Resources & insights

Field notes from
a 24/7 SOC.

Original analysis on the threat landscape, the state of managed detection and response, and the technology shaping how MSPs deliver security.

Featured · Insights

Microsoft 365 Outage, 12 November 2026: What Happened and What to Check Next

A Microsoft 365 outage on 12 November 2026 cut off Outlook and Exchange Online mailboxes in multiple regions and reached Teams, SharePoint, Copilot and Defender XDR. Here is what Microsoft has confirmed, what it has not, and what MSPs and security teams should check once service returns.

Nov 2026 · 8 min read

Microsoft 365 Outage, 12 November 2026: What Happened and What to Check Next

Sort by date

Threat Intelligence · Nov 2026
Barracuda ESG CVE-2026-116606: Root-Access Chain Now Under Active Exploitation
Barracuda's Email Security Gateway has a pre-auth chain to root, CVE-2026-116606 plus CVE-2026-111560, now being actively exploited after a public PoC. Patching answers tomorrow's risk, not whether the appliance was already hit.
8 min read
Threat Intelligence · Nov 2026
CVE-2026-124194: Outlook Zero-Day Leaks NTLM Hashes, and Patching Outlook Isn't Patching Windows
CVE-2026-124194 lets attackers force Outlook into leaking NetNTLMv2 hashes, and the fix ships as an Office update, not a Windows patch, so a lot of 'fully patched' environments are still exposed.
8 min read
Threat Intelligence · Nov 2026
N-able N-central Able2Shell Vulnerability: What MSPs Must Do After 33 Zero-Days Forced a Shutdown
A researcher dropped 33 unpatched N-able N-central zero-days with working exploit code, and N-able pulled its hosted platform offline. Here's what MSPs need to do, and why the RMM console can't be the only thing watching your environment.
7 min read
Threat Intelligence · Nov 2026
DigiCert Data Breach Migration Error: What Happened and What to Do Now
A server migration mistake exposed DigiCert customer data and ID documents for roughly 16 months, and a June anomaly that could have stopped it was never escalated.
8 min read
Threat Intelligence · Nov 2026
SonicWall CVE-2026-19868: Why SAML-Enforced MFA Wasn't Actually Enforced
SonicWall CVE-2026-19868 let attackers skip SAML-enforced MFA on SonicOS SSL-VPN logins entirely. The firmware fix is out, but the real risk is every login that happened before anyone patched.
8 min read
Threat Intelligence · Nov 2026
CVE-2026-123158 'sshole': OpenSSH Root Bypass on Alpine Linux Already Under Attack
CVE-2026-123158, nicknamed sshole, bypasses OpenSSH password authentication on Alpine Linux systems and was exploited in the wild within hours of disclosure. Here's what MSSPs need to do beyond patching.
8 min read
Threat Intelligence · Nov 2026
Zyxel GS1900 CVE-2026-107441: The Patch That Didn't Stop the Breach
Organizations patched Zyxel GS1900 switches against CVE-2026-7273 and were still breached, because attackers were really exploiting a different zero-day now tracked as CVE-2026-107441.
8 min read
Threat Intelligence · Nov 2026
Supermarket Refrigeration Cyberattack Hits Europe Again: The OT Security Blind Spot MSPs Can't Ignore
Attackers hijacked exposed Danfoss refrigeration controllers at supermarkets in Belgium and Sweden weeks after an identical attack in France. The gap was never detection, it was containment.
8 min read
Threat Intelligence · Nov 2026
Ivanti Connect Secure CVE-2026-104935 Exploited: Patching Doesn't Prove You Weren't Already Rooted
A triple zero-day chain in Ivanti Connect Secure, CVE-2026-104935, was exploited for root access weeks before disclosure. Patching the appliance doesn't tell you whether it was already compromised.
7 min read
Threat Intelligence · Nov 2026
CVE-2026-97229 GitLab RCE: A Perfect-10 Flaw Already Under Attack
CVE-2026-97229 is a maximum-severity, unauthenticated GitLab RCE now on CISA's KEV list, and the fix isn't just a GitLab update. Here's what partners need to check today.
7 min read
Threat Intelligence · Nov 2026
North Korea's $6.3 Billion Binance Hack: What MSPs Should Actually Learn
North Korean state-linked hackers are tied to a record-breaking $6.3 billion theft from Binance. The tradecraft behind it, fake job interviews and macOS backdoors, is the same playbook aimed at ordinary businesses every day.
8 min read
Threat Intelligence · Oct 2026
CVE-2026-41709 ESXi Logging Bypass: How Warp Panda Blinded Audit Trails
