D
Oct 27, 2026Deleted is evidence: what attackers cannot erase, in 7 principles
Four kinds of traces, which ones attackers can erase, and seven principles that turn a missing log into a lead.
Oct 27, 20262 min read0 reactions0 comments
Back to articles
Tag archive
#incidentresponse
R
Oct 26, 2026Reachable Is Not the Same as Compromised: Scoping BeyondTrust Appliances After CVE-2026-102764
Why external reachability and confirmed compromise require separate evidence streams when scoping BeyondTrust Remote Support appliances.
Oct 26, 20263 min read0 reactions0 comments
B
Oct 26, 2026Blast Radius of an Appliance Credential: What CVE-2026-102764 Put at Risk
Credential exposure, persistence across resets, and a rotation sequence for compromised remote-support appliances after CVE-2026-102764.
Oct 26, 20263 min read0 reactions0 comments
W
Oct 26, 2026When the WAF Host Is Compromised: CVE-2026-106931 and Evidence You Still Own
Why a compromised SiteGuard host undermines WAF-produced evidence for CVE-2026-106931, and how to order collection, verification and patching so local evidence survives.
Oct 26, 20263 min read1 reactions0 comments
C
Oct 26, 2026Collecting SiteGuard Diagnostic Information Before the CVE-2026-106931 Patch
Step-by-step evidence workflow for CVE-2026-106931: export SiteGuard diagnostic information first, record version and statistics state, store the archive off-host, then patch.
Oct 26, 20263 min read0 reactions0 comments
C
Oct 26, 2026CVE-2026-106931 Response Order: Export Evidence Before You Patch SiteGuard
Response-order analysis for CVE-2026-106931 in SiteGuard Server Edition: preserve diagnostic evidence before patching, confirm affected versions, and read public exposure figures correctly.
Oct 26, 20264 min read0 reactions0 comments
T
Oct 26, 2026The attacker deleted everything. At 2 a.m., /proc still remembered.
How to recover a deleted, still-running payload straight from /proc on Linux, and why 'rm' never erases the evidence.
Oct 26, 20264 min read1 reactions1 comments
O
Oct 26, 2026Opening a Word file got lsass read. Remember 0x1410.
How Sysmon Event ID 10 exposes lsass memory access: GrantedAccess 0x1410, CallTrace UNKNOWN, and a chain-based rule.
Oct 26, 20262 min read0 reactions0 comments
C
Oct 25, 2026Cheap Embeddings and Rerank Alternatives: OpenAI, Cohere, Voyage Semantic Search
For a support system that turns sales calls into CRM actions, the safest way to control...
Oct 25, 20267 min read0 reactions0 comments
A
Oct 25, 2026AhsayCBS CVE-2026-105133 and CVE-2026-105134: The Backup Server as an Attack Platform
Why an incomplete first patch and a backup server with command execution create a recovery risk, with concrete verification steps.
Oct 25, 20263 min read0 reactions0 comments
R
Oct 25, 2026Recovering a PAN-OS firewall from CVE-2026-0321 maintenance mode
Recovery sequence, HA considerations and monitoring for maintenance-mode outages.
Oct 25, 20263 min read0 reactions0 comments
S
Oct 25, 2026Seventy-One Percent in Three Days: What a Fast Exposure Drop Actually Costs
A 71% exposure drop in 72 hours is fast, visible and not the same as remediation. What the timeline shows and what it leaves unpaid.
Oct 25, 20264 min read0 reactions0 comments