Abstract

Submitted for the approval of the Midnight Society, I call this story... 🔦 On October 30, Abstract is hosting "Are You Afraid of the SOC?", a slightly terrifying session of real-world security operations nightmares. boo 👻

Your SIEM: "you still want these logs?" Also your SIEM: billing you for every one of them, even the ones nobody ever opens. That's not a relationship, it's a billing cycle. Abstract is free to try, right next to the SIEM you have. Learn more 👉 https://lnkd.in/gXpBMUmM

Yesterday, ASTRO published new research on PHP2Shell, covering two critical vulnerabilities in the PHP engine that could allow unauthenticated remote code execution. With attacks already being reported, the team breaks down what we know so far, which environments are most at risk, and what defenders should prioritize. The full report also includes detection guidance, WAF rules, and recommendations for hunting potential exploitation. Full report linked in comments 👇

Date night is here. Meet the SIEM that treats you right. It works every alert in the queue. It investigates, hunts, triages and responds on the same platform that already detects, with the evidence attached. No bolt-on AI sitting on top of someone else's alerts. Still stuck with a toxic SIEM? It's time to end it. Send us your current bill—for our next 100 customers, we'll come in under it, lock the price for three years, and give you 30 days in production before you sign. No hard feelings. Learn more 💘 https://lnkd.in/gVYbenBH

FMK. Everyone in the SOC has an answer. You deserve a SIEM that treats you right. Meet the love of your life tomorrow. 10.20 it's a date 🫶 Drop your crazy ex SIEM stories in the comments👇 👀

Patched your NetScaler? Cool beans. The webshell doesn't care. Two NetScaler ADC and Gateway zero-days, CVE-2026-88771 and CVE-2026-88772, have been exploited since early September. Responders keep finding implants that survive the patch including modified Apache configs, setuid shells, cron entries, and PHP webshells hiding behind arbitrary extensions. And as of Friday (yesterday), there's a potential new vector affecting appliances already patched against the first round. Weekend plans: cancelled. 😭 ASTRO pulled our own guidance together with reporting from other security teams and responders into one place: → Log signatures for both CVEs → Hunting implants → What to rotate, and why to rebuild instead of clean Hunt before you patch. Patching can delete the evidence. 🤬 https://lnkd.in/guN_D2Ph