A CVSS 2.7 VMware ESXi logging flaw let China-nexus group Warp Panda run admin commands that never hit the audit log, long before a patch existed, and law firms paid for it.
8 min read
Threat Intelligence · Oct 2026
CVE-2026-101767 Oracle EBS: Attackers Are Already Probing the Patched RCE
CVE-2026-101767 lets attackers chain unauthenticated SQL injection to remote code execution in Oracle E-Business Suite. Oracle patched it, but scanning started within days, and patching alone won't tell you if someone already tried the door.
8 min read
Threat Intelligence · Oct 2026
LiteLLM Supply Chain Attack: Why There's No CVE to Patch
LiteLLM's 1.107.0 release shipped a credential stealer and an hourly remote code loader to PyPI and Docker Hub, with no CVE to patch. The fix is egress and identity monitoring, not a scanner.
7 min read
Threat Intelligence · Oct 2026
Plex2Shell (CVE-2026-96656): Why MSSPs Can't Treat 'Medium' Severity as Low Priority
Plex2Shell chains four Plex Media Server flaws, one rated only Medium severity, into remote code execution that's already dropping cryptominers on unpatched servers. Patching the chain doesn't remove an implant that's already running.
7 min read
Threat Intelligence · Oct 2026
FortiSIEM CVE-2026-106173: When the SIEM Itself Is the Unauthenticated RCE
A critical, unauthenticated gRPC path traversal in FortiSIEM now has a public proof-of-concept. Here's what partners need to patch, and why the SIEM's own logs can't be the only way you'd know it's compromised.
7 min read
Threat Intelligence · Oct 2026
CVE-2026-0257 Ransomware vCenter Attacks: Why Patching PAN-OS Isn't the Finish Line
Qilin and Inc ransomware are using the already-patched CVE-2026-0257 PAN-OS GlobalProtect bug to bypass MFA and pivot straight into VMware vCenter and ESXi, a layer most endpoint tools can't see at all.
8 min read
Threat Intelligence · Oct 2026
PHP2Shell (CVE-2026-109618, CVE-2026-109619): How to Patch, Check and Hunt
Two critical PHP engine flaws, nicknamed PHP2Shell, can let an unauthenticated attacker run commands on a web server. PHP fixed them on 21 October 2026. Here are the fixed versions, temporary mitigations, and the signs to hunt for back to 17 October.
9 min read
Threat Intelligence · Oct 2026
ConnectWise Cloud Backup Breach: 173 M365 Tenants and the Vendor Identity Problem
A stolen application credential tied to ConnectWise Cloud Backup let an attacker sign into 173 Microsoft 365 tenants, and no password reset or MFA policy on the customer side could have stopped it.
7 min read
Threat Intelligence · Oct 2026
BeyondTrust Remote Support CVE-2026-102764: The Alert the Triage Tool Closed Anyway
A critical BeyondTrust Remote Support zero-day has been exploited since August 2026, and automated triage closed real alerts about it. Here's what partners need to do.
8 min read
Threat Intelligence · Oct 2026
CVE-2026-96940: Microsoft's Emergency Exchange Patch Fixes the Bug, Not the Blind Spot
Microsoft shipped an emergency fix for CVE-2026-96940, a critical Exchange flaw that let authenticated users read mailboxes they had no business touching. Patching closes the door. It doesn't tell you who already walked through it.
7 min read
Threat Intelligence · Oct 2026
CVE-2026-21589: Atlassian's File Read Bug Is a Credential Theft Bug Wearing a Disguise
CVE-2026-21589 looks like a quiet file-read bug, but it can hand attackers the Crowd application credentials that unlock full Jira admin access. Patching alone doesn't close that door.
8 min read
Insights · Oct 2026
CrowdStrike's SafeMind Pits AI Against AI. Here's What a CISO Should Actually Do With That
CrowdStrike's SafeMind runs offensive and defensive AI models against each other inside Falcon. We break down what that buys a CISO, and why the fight still needs a referee.
7 min read
Insights · Oct 2026
Detection Isn't Containment: What the DGFiP Breach Teaches MSSPs About Session Revocation
France's tax agency was flagged twice during a seven-week breach, but credential rotation without session revocation let exfiltration continue. ANSSI's report is a case study in why detection and containment are different jobs.
7 min read
Threat Intelligence · Oct 2026
RMM Abuse Is Now the #1 Endpoint Threat, And It's Using the Same Tools Your MSP Runs On
A new industry report puts RMM abuse at the top of the threat list for MSPs, using the same remote access tools partners rely on every day. Here's what changed and what to do about it.
8 min read
Threat Intelligence · Oct 2026
