Detection-Engineering
Two Parsers, One URL: The Interpretation-Conflict Bug Is Eating Authentication in 2026
Cisco SD-WAN, UniFi OS, Starlette and Clerk all fell to the same flaw this year: the component that decides who gets in and the component that decides where the request goes read the URL differently. Here is why it keeps happening and how to stop shipping it.
Inside the AI-Orchestrated EDR Evasion Lab: What Sophos Actually Found, and Why the Bug Wasn't in the Malware
Sophos recovered a fully autonomous malware R&D pipeline — a coordinator agent, four subordinate agents, a self-provisioned lab, and 80 evasion modules built against three EDR vendors. The interesting part isn't that it worked. It's the one thing in the whole pipeline that didn't.
The Login Path Is the Target: Inside the PAM/OpenSSH Backdoor Playbook Attackers Keep Reusing
Sygnia's Operation Highland found a China-nexus group living inside an air-gapped network for a decade by backdooring pam_unix.so and sshd. It's the same target the XZ Utils and Ebury campaigns went after — because the Linux authentication stack is the softest hard target in your fleet.