Author: HackWatchit

// Description: This query attempts to identify post-exploitation command execution within the context of a PHP web server or worker process. // Notes: This hunting query is not specific to CVE-2026-109618 and CVE-2026-109619. It is capable of identifying exploitation of various web application vulnerabilities. This query may also produce false positive findings depending on the specific web applications running. We recommend validating if any identified activity is expected for the web applications running on systems. config case_sensitive = false| dataset = xdr_data| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START and action_process_image_name != null| fields _time, agent_hostname, agent_id, event_id, actor_effective_username, actor_process_image_name, actor_process_command_line,…

Chainalysis Investigates Security Incident Involving AI-Driven Attack Techniques Pierluigi Paganini November 02, 2026 Chainalysis suffered a cyberattack exposing customer names, emails and user IDs, while investigation data and passwords remain safe. Blockchain analytics firm Chainalysis says it was the target of a cybersecurity incident. A threat actor accessed its systems and internal tools and stole some non-sensitive customer data. “This month, Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools.” reads the statement published by the company, which also includes the full email sent to affected customers. Chainalysis says it…

A 28-year-old Russian man has been arrested by German police, suspected of being a key member of the Qilin ransomware gang. As BBC News reports, detectives have linked the man to the 2024 attack against blood-testing firm Synnovis, that disrupted London hospitals, and resulted in the death of a patient.The suspect, who has been named by German media only as “Vladimir K” was originally detained in May in Japan, after he travelled there on holiday. According to German officials, the man’s vacation plans were intercepted and Japanese police were waiting for him on arrival. Earlier this month he was extradited…

The cryprocurrency exchange Binance is investigating a suspected hack after billions of dollars moved from wallets associated with the exchange on October 29, 2026. Outside investigators have estimated the suspicious transfers at up to $5.8 billion, a figure that would make this the largest cryptocurrency theft publicly reported if confirmed. The exchange has not confirmed that amount as stolen but confirmed that it was investigating the incident and assured customers that their funds were “completely safe.” Meanwhile, cryptocurrency issuers began freezing assets linked to the suspicious activity.  Billions Moved Before Issuers Froze Assets Blockchain investigators began examining large transfers involving…

An informal CISO group is helping agencies find gaps as the 2030 post-quantum migration deadline nears.

Topic: AI Governance Challenge: Data Leakage, Model Risk, Third-Party & Shadow AI Watch Now Abstract: AI risks rarely emerge in controlled environments. Instead, they surface through shadow AI, rapid experimentation, and ungoverned use of third-party tools, leading to data leaks, bias, compliance failures, and operational instability. This session takes a real-world, use-case-driven lens to AI risk. We’ll break down how risks manifest across the AI lifecycle—from unauthorized adoption and data exposure to model drift and vendor dependencies. You’ll also learn how to identify and prioritize AI use cases based on risk exposure and business value, while embedding governance at every…

For many families around the world, the digital spaces where children learn and play have also become venues for relentless harassment. According to a 2025 survey of nearly 3,500 U.S. teens by the Cyberbullying Research Center, about 58% have been cyberbullied at least once, a significant jump from 34% in 2016. Experts warn that this issue is now a constant crisis and impacting the well-being of children and teens. In this guide, we will clarify exactly what counts as cyberbullying. We will explore how new platforms and artificial intelligence are reshaping the landscape. Most importantly, we will provide you with…

Prompt injection started as a simple idea during its initial chatbot phase: Tell the model to ignore its instructions and return information in violation of its guardrails. Now, prompt injection attacks can aim at something harder to see: how an agent plans, and how a model reasons and decides which rules apply. The CrowdStrike Prompt Injection Taxonomy, built and maintained by CrowdStrike AI security researchers, offers the industry’s most comprehensive framework for understanding and defending against the ever-expanding array of attack techniques. Today we are introducing a new version of the taxonomy that adds newly discovered attack techniques on autonomous…

Imagine you are a soldier on the front lines, moving through hostile terrain with only your training, tools, and instincts. That’s what threat hunting in cybersecurity feels like. You’re not waiting in a bunker for alarms to sound; you leave the wire, patrol the area of operations, and look for signs of the enemy before they strike.A traditional SOC analyst is a watchtower guard: when an alarm goes off, you investigate, confirm, and respond. A threat hunter is the scout team. Your mission begins when everything appears quiet. You assume the adversary is already inside the wire, moving carefully to…