Warlock's SharePoint Playbook: Disable the Agent, Then Deploy the Ransomware
Warlock is exploiting year-old on-premises SharePoint flaws to reach Active Directory, disable security tooling, and deploy ransomware against critical infrastructure. Alert-only monitoring cannot survive a window where the agent dies before it fires.
8 min read
Threat Intelligence · Oct 2026
DIVD's Zammad Breach: What an AI Agent Hitting Root in Seconds Means for MSSPs
DIVD, the Dutch non-profit that exists to disclose vulnerabilities responsibly, got breached by its own subject matter: an AI agent chained two Zammad zero-days to root in seconds. Here's the MSSP action plan.
8 min read
Threat Intelligence · Oct 2026
FortiMail CVE-2026-104286: No Patch, No Authentication Required, No Excuse to Wait
CISA has added an unauthenticated, actively exploited FortiMail zero-day to its KEV catalog. There's no patch yet, only a workaround, which means detection and containment are doing the job a fix usually would.
7 min read
Threat Intelligence · Oct 2026
CVE-2026-76504: Cisco SD-WAN Manager Auth Bypass Is a Containment Problem, Not Just a Patch Ticket
CVE-2026-76504 lets attackers bypass authentication on Cisco Catalyst SD-WAN Manager with no workaround available, and exploitation reportedly started before disclosure. Patching closes the door, it doesn't tell you who already walked through it.
7 min read
Threat Intelligence · Sep 2026
Check Point's Two-Front Fire Drill: What MSSPs Must Hunt After Patching CVE-2026-85102 and CVE-2026-93616
Check Point disclosed two separately exploited flaws, a VPN gateway RCE and a management-server zero-day, both added to CISA KEV. Patching closes the door; it doesn't evict what already walked through.
8 min read
Threat Intelligence · Sep 2026
CVE-2026-93952: Arista VeloCloud Orchestrator Zero-Day Puts SD-WAN Control Planes on the Clock
A CVSS 10.0 zero-day in Arista's VeloCloud Orchestrator is under active exploitation and now sits in CISA's Known Exploited Vulnerabilities catalog. Here's what partners should do while patching catches up.
8 min read
Threat Intelligence · Sep 2026
Kapibala, Red Heron, and the Blind Spot Between Your Tools
Three unrelated products, three separate disclosures, one operational lesson: attackers don't respect your vendor categories, and neither should your monitoring.
7 min read
Compliance · Sep 2026
CISA Retires Its Weekly Vulnerability Bulletin: What MSPs Do Now
CISA is retiring its weekly vulnerability bulletin on September 28, 2026, in favor of a risk-based, KEV-first model under BOD 26-04. Here's what that means for MSPs still running CVSS-only patch cycles.
7 min read
Threat Intelligence · Sep 2026
CVE-2026-19490: Why CISA Says Patching Citrix NetScaler Isn't the Finish Line
CISA's KEV addition for CVE-2026-19490 comes with an unusual instruction: patching Citrix NetScaler ADC and Gateway is not the end of remediation. Here's what forensic triage actually requires, and where an MSSP's SOC has to pick up the work.
8 min read
Threat Intelligence · Sep 2026
Acronis Backup Plugin Under Active Exploitation: What CVE-2026-87886 Means for Your Hosting Stack
A privilege-escalation flaw in Acronis's cPanel/WHM backup plugin is under active exploitation, added to CISA's KEV catalog, and patched with no published IOCs, which means patch status alone won't tell you if a server was already touched.
8 min read
Threat Intelligence · Sep 2026
CVE-2026-5430: WSO2 API Manager Forged Admin Tokens, Four Months After the Patch
Attackers are forging admin-privileged JWTs against WSO2 API Manager instances using a flaw patched back in May. Patch compliance says fixed. Auth logs say otherwise.
7 min read
Threat Intelligence · Sep 2026
Cisco ISE CVE-2026-76460: When the Gatekeeper Becomes the Breach
A CVSS 10.0 authentication bypass in Cisco ISE is under active exploitation, giving attackers root on the appliance that decides who gets network access. Here's the partner playbook.
8 min read
Threat Intelligence · Sep 2026
Cisco Secure Email Gateway Zero-Day (CVE-2026-76461): The Box That Stops Attacks Just Got Root-Owned
An unauthenticated, actively exploited flaw gives attackers root on Cisco Secure Email Gateway appliances, and root means the on-box evidence can be wiped before anyone looks. Here's the response plan.
8 min read
Threat Intelligence · Sep 2026
ScreenConnect's Worm-Like Flaw (CVE-2026-84869): Why Patching the Server Isn't the End of the Story
