OneNote File Extraction
Recently, I had to extract embedded files from a set of OneNote files (extension .one). 
Search Intelligence
Wireshark 5.0.0rc1 Release
Wireshark Release Candidate 5.0.0 was published : soon we can expect a new major version of Wireshark. 
YARA-X 1.22.1 Release
YARA-X&#;x26;#;39;s 1.22.1 is a bugfix version, it brings 2 bugfixes. 
China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days
Vapor Panda targeted more than 200 organizations spanning at least 14 countries, according to CrowdStrike. The ongoing campaign is remarkably successful and operating at shocking speed. The post China
Apple notifications alert victims in 99 countries about mercenary spyware infections
The notifications come shortly before the Pall Mall Process is nearing final negotiations on guidelines for the use of commercial hacking tools. The post Apple notifications alert victims in 99 countr
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos. The post From help desk impersonation to AD CS
What Exactly Is ISOC? And What Does It Mean for You?
Why Integrated Security Operations Centers Are the Future of AI-Driven Security – Aimei Wei, Founder, CTO at Stellar Cyber San Jose, Calif. – Oct. 30, 2026 Gartner recently released a new category of
Defense contractor pleads guilty to aiding North Korean remote worker scheme
The 62-year-old allowed co-conspirators to use his identity and top secret security clearance to apply for almost 100 jobs last year. The scheme’s success rate was limited. The post Defense contractor
Syrian hacker who served Assad regime gets 42 months in US prison
Ahmad Umar Agha is best known for posting a fake Associated Press tweet claiming President Obama was injured in a White House bombing. The post Syrian hacker who served Assad regime gets 42 months in
Filter generation in practice: from algorithms to LLMs
We automate filter generation for security alerts using an algorithm, a large language model, and a group of LLM agents.
Tracking AI adoption in North Korean threat actor tradecraft
As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed and efficiency of attacks, we’ve identified North Korean threat actors expanding their use
IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment
IDC has named Microsoft a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises. The post IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endp
There Aren’t Enough CISOs. 95% of Clients Will Pay Their Provider to Fill In.
According to Cybersecurity Ventures, there are about 35,000 CISOs worldwide. Cynomi’s 2026 State of vCISO Report shows what clients need from the providers who could fill the gap. Sausalito, Cal
Officials seize domain of top bulletproof hosting provider Virtualine
The Russian-speaking cybercrime storefront was among the most active bulletproof hosting providers this year to date, receiving almost one-fifth of all illicit-attributed inflow tracked by researchers
Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists
The Department of Peace group shared it with Swiss hacker/journalist maia arson crimew and DDoSecrets put it online. The post Leak site publishes data on more than 41,000 DHS employees obtained by hac
PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing Most
As of October 28, 2026, Wordfence knows of no WordPress site compromised through PHP2Shell. Update PHP to a fixed version and restart it, because updating WordPress does not update PHP. The post PHP2S
Yet Another ClickFix Campaign
Introduction 
The CISO’s evolving role: Protecting and defending in the agentic era
As AI and agents reshape the enterprise, CISOs face two critical priorities: enabling innovation with the right identity and data guardrails, and modernizing defense to keep pace with AI-powered threa
Dan McCrum’s Backstory of Wirecard, Germany’s Biggest Post-War Fraud Scandal
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 28, 2026 – Listen to the Podcast Episode Award winning investigative reporter Dan McCrum joined the Financia
Before you file that AI bug report, OpenAI has some advice
Open-source maintainers are so overwhelmed by AI-generated security reports that some have stopped accepting them. OpenAI’s Daybreak lead says the fix is higher-quality findings and far more coordinat