Author: HackWatchit

Extending Threat Hunting and MDR to AI As organizations increasingly connect AI systems to sensitive data, applications, and infrastructure, adversaries have new opportunities to exploit trusted access and legitimate AI capabilities. According to the CrowdStrike 2026 Threat Hunting Report, AI agents triggered 2.5 times more detection leads than human activity, underscoring how AI-driven activity is increasing the volume and velocity of signals threat hunters must assess. Falcon Adversary OverWatch Cross-Domain now extends 24/7 proactive threat hunting to AI applications and autonomous agent activity monitored by CrowdStrike Falcon Guardian. By combining Falcon Guardian’s runtime context with telemetry across the Falcon platform…

Collective action on AI must include rebuilding the government’s expertise, and it must start now. Mary Ellen Callahan October 29, 2026 4:45 pm 5 min read Until January 2025, I led the Department of Homeland Security’s office focused on countering chemical, biological, radiological and nuclear threats (CBRN). My team wrote a report warning that artificial intelligence could lower the barriers to CBRN misuse, but real limits still made that likelihood low. Now those limits are giving way and the government organizations focused on this issue have been weakened and broken up. The evidence is mounting that we are closing in…

Security, Orchestration, Automation, and Response (SOAR) is still a foreign concept to some but has rapidly evolved into a necessity for high-performing SOCs. SOCs without a SOAR — or without meaningful automation — will struggle with manual repetition, duplicate alerts, and slow response times as they scale. With SOAR, many of these problems can be addressed or reduced.While SOAR isn’t a “silver bullet” by any means, the operational impacts are real because of the power it gives a SOC to optimize workflows, centralize security alert management, and minimize threat response time (or mean time to resolution). According to the Ponemon…

This post is also available in: 繁體中文 (Chinese (Traditional)) 日本語 (Japanese) Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) have been published. Both vulnerabilities carry a severe CVSS score of 9.2 (more technical details are in the Unit 42 Threat Brief).  This is not just another high-severity vulnerability disclosure, it marks the opening chapter in a massive acceleration of cyberthreats that will define the foreseeable future. Because PHP is widely used globally (by some estimates, more than half of all websites), the sheer scale of this is massive. Navigating this new reality demands immediate imperatives, including continuous, proactive vulnerability discovery…

Germany’s far-right AfD (Alternative für Deutschland) party has confirmed that it has suffered a security breach, after a hacker published what appear to be hundreds of thousands of the controversial political party’s internal emails.Earlier this week, the AfD admitted that its hosting provider had been hacked in September, and that some of its mailboxes had been copied. The party claims that most of the affected mailboxes had not been used for years, but the leaked archive reportedly includes messages dated as recently as 12 September 2026.The news came as the Hexane.cc leak site published AI-written summaries of hundreds of thousands…

The FBI has attributed the theft of more than $6 billion from Binance to North Korea, naming the activity it tracks as TraderTraitor and publishing hundreds of cryptocurrency addresses connected to the stolen funds. In an October 31 announcement, the bureau said the theft occurred on or around October 29, 2026. The attribution follows Binance’s disclosure that attackers stole approximately $6.3 billion, with its investigation identifying a compromised DevOps engineer’s laptop and additional breach points. Stolen Assets Converted Into Ethereum Investigators from the FBI, US Secret Service and IRS Criminal Investigation have observed the attackers converting stolen assets primarily into…

Topic: The Ultimate Guide to Incident Response Governance Watch Now Abstract: Effective incident response is not just a technical exercise but also a governance imperative. As cyber threats become more sophisticated and regulatory expectations continue to evolve, organizations need clearly defined structures to ensure incidents are detected, escalated, managed, communicated, and reviewed with appropriate levels of accountability. The current webinar explores the key elements of incident response governance, from establishing roles and responsibilities to defining escalation paths, decision-making authority, communication protocols, and regulatory reporting requirements. It will examine how organizations can align incident response processes with enterprise risk management and…

OpenAI isn’t done securing the AI infrastructure it needs to rapidly scale agentic workloads. The ChatGPT-maker on Monday said it has reached a deal with Amazon to buy $38 billion in cloud computing services over the next seven years.   OpenAI said it will immediately start using AWS compute, with all capacity targeted to be deployed before the end of 2026, with the ability to expand further into 2027 and beyond.   The deal follows OpenAI’s restructuring last week, which freed the company from having to secure Microsoft’s approval to buy computing services from other firms. OpenAI’s deal with Amazon…

Here’s the deal: when adversaries compromise your environment, they don’t float around in abstract network flows. They execute on actual systems. They touch files, spawn processes, and mess with registries.The premise of endpoint threat hunting is simple: if an adversary wants to accomplish anything meaningful, they must eventually execute code on a host. That execution leaves traces.The Endpoint Advantage: Depth and ContextEndpoint hunting gives you deep, contextual visibility into adversary behavior. You’re not inferring what happened from network packets; you’re seeing exactly what processes ran, which files were touched, and what registry keys got modified.Consider credential theft. An adversary running…