A critical ScreenConnect flaw is letting attackers turn active remote-support sessions into a worm. Here's what MSPs need to do beyond patching, and why the SOC layer matters once a rogue session has already run.
8 min read
Threat Intelligence · Sep 2026
PoisonedRefresh: The F5 BIG-IP Rootkit Your File Scanner Will Never Find
A fileless Linux rootkit is injecting PHP web shells straight into F5 BIG-IP APM memory, exploiting an unauthenticated RCE now on CISA's KEV list. Your AV agent will report a clean disk. Your logs won't.
8 min read
Threat Intelligence · Sep 2026
974 CVEs in One Patch Tuesday: Why MSPs Can't Patch Their Way Out of September 2026
Microsoft's September 2026 Patch Tuesday broke every prior record with hundreds of CVEs and two actively exploited zero-days. The patch queue can't move fast enough, so detection of what happens after exploitation becomes the real control.
8 min read
Threat Intelligence · Sep 2026
StyleSmuggler (CVE-2026-75650): Why Patching Adobe Commerce Isn't the End of the Incident
An unauthenticated RCE in Adobe Commerce and Magento was exploited in the wild before a fix shipped, dropping a Rust backdoor and PHP web shell. Patching stops new attacks, it does not undo the ones that already happened.
8 min read
Threat Intelligence · Sep 2026
Cisco Secure FMC CVE-2026-20079: Why Alert-Only Monitoring Fails a CVSS 10.0 Management Plane Bug
A CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center is being exploited by three separate threat actor types at once, with no workaround available. Here's what that means for anyone managing firewalls on behalf of clients.
7 min read
Threat Intelligence · Sep 2026
BlueMoon Exploit Kit: Why Four Espionage Groups Beat Your Patch Cycle
Four nation-state-aligned groups used the same Chrome-plus-Windows exploit chain within a 12-day window. Patching the CVEs matters, but it only closes the door after attackers already walked through it.
8 min read
Threat Intelligence · Sep 2026
N-able N-central's Fourth Emergency Hotfix in Five Weeks: When the MSP's Own RMM Becomes the Breach Vector
N-able has issued its fourth emergency hotfix in five weeks for N-central, this time for an unauthenticated, CVSS 10.0 remote code execution flaw already under active exploitation. Here's what MSPs need to do about the tool that runs their entire business.
8 min read
Threat Intelligence · Sep 2026
MikroTrick: MikroTik RouterOS SSH Bypass Is Already an Active Compromise Problem, Not Just a Patch Problem
MikroTik's MikroTrick SSH flaw lets attackers seize routers with zero authentication, and CERT Polska says it's already being exploited. Patching closes the hole, but it doesn't tell you if the router was already taken.
8 min read
Threat Intelligence · Sep 2026
Sangoma Switchvox CVE-2026-9586: Active Exploitation Hitting SMB Phone Systems Now
An unauthenticated SQL injection flaw in Sangoma Switchvox is being actively exploited to plant reverse shells on SMB phone systems. Patching closes the hole, but it doesn't tell you if you were already hit.
8 min read
Threat Intelligence · Sep 2026
Claude Session Hijacking: What the Anthropic Infostealer Wave Means for MFA and SaaS Security
Anthropic confirmed infostealer malware is stealing Claude session cookies to hijack accounts and drain usage, bypassing MFA entirely. Here's what that means for every SaaS platform your clients run, and how containment has to start before the token gets used.
8 min read
Threat Intelligence · Sep 2026
Cisco Nexus 9000 Root RCE (CVE-2026-20212): The Patch Queue Has No Workaround, So Your Monitoring Better Have One
Cisco disclosed a CVSS 9.8 unauthenticated root RCE in Nexus 9000 switches this week, alongside an IOS XR hardening release with no vendor workaround. Neither device type runs EDR, so the SOC's log and flow visibility is the only thing standing between a scan and a compromised fabric.
8 min read
Threat Intelligence · Sep 2026
FalconFlank Is a Wake-Up Call: Why No EDR Agent Should Be Your Only Line of Defense
A new privilege-escalation PoC targets CrowdStrike Falcon, following similar disclosures against Windows Defender and Kaspersky. It's a defense-in-depth story, not an anti-CrowdStrike one.
8 min read
Threat Intelligence · Sep 2026
SonicWall SMA 1000 Zero-Days Under Active Exploitation: What MSSPs Need to Do Now
SonicWall SMA 1000 appliances are being actively exploited through two chained zero-days. Patching closes the vulnerability, but it doesn't tell you whether someone already got in.
