An unauthenticated file-write in Splunk Enterprise’s bundled Postgres sidecar chains to code execution as the splunk service account — the same account that owns your _audit and _internal indexes. The detection problem is mostly a log-forwarding hygiene problem you either solved last year or didn’t.
Conditional Access Token Protection is the control everyone cites as the answer to adversary-in-the-middle phishing. It binds the PRT for native apps on Windows and skips browsers entirely — which is exactly where the stolen cookie lands. Detection, not the control, is still your line.
Attackers don’t need a vulnerable driver to blind an EDR — they need the agent’s own installer and a window. The durable detection isn’t the kill command, it’s the silence that follows. Here is what that detection looks like the first time you deploy it, and why it floods the SOC before it works.
RunMRU is the tidiest endpoint signal for ClickFix, which is exactly why it’s the first thing attackers stopped touching. A look at what the registry detection catches, why it’s already half-blind, and the process-ancestry signal that actually survives.
Most prompt injection is semantic and resists signature detection. Invisible Unicode tag smuggling is the exception: it leaves a deterministic byte range you can match at the gateway. Here’s the detection, the tuning, and why most teams instrument the wrong path.
SRG moved its extortion infrastructure onto DNS fast flux. Building the detection is easy; the hard part is that a naive low-TTL-plus-many-IPs rule lights up every CDN in your environment before it ever surfaces the botnet.
China-nexus operational relay box networks rotate their egress IPs monthly and pick exit nodes inside the victim’s own region. Blocklists and impossible-travel rules don’t fire. Here’s where the detection actually lives, and what the first round of tuning has to fix.
FortiBleed isn’t a Fortinet vulnerability — it’s years of leaked configs, infostealer logs, and legacy password hashing compounding into tens of thousands of working FortiGate logins. There’s nothing to patch. Here’s what that changes for detection and response.
Z.ai’s GLM-5.2 is a cheap, MIT-licensed, long-horizon coding agent anyone can self-host with no provider-side refusal, logging, or kill switch. Paired with fresh AISI research on autonomous container-sandbox escape, the lesson is blunt: the model was never your control point. Your runtime hardening is.
The June 2026 Atomic Arch campaign weaponized abandoned AUR packages with a Rust infostealer and an eBPF rootkit. The mechanism wasn’t an exploit — it was the orphan-adoption process working exactly as designed.
