We Live Secruity
- MATCHBOIL: New tricks, same old evil intentions October 8, 2026ESET Research catalogs the changes of UAC-0099’s MATCHBOIL downloader from 2024 to 2026
- Inside a brand deal scam targeting YouTube creators October 7, 2026A plausible-sounding sponsorship offer could mask an attempt to compromise your Google account
- The quest for simplicity: Why SMBs want advanced protection without the complexity October 6, 2026The cybersecurity market is often making it tougher for SMBs to keep threats at bay
- This month in security with Tony Anscombe – September 2026 edition September 30, 2026Autonomous AI agents go on a hacking spree, and Microsoft ships what used to be a year's worth of security patches in one go – here's how to keep pace
- Timeshare exit scams: From fake buyers to recovery fraud September 29, 2026Con artists are targeting timeshare owners who want out – and some victims are hit twice
- The devil is still in the email – but wears a new mask September 28, 2026When phishing can increasingly pass familiar checks, avoiding or limiting the damage depends on how quickly your company can detect and contain the attack
- Is that vibe coded app safe? 5 checks before you download September 25, 2026As AI lets anyone build software, here’s how to vet that shiny new app before it exposes your data
- Been told to pay at a Bitcoin ATM? Read this first September 24, 2026Crypto ATM scams often follow a predictable script – here’s how to recognize it and what to do if you’ve already been caught out
- Looking for free Robux? Here’s what’s real, and what’s a scam September 22, 2026Fake giveaways, free Robux generators and lookalike login pages all target the same thing – your Roblox account
- The SMB cybersecurity squeeze: AI agents at work, old attacks in overdrive September 21, 2026As AI opens new paths to company data while making familiar attacks faster and cheaper, SMBs need protection designed around the time and expertise available to operate it
SANS ISC
- ISC Stormcast For Friday, October 9th, 2026 https://isc.sans.edu/podcastdetail/10130, (Fri, Oct 9th) October 9, 2026
- Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th) October 8, 2026We just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response. In the new material we dicsuss 8 of the most popular AI coding assistants and agents including Claude Code, Codex, Gemini CLI, Cursor, Copilot, Warp, Windsurf, and Qwen Code. I've been using […]
- ISC Stormcast For Thursday, October 8th, 2026 https://isc.sans.edu/podcastdetail/10128, (Thu, Oct 8th) October 8, 2026
- Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th) October 7, 2026On October 5th, Atlassian published patches for multiple products to fix an "Arbitrary File Access" vulnerability [CVE-2026-21589]. An attacker can read arbitrary files in the web application's directory, potentially exposing sensitive information such as configuration files.
- ISC Stormcast For Wednesday, October 7th, 2026 https://isc.sans.edu/podcastdetail/10126, (Wed, Oct 7th) October 7, 2026
- More RMM Tools In the Wild, (Tue, Oct 6th) October 6, 2026It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today, I found another one.
- ISC Stormcast For Tuesday, October 6th, 2026 https://isc.sans.edu/podcastdetail/10124, (Tue, Oct 6th) October 6, 2026
- ISC Stormcast For Monday, October 5th, 2026 https://isc.sans.edu/podcastdetail/10122, (Mon, Oct 5th) October 5, 2026
- TTY Logs and the Data it Captures, (Sun, Oct 4th) October 5, 2026For an experiment, I created a script [1] that parses and send the TTY logs collected from actors or bots activity that run various commands after they successfully login the DShield sensor. Those TTY logs are sent daily at the end of each day to the DShield SIEM [2] to be correlated with all the […]
- User Agent Strings Curiosities, (Sun, Oct 4th) October 4, 2026Sometimes I have to smile, or my interest is triggered, when I review new User Agent Strings in the honeypot logs.