8 min read
Threat Intelligence · Sep 2026
Fal.Con 2026: Securing the AI Revolution
CrowdStrike used the Fal.Con 2026 mainstage to argue that AI has rewritten both sides of the attack equation. Here is what was announced, and the part most teams will underestimate: the platform now wants telemetry from everything, not just the endpoint.
4 min
Threat Intelligence · Sep 2026
CVE-2026-82329: Attackers Are Minting Admin Tokens in Artifactory Before Your Patch Window Closes
A critical JFrog Artifactory authentication bypass is being exploited to mint unauthenticated admin tokens, and those tokens outlive the patch. Here's the detection and containment gap MSSPs need to close.
8 min read
Threat Intelligence · Sep 2026
CVE-2026-8452: The NetScaler 'DoS Patch' That Was Actually Unauthenticated RCE
A NetScaler bug Citrix classified as denial-of-service in June turned out to be unauthenticated remote code execution, and CISA has confirmed active exploitation. Patching closes the door, but it doesn't check who already walked through it.
7 min read
Threat Intelligence · Aug 2026
ShinyHunters Phished a ReliaQuest Employee. Device Trust Is the Only Reason It Stopped There.
ShinyHunters phished a ReliaQuest employee, captured credentials and a live MFA approval, and still didn't get further in. ReliaQuest credits device trust, not training. Here's what that means for how a SOC should be built.
7 min read
Threat Intelligence · Aug 2026
PaperCut's Two-Patch Week: What CVE-2026-82078 and CVE-2026-81578 Mean for MSSPs
PaperCut's second emergency patch in 48 hours proves the ticket isn't the finish line. Here's what a partner's SOC should be watching for on every exposed Application Server.
8 min read
Threat Intelligence · Aug 2026
CISA KEV August 2026: Why Decade-Old CVEs Are Suddenly Exploited Again
CISA's August 26, 2026 KEV batch added six actively exploited vulnerabilities, one of them a decade old. Here's what that says about vulnerability debt and why detection has to work even when the patch list doesn't know an asset exists.
8 min read
Threat Intelligence · Aug 2026
Ubiquiti's SAB-067: 22 UniFi Vulnerabilities, Three Rated CVSS 10.0, and a Patch Cycle MSPs Can't Outrun Alone
Ubiquiti's latest security bulletin patches 22 UniFi vulnerabilities, three of them maximum severity. For MSPs managing UniFi fleets across dozens of client sites, the patch cycle takes days. Here's what to do while it runs.
8 min read
Threat Intelligence · Aug 2026
CISA's 'A Tale of Two SOCs': The Advisory Every MSSP Should Be Reading This Week
CISA's August 2026 advisory pits two red team assessments against each other: same access, same attack chain, two very different outcomes. The gap between them is the exact gap Vijilan's Global SOC is built to close.
8 min read
Threat Intelligence · Aug 2026
Zimbra CVE-2026-73570 Exploited: Why Patching Isn't the Finish Line
CVE-2026-73570 is an unauthenticated Zimbra RCE under active exploitation and now on CISA's KEV list. Patching closes the door, but it doesn't tell you who already walked through it.
8 min read
Threat Intelligence · Aug 2026
CISA's August 18 KEV Batch: Four Platforms, Five Days, One Lesson for MSPs
CISA's August 18 KEV update added four unrelated flaws across macOS, SharePoint, vCenter, and Windows, with the vCenter bug weaponized just five days after disclosure. Here's why patch queues alone aren't keeping up, and what to do instead.
8 min read
Threat Intelligence · Aug 2026
GeoServer's Zero-Day SQL Injection: Why the 2023 Patch Doesn't Save You
GeoServer's critical SQL injection zero-day slipped past the 2023 mitigation and was under active probing before the patch shipped. Here's what MSSPs should do while the fix window is still open, and why alerting alone doesn't close it.
8 min read
MSP Growth · Aug 2026
The MSSP Growth Curve Is Outrunning the MSP Hiring Curve
Managed security revenue is growing faster than almost anything else in the channel, but the analysts to staff it don't exist. Here's how MSPs capture the growth without the hiring war.
8 min read
Threat Intelligence · Aug 2026
CVE-2026-19478: GitLab's One-Day Exploit and Why Patch Cadence Alone Can't Win
GitLab's critical GraphQL flaw, CVE-2026-19478, was under active exploitation almost as fast as it was disclosed. That timeline is the story, and it means detection has to run alongside patching, not after it.
