Resources & insights

Field notes from
a 24/7 SOC.

Original analysis on the threat landscape, the state of managed detection and response, and the technology shaping how MSPs deliver security.

Featured · Threat Intelligence

Kapibala, Red Heron, and the Blind Spot Between Your Tools

Three unrelated products, three separate disclosures, one operational lesson: attackers don't respect your vendor categories, and neither should your monitoring.

Sep 2026 · 7 min read

Kapibala, Red Heron, and the Blind Spot Between Your Tools

Sort by date

Compliance · Sep 2026

CISA Retires Its Weekly Vulnerability Bulletin: What MSPs Do Now

CISA is retiring its weekly vulnerability bulletin on September 28, 2026, in favor of a risk-based, KEV-first model under BOD 26-04. Here's what that means for MSPs still running CVSS-only patch cycles.

7 min read

Threat Intelligence · Sep 2026

CVE-2026-19490: Why CISA Says Patching Citrix NetScaler Isn't the Finish Line

CISA's KEV addition for CVE-2026-19490 comes with an unusual instruction: patching Citrix NetScaler ADC and Gateway is not the end of remediation. Here's what forensic triage actually requires, and where an MSSP's SOC has to pick up the work.

Field notes from a 24/7 SOC.

Kapibala, Red Heron, and the Blind Spot Between Your Tools

CISA Retires Its Weekly Vulnerability Bulletin: What MSPs Do Now

CVE-2026-19490: Why CISA Says Patching Citrix NetScaler Isn't the Finish Line

Acronis Backup Plugin Under Active Exploitation: What CVE-2026-87886 Means for Your Hosting Stack

CVE-2026-5430: WSO2 API Manager Forged Admin Tokens, Four Months After the Patch

Cisco ISE CVE-2026-76460: When the Gatekeeper Becomes the Breach

Cisco Secure Email Gateway Zero-Day (CVE-2026-76461): The Box That Stops Attacks Just Got Root-Owned

ScreenConnect's Worm-Like Flaw (CVE-2026-84869): Why Patching the Server Isn't the End of the Story

PoisonedRefresh: The F5 BIG-IP Rootkit Your File Scanner Will Never Find

974 CVEs in One Patch Tuesday: Why MSPs Can't Patch Their Way Out of September 2026

StyleSmuggler (CVE-2026-75650): Why Patching Adobe Commerce Isn't the End of the Incident

Cisco Secure FMC CVE-2026-20079: Why Alert-Only Monitoring Fails a CVSS 10.0 Management Plane Bug

BlueMoon Exploit Kit: Why Four Espionage Groups Beat Your Patch Cycle

N-able N-central's Fourth Emergency Hotfix in Five Weeks: When the MSP's Own RMM Becomes the Breach Vector

MikroTrick: MikroTik RouterOS SSH Bypass Is Already an Active Compromise Problem, Not Just a Patch Problem

Sangoma Switchvox CVE-2026-9586: Active Exploitation Hitting SMB Phone Systems Now

Claude Session Hijacking: What the Anthropic Infostealer Wave Means for MFA and SaaS Security

Cisco Nexus 9000 Root RCE (CVE-2026-20212): The Patch Queue Has No Workaround, So Your Monitoring Better Have One

FalconFlank Is a Wake-Up Call: Why No EDR Agent Should Be Your Only Line of Defense

SonicWall SMA 1000 Zero-Days Under Active Exploitation: What MSSPs Need to Do Now

Fal.Con 2026: Securing the AI Revolution

CVE-2026-82329: Attackers Are Minting Admin Tokens in Artifactory Before Your Patch Window Closes

CVE-2026-8452: The NetScaler 'DoS Patch' That Was Actually Unauthenticated RCE

ShinyHunters Phished a ReliaQuest Employee. Device Trust Is the Only Reason It Stopped There.

PaperCut's Two-Patch Week: What CVE-2026-82078 and CVE-2026-81578 Mean for MSSPs

CISA KEV August 2026: Why Decade-Old CVEs Are Suddenly Exploited Again

Ubiquiti's SAB-067: 22 UniFi Vulnerabilities, Three Rated CVSS 10.0, and a Patch Cycle MSPs Can't Outrun Alone

CISA's 'A Tale of Two SOCs': The Advisory Every MSSP Should Be Reading This Week

Zimbra CVE-2026-73570 Exploited: Why Patching Isn't the Finish Line

CISA's August 18 KEV Batch: Four Platforms, Five Days, One Lesson for MSPs

GeoServer's Zero-Day SQL Injection: Why the 2023 Patch Doesn't Save You

The MSSP Growth Curve Is Outrunning the MSP Hiring Curve

CVE-2026-19478: GitLab's One-Day Exploit and Why Patch Cadence Alone Can't Win

ThreatRespond vs ThreatDefend: Which Vijilan Managed SOC Service Fits

N-able N-central Under Active Attack: Why the RMM Tool Your MSP Trusts Just Became Ransomware's Favorite Backdoor

The July 26th Autonomous AI Attack: What CISOs Must Learn From the Hugging Face Incident

White-Label Security Done Right: A Buyer's Guide for MSPs

XDR vs MDR for Businesses: What Fits?

MDR for Small Business: What Actually Matters

What an Enterprise Incident Response Service Does

Bring Your Own Tool SOC: What Fits

Managed Security Services for VAR Growth

How to Outsource Security Operations Center

Co Managed SOC Services Explained

What AI Driven mXDR Services Actually Do

SOC as a Service for MSSP Growth

CrowdStrike Falcon Managed Service Explained

Outsourced SOC for SMB: What Actually Matters

What a 24 7 SOC Monitoring Service Delivers

How White Label SOC Services Scale Security

Managed Detection and Response for MSPs

Get the briefing,every Tuesday.

Field notes from
a 24/7 SOC.

Get the briefing,
every Tuesday.