Buyer’s guide compares 12 incident response retainer services
The review weighs SLAs, unused-hour conversion, onboarding and post-acquisition ownership rather than responder reputation alone.
24
Organization
Mandiant
- Mentions · 7d10
- Mentions · 30d47
- All mentions107
- First seenAug 17, 2026
- Last mentioned1d ago
Timeline
107 articles · newest firstBuyer's guide ranks 12 DFIR firms; Coveware now under Veeam
The guide matches firms to breach lanes and flags Coveware's acquisition by Veeam as a procurement issue.
22
2026 ranking puts Recorded Future first among CTI providers
Mandiant and CrowdStrike place second and third; Kaspersky is flagged as jurisdiction-gated for Western buyers.
17
2026 buyer’s guide compares 12 SIEM platforms
The guide stresses pricing fit and ownership changes, including QRadar’s split lanes and Splunk under Cisco.
17
CISA lists VMware ESX logging flaw exploited by Warp Panda
CVE-2026-41709 lets an admin skip some logs; federal agencies must patch by November 11, 2026.
74
Attackers probe patched Oracle EBS bug; PeopleSoft zero-day is three flaws
ShinyHunters used CVE-2026-35273 for theft and extortion; ZDI says Oracle bundled three PeopleSoft bugs under one CVE.
82
ShinyHunters PeopleSoft zero-day is three flaws under CVE-2026-35273
Unauthenticated SSRF to the loopback-trusted admin hub yields code execution on PeopleTools 8.61 and 8.62.
82
ShinyHunters mass-exploits PeopleSoft SSRF-to-RCE bug CVE-2026-35273
A gateway request forgery can satisfy localhost trust checks and reach a file-write path to code execution.
84
PHP2Shell attempts preceded same-week patches for PHP, GitLab and Node.js
GitLab’s unauthenticated RCE is CVSS 10.0 back to version 7.0; LiteLLM 1.107.0 stole credentials and OpenCode keys may have leaked.
84
CSO ranks incumbent security vendors adapting to AI threats
Palo Alto’s Prisma AIRS hit $100 million ARR, and the company bought CyberArk for $25 billion.
22
Third PHP2Shell bug waits for the regular PHP release
CVE-2026-115560 needs a rare session setup; the foundation reports no confirmed compromises of the two bugs patched Wednesday.
72
Attackers hide command and control in trusted cloud services
Cited cases include Gridtide on Google Sheets, SesameOp via OpenAI APIs, and a reported Intune wipe at Stryker.
34
AOMEI Backupper update servers briefly hijacked to push a backdoor
Tampered configs sent Backupper 8.3.0 and later a dropper that installed Radmin and SHINYROAD.
78
AOMEI Backupper updates briefly served malware in 2026
UNC7017 used five-to-ten-minute windows to deliver CrossRoad and the ShinyRoad backdoor to anyone fetching packages.
78
UNC7017 hijacks AOMEI updates for minutes to plant backdoors
Tampered update configs in brief windows between April and July 2026 could leave CROSSROAD and SHINYROAD after the servers were fixed.
76
AOMEI update servers briefly served CROSSROAD and SHINYROAD malware
UNC7017 altered promotion configs for minutes in May and July so Backupper ran malware without user action.
74
BeyondTrust Remote Support auth bypass CVE-2026-102764 exploited before disclosure
Unauthenticated attackers can perform file operations on Remote Support 26.2.3 and earlier; CISA set a October 19 KEV due date.
84
Weekly recap: BeyondTrust zero-day, ConnectWise access, Ledger thefts
Armory Castle used CVE-2026-102764 for file operations, then planted SAWFLY and BARECLAW on a few victims.
78
Exploited NetScaler flaws allow command execution before login
CVE-2026-88771 works without authentication, including on default configurations; CVE-2026-88772 involves DTLS.
82
UNC5820 used Fortinet zero-days to plant PeerStitch at a telecom
CISA added CVE-2025-61624 to KEV; the memory-only implant rides legitimate FortiGate process traffic.
84
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Attackers used a compromised ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 tenants.
80
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and deployed the SAWFLY webshell.
88
Prolific Chinese espionage group exploits BeyondTrust zero-day
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 starting in late August.
84
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
UNC7017 briefly tampered with AOMEI Backupper updates to install the SHINYROAD backdoor on polling hosts.
78
Your AI Agent Doesn’t Have MFA
Report says AI agents lack MFA and have already misused credentials and spread malware.
66
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
Chinese espionage group Armory Castle is exploiting BeyondTrust Remote Support zero-day CVE-2026-102764.
86
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
CISA says attackers are exploiting critical BeyondTrust Remote Support flaw CVE-2026-102764, now on KEV.
86
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
China-linked Armory Castle exploited BeyondTrust Remote Support CVE-2026-102764 as a zero-day since August.
84
BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert
Chinese espionage group Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 for root and credential-vault access.
88
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
China-nexus UNC5221 exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and wiped logs.
86
BeyondTrust 0-Day Vulnerability Exploited Since August to Gain Full Admin Access in Minutes
Attackers exploited BeyondTrust Remote Support zero-day CVE-2026-102764 from August to gain full admin access.
86
Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors
China-linked ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 for root access and persistent backdoors.
86
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 to seize support appliances.
86
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust patched CVE-2026-102764, a Remote Support authentication bypass exploited since August by China-linked Armory Castle.
87
Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access
China-linked ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 for root access before disclosure.
84
ARMORY CASTLE Exploits BeyondTrust
Suspected China-nexus group ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 to steal appliance credentials.
82
Investigating Ephemeral Supply Chain Tampering
UNC7017 