falcon-managed-service-explained 2026-06-20T07:21:31.184Z 2026-06-20T07:21:31.184Z

Learn what a crowdstrike falcon managed service includes, how it operates in a 24/7 SOC model, and when it fits MSPs and businesses best.

https://vijilan.com/blog/outsourced-soc-for-smb-what-actually-matters 2026-06-19T07:15:35.088Z 2026-06-19T07:15:35.088Z

Learn how outsourced SOC for SMB improves 24/7 threat detection, response, and coverage without the cost and staffing burden of an internal SOC.

https://vijilan.com/blog/what-a-24-7-soc-monitoring-service-delivers 2026-06-18T07:15:47.305Z 2026-06-18T07:15:47.305Z

See what a 24 7 soc monitoring service delivers, how it works, where it fits, and why always-on detection and response matter to MSPs and SMBs.

https://vijilan.com/blog/white-label-soc-services-scale-security 2026-06-17T07:09:31.673Z 2026-06-17T07:09:31.673Z

White label SOC services help MSPs and MSSPs deliver 24/7 threat detection, response, and branded growth without building a SOC from scratch.

https://vijilan.com/blog/managed-detection-and-response-for-msps 2026-06-16T14:29:07.911Z 2026-06-16T14:29:07.911Z

Managed detection and response for MSPs adds 24/7 SOC coverage, faster containment, and scalable security delivery without building in-house teams.