Sophos Blogs https://www.sophos.com/en-us/blog Latest blog posts and insights from Sophos en-us Building intent-based access control for AI agents https://www.sophos.com/en-us/blog/building-intent-based-access-control-for-ai-agents This article was first published on LinkedIn.

]]> Tue, 27 Oct 2026 00:00:00 GMT blt28f30e70e5517901 The breachpocalypse is here https://www.sophos.com/en-us/blog/the-breachpocalypse-is-here It's just hard to measure

]]> Mon, 26 Oct 2026 00:00:00 GMT blt7b229f12fcbbf65a Is “SIEM-less” really what it sounds like? https://www.sophos.com/en-us/blog/is-siem-less-really-what-it-sounds-like SIEM-less security may sound like an escape from traditional SIEM complexity and costs, but the underlying capabilities still have to exist somewhere.

]]> Fri, 23 Oct 2026 00:00:00 GMT blt54c34dbcdf3368b2 Web App Owners – You’re on Notice. Your Low-Hanging Fruit Just Got Lower https://www.sophos.com/en-us/blog/web-app-owners-your-low-hanging-fruit-just-got-lower Recent incident response investigations reveal how AI-assisted attackers are chaining web application vulnerabilities, credential theft, privilege escalation, and lateral movement into autonomous intrusion workflows.

]]> Wed, 21 Oct 2026 00:00:00 GMT blt87532768bfb186dd Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619 Wed, 21 Oct 2026 00:00:00 GMT bltf897adb4e814d8b4 BRONZE SANDCASTLE deploys modified Meterpreter shells https://www.sophos.com/en-us/blog/bronze-sandcastle-deploys-modified-meterpreter-shells The China-based threat group uses DLL sideloading in these attacks

]]> Tue, 20 Oct 2026 00:00:00 GMT blt7d3642827934f9d6 Why Incident Response Demand Will Grow Faster than Expected https://www.sophos.com/en-us/blog/why-incident-response-demand-will-grow-faster-than-expected A perspective on AI-enabled attacker scale, defender capacity, and the growing need for experienced responders.

]]> Tue, 20 Oct 2026 00:00:00 GMT bltae407484de261c2f Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion https://www.sophos.com/en-us/blog/graph-reconnaissance-and-servicenow-user-enumeration-in-a-modern-identity-intrusion No novelty required to be effective

]]> Mon, 19 Oct 2026 00:00:00 GMT blt3ac1e6583a6248d6 ConnectWise Cloud Backup application abused in cross-tenant token sweep https://www.sophos.com/en-us/blog/connectwise-cloud-backup-application-abused-in-token-sweep Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants

]]> Mon, 19 Oct 2026 00:00:00 GMT blta719c8e904949312