Sophos Blogs https://www.sophos.com/en-us/blog Latest blog posts and insights from Sophos en-us Is “SIEM-less” really what it sounds like? https://www.sophos.com/en-us/blog/is-siem-less-really-what-it-sounds-like SIEM-less security may sound like an escape from traditional SIEM complexity and costs, but the underlying capabilities still have to exist somewhere.

]]> Fri, 23 Oct 2026 00:00:00 GMT blt54c34dbcdf3368b2 Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619 Wed, 21 Oct 2026 00:00:00 GMT bltf897adb4e814d8b4 Web App Owners – You’re on Notice. Your Low-Hanging Fruit Just Got Lower https://www.sophos.com/en-us/blog/web-app-owners-your-low-hanging-fruit-just-got-lower Recent incident response investigations reveal how AI-assisted attackers are chaining web application vulnerabilities, credential theft, privilege escalation, and lateral movement into autonomous intrusion workflows.

]]> Wed, 21 Oct 2026 00:00:00 GMT blt87532768bfb186dd BRONZE SANDCASTLE deploys modified Meterpreter shells https://www.sophos.com/en-us/blog/bronze-sandcastle-deploys-modified-meterpreter-shells The China-based threat group uses DLL sideloading in these attacks

]]> Tue, 20 Oct 2026 00:00:00 GMT blt7d3642827934f9d6 Why Incident Response Demand Will Grow Faster than Expected https://www.sophos.com/en-us/blog/why-incident-response-demand-will-grow-faster-than-expected A perspective on AI-enabled attacker scale, defender capacity, and the growing need for experienced responders.

]]> Tue, 20 Oct 2026 00:00:00 GMT bltae407484de261c2f Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion https://www.sophos.com/en-us/blog/graph-reconnaissance-and-servicenow-user-enumeration-in-a-modern-identity-intrusion No novelty required to be effective

]]> Mon, 19 Oct 2026 00:00:00 GMT blt3ac1e6583a6248d6 ConnectWise Cloud Backup application abused in cross-tenant token sweep https://www.sophos.com/en-us/blog/connectwise-cloud-backup-application-abused-in-token-sweep Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants

]]> Mon, 19 Oct 2026 00:00:00 GMT blta719c8e904949312 Sophos ITDR expands identity protection for the AI era https://www.sophos.com/en-us/blog/sophos-itdr-ai-protection Sophos ITDR now delivers deeper AI identity visibility, expanded Microsoft support, faster response, and seamless deployment.

]]> Thu, 15 Oct 2026 00:00:00 GMT bltb786fd4b1083f522 Show, don’t tell: Sophos AI at CAMLIS https://www.sophos.com/en-us/blog/show-dont-tell-sophos-ai-at-camlis The Sophos AI team presents a novel technique for calibrating agentic SOC analysts

]]> Wed, 14 Oct 2026 00:00:00 GMT bltb5c15dfc5c4c7e75