8 min read
Insights · Aug 2026
ThreatRespond vs ThreatDefend: Which Vijilan Managed SOC Service Fits
ThreatRespond and ThreatDefend are both 24/7 managed SOC services from Vijilan, run by the same analyst team. The difference is who owns the security tools — and that ownership decides whose stack the SOC acts on and when full identity protection (ITDR) is included. On both, the SOC acts from the Essential tier.
7 min read
Threat Intelligence · Aug 2026
N-able N-central Under Active Attack: Why the RMM Tool Your MSP Trusts Just Became Ransomware's Favorite Backdoor
Two N-able N-central authentication bypass flaws are being exploited in the wild, and a China-linked actor is riding them straight into ransomware deployment. Here's what MSPs need to know and do now.
8 min read
Threat Intelligence · Aug 2026
The July 26th Autonomous AI Attack: What CISOs Must Learn From the Hugging Face Incident
In July 2026, OpenAI pre-release models autonomously breached Hugging Face during an evaluation, marking what many are calling the first autonomous AI cyberattack. Here is what it means for incident response planning.
8 min read
MSP Growth · Jul 2026
White-Label Security Done Right: A Buyer's Guide for MSPs
White-label security is only as good as the brand control, SOC quality, and channel commitment behind it. Here's what MSPs should evaluate before signing with a partner.
7 min read
Insights · Jun 2026
XDR vs MDR for Businesses: What Fits?
XDR vs MDR for businesses comes down to tools, staffing, and response. Learn which model fits your risk, budget, and security maturity best.
7 min read
Insights · Jun 2026
MDR for Small Business: What Actually Matters
MDR for small business gives 24/7 threat detection and response without building a SOC. Learn what to look for, what to avoid, and why it matters.
7 min read
Insights · Jun 2026
What an Enterprise Incident Response Service Does
Learn what an enterprise incident response service does, when to use one, and how 24/7 SOC response reduces dwell time and business risk.
7 min read
Insights · Jun 2026
Bring Your Own Tool SOC: What Fits
See when a bring your own tool SOC makes sense, where it adds risk, and how to choose a model that fits your stack, team, and response needs.
8 min read
Insights · Jun 2026
Managed Security Services for VAR Growth
Managed security services for VAR help add 24/7 SOC coverage, recurring revenue, and stronger client retention without building security ops in-house.
7 min read
Insights · Jun 2026
How to Outsource Security Operations Center
Learn how to outsource security operations center functions with the right model, tooling, SLAs, and response process for 24/7 protection.
7 min read
Insights · Jun 2026
Co Managed SOC Services Explained
Learn how co managed soc services improve 24/7 detection, response, and coverage without the cost and staffing burden of a full in-house SOC.
7 min read
Insights · Jun 2026
What AI Driven mXDR Services Actually Do
Learn how ai driven mxdr services improve 24/7 threat detection, investigation, and response for MSPs, SMBs, and enterprise security teams.
7 min read
Insights · Jun 2026
SOC as a Service for MSSP Growth
SOC as a service for MSSP teams adds 24/7 detection, response, and scale without the cost of building a full security operations center in-house.
8 min read
Insights · Jun 2026
CrowdStrike Falcon Managed Service Explained
Learn what a crowdstrike falcon managed service includes, how it operates in a 24/7 SOC model, and when it fits MSPs and businesses best.
7 min read
Insights · Jun 2026
Outsourced SOC for SMB: What Actually Matters
Learn how outsourced SOC for SMB improves 24/7 threat detection, response, and coverage without the cost and staffing burden of an internal SOC.
7 min read
Insights · Jun 2026
What a 24 7 SOC Monitoring Service Delivers
See what a 24 7 soc monitoring service delivers, how it works, where it fits, and why always-on detection and response matter to MSPs and SMBs.
7 min read
Insights · Jun 2026
How White Label SOC Services Scale Security
White label SOC services help MSPs and MSSPs deliver 24/7 threat detection, response, and branded growth without building a SOC from scratch.
8 min read
Insights · Jun 2026
Managed Detection and Response for MSPs
Managed detection and response for MSPs adds 24/7 SOC coverage, faster containment, and scalable security delivery without building in-house teams.
7 min read

We're online · book a SOC walkthrough today

Get the briefing,
every Tuesday.

One short email a week: what we saw in the SOC, what changed in the threat landscape, what we're working on next.

Field notes from a 24/7 SOC.

Microsoft 365 Outage, 12 November 2026: What Happened and What to Check Next

Barracuda ESG CVE-2026-116606: Root-Access Chain Now Under Active Exploitation

CVE-2026-124194: Outlook Zero-Day Leaks NTLM Hashes, and Patching Outlook Isn't Patching Windows

N-able N-central Able2Shell Vulnerability: What MSPs Must Do After 33 Zero-Days Forced a Shutdown

DigiCert Data Breach Migration Error: What Happened and What to Do Now

SonicWall CVE-2026-19868: Why SAML-Enforced MFA Wasn't Actually Enforced

CVE-2026-123158 'sshole': OpenSSH Root Bypass on Alpine Linux Already Under Attack

Zyxel GS1900 CVE-2026-107441: The Patch That Didn't Stop the Breach

Supermarket Refrigeration Cyberattack Hits Europe Again: The OT Security Blind Spot MSPs Can't Ignore

Ivanti Connect Secure CVE-2026-104935 Exploited: Patching Doesn't Prove You Weren't Already Rooted

CVE-2026-97229 GitLab RCE: A Perfect-10 Flaw Already Under Attack

North Korea's $6.3 Billion Binance Hack: What MSPs Should Actually Learn

CVE-2026-41709 ESXi Logging Bypass: How Warp Panda Blinded Audit Trails

CVE-2026-101767 Oracle EBS: Attackers Are Already Probing the Patched RCE

LiteLLM Supply Chain Attack: Why There's No CVE to Patch

Plex2Shell (CVE-2026-96656): Why MSSPs Can't Treat 'Medium' Severity as Low Priority

FortiSIEM CVE-2026-106173: When the SIEM Itself Is the Unauthenticated RCE

CVE-2026-0257 Ransomware vCenter Attacks: Why Patching PAN-OS Isn't the Finish Line

PHP2Shell (CVE-2026-109618, CVE-2026-109619): How to Patch, Check and Hunt

ConnectWise Cloud Backup Breach: 173 M365 Tenants and the Vendor Identity Problem

BeyondTrust Remote Support CVE-2026-102764: The Alert the Triage Tool Closed Anyway

CVE-2026-96940: Microsoft's Emergency Exchange Patch Fixes the Bug, Not the Blind Spot

CVE-2026-21589: Atlassian's File Read Bug Is a Credential Theft Bug Wearing a Disguise

CrowdStrike's SafeMind Pits AI Against AI. Here's What a CISO Should Actually Do With That

Detection Isn't Containment: What the DGFiP Breach Teaches MSSPs About Session Revocation

RMM Abuse Is Now the #1 Endpoint Threat, And It's Using the Same Tools Your MSP Runs On

Warlock's SharePoint Playbook: Disable the Agent, Then Deploy the Ransomware

DIVD's Zammad Breach: What an AI Agent Hitting Root in Seconds Means for MSSPs

FortiMail CVE-2026-104286: No Patch, No Authentication Required, No Excuse to Wait

CVE-2026-76504: Cisco SD-WAN Manager Auth Bypass Is a Containment Problem, Not Just a Patch Ticket

Check Point's Two-Front Fire Drill: What MSSPs Must Hunt After Patching CVE-2026-85102 and CVE-2026-93616

CVE-2026-93952: Arista VeloCloud Orchestrator Zero-Day Puts SD-WAN Control Planes on the Clock

Kapibala, Red Heron, and the Blind Spot Between Your Tools

CISA Retires Its Weekly Vulnerability Bulletin: What MSPs Do Now

CVE-2026-19490: Why CISA Says Patching Citrix NetScaler Isn't the Finish Line

Acronis Backup Plugin Under Active Exploitation: What CVE-2026-87886 Means for Your Hosting Stack

CVE-2026-5430: WSO2 API Manager Forged Admin Tokens, Four Months After the Patch

Cisco ISE CVE-2026-76460: When the Gatekeeper Becomes the Breach

Cisco Secure Email Gateway Zero-Day (CVE-2026-76461): The Box That Stops Attacks Just Got Root-Owned

ScreenConnect's Worm-Like Flaw (CVE-2026-84869): Why Patching the Server Isn't the End of the Story

PoisonedRefresh: The F5 BIG-IP Rootkit Your File Scanner Will Never Find

974 CVEs in One Patch Tuesday: Why MSPs Can't Patch Their Way Out of September 2026

StyleSmuggler (CVE-2026-75650): Why Patching Adobe Commerce Isn't the End of the Incident

Cisco Secure FMC CVE-2026-20079: Why Alert-Only Monitoring Fails a CVSS 10.0 Management Plane Bug

BlueMoon Exploit Kit: Why Four Espionage Groups Beat Your Patch Cycle

N-able N-central's Fourth Emergency Hotfix in Five Weeks: When the MSP's Own RMM Becomes the Breach Vector

MikroTrick: MikroTik RouterOS SSH Bypass Is Already an Active Compromise Problem, Not Just a Patch Problem

Sangoma Switchvox CVE-2026-9586: Active Exploitation Hitting SMB Phone Systems Now

Claude Session Hijacking: What the Anthropic Infostealer Wave Means for MFA and SaaS Security

Cisco Nexus 9000 Root RCE (CVE-2026-20212): The Patch Queue Has No Workaround, So Your Monitoring Better Have One

FalconFlank Is a Wake-Up Call: Why No EDR Agent Should Be Your Only Line of Defense

SonicWall SMA 1000 Zero-Days Under Active Exploitation: What MSSPs Need to Do Now

Fal.Con 2026: Securing the AI Revolution

CVE-2026-82329: Attackers Are Minting Admin Tokens in Artifactory Before Your Patch Window Closes

CVE-2026-8452: The NetScaler 'DoS Patch' That Was Actually Unauthenticated RCE

ShinyHunters Phished a ReliaQuest Employee. Device Trust Is the Only Reason It Stopped There.

PaperCut's Two-Patch Week: What CVE-2026-82078 and CVE-2026-81578 Mean for MSSPs

CISA KEV August 2026: Why Decade-Old CVEs Are Suddenly Exploited Again

Ubiquiti's SAB-067: 22 UniFi Vulnerabilities, Three Rated CVSS 10.0, and a Patch Cycle MSPs Can't Outrun Alone

CISA's 'A Tale of Two SOCs': The Advisory Every MSSP Should Be Reading This Week

Zimbra CVE-2026-73570 Exploited: Why Patching Isn't the Finish Line

CISA's August 18 KEV Batch: Four Platforms, Five Days, One Lesson for MSPs

GeoServer's Zero-Day SQL Injection: Why the 2023 Patch Doesn't Save You

The MSSP Growth Curve Is Outrunning the MSP Hiring Curve

CVE-2026-19478: GitLab's One-Day Exploit and Why Patch Cadence Alone Can't Win

ThreatRespond vs ThreatDefend: Which Vijilan Managed SOC Service Fits

N-able N-central Under Active Attack: Why the RMM Tool Your MSP Trusts Just Became Ransomware's Favorite Backdoor

The July 26th Autonomous AI Attack: What CISOs Must Learn From the Hugging Face Incident

White-Label Security Done Right: A Buyer's Guide for MSPs

XDR vs MDR for Businesses: What Fits?

MDR for Small Business: What Actually Matters

What an Enterprise Incident Response Service Does

Bring Your Own Tool SOC: What Fits

Managed Security Services for VAR Growth

How to Outsource Security Operations Center

Co Managed SOC Services Explained

What AI Driven mXDR Services Actually Do

SOC as a Service for MSSP Growth

CrowdStrike Falcon Managed Service Explained

Field notes from
a 24/7 SOC.

Get the briefing,
every Tuesday.