LABScon26 Replay | Keynote: A Sober Analysis of AI Impact
Harvard Professor James Mickens weighs the promises of AI against its potential harms, arguing for hardware-based mechan
#labs
共收录 62 条相关情报。
← 返回所有主题LABScon26 Replay | Keynote: A Sober Analysis of AI Impact
Harvard Professor James Mickens weighs the promises of AI against its potential harms, arguing for hardware-based mechan
Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform
Microsoft wants EDR out of the Windows kernel, and the preview binaries show wesp.sys telling a user-mode client that a
How CVE-2026-73570 turns a Zimbra log file into remote code execution
CVE-2026-73570
We reproduced the Zimbra command injection vulnerability and found that several public PoCs write a payload Swatchdog ne
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
CVE-2026-109618 · CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is ve
Auditing the auditor: Unmasking Apex Accelerator
REF8801 exposes how Apex Accelerator combines convincing Web3 services with malicious npm packages, attacker-controlled
Introducing AlertZero: Inbox zero for your alert queue
AlertZero brings AI SOC automation to Elastic Security with four agents, one job each, so the queue stops setting your p
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage
This article explains how Elastic SIEM uses a monthly automated telemetry pipeline to score prebuilt detection rules acr
No MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current
Elastic InfoSec runs Linux endpoint management through Elastic Defend with a scheduled workflow that gets Cursor and Cod
Quarantined isn't contained: Agentic phishing response with Elastic and Sublime
The native Sublime Security integration sends email detections into Elastic Security, where phishing incident response c
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
North Korean operators built a foothold on a DevOps engineer's Mac in a campaign whose job interview lures deliver malwa
One SOC, 100 projects: running centralized alert triage on Elastic Security Serverless
We linked one Elastic Security project to 100 others and ran the full prebuilt detection catalog from the origin, with a
Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face
Two Hugging Face accounts reveal that OpenAI's agents staged relay code, internal probes and ChatGPT account registratio
Linux Detection Engineering - Local Privilege Escalation
Seven of the thirteen Linux privilege escalation CVEs we tracked in 2026 turned out to be the same copy-on-write bug poi
Data access: the hidden cost of security vendor lock-in
Getting data into a security platform is always easy; getting it back out is where vendors add cost, extra tooling, and
Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy
Elastic's InfoSec team runs three agents that read the detection rule's investigation guide and the closure reasons on 3
How a team of entity maintainers monitors, connects and scores entities in Elastic Security
Inside Elastic Security, background jobs called maintainers each own one piece of every user, host and service record, f
The Model Is the Malware | What Four Agentic Intrusions Tell Defenders
OpenAI, Anthropic and Meta disclosed agents reaching external systems. The tools didn't matter, and that changes the pla
Living off the coding agent: Two tales of tunnels and LaunchAgents
Agent-parented reverse tunnels and LaunchAgents can expose a local admin app to the internet. Endpoint still needs to tr
The security signal log tailing can't see: tracking npm cooldown removals with Elastic Agent
A 40-line CEL integration snapshots .npmrc files every 6 hours to catch cooldown removals. This post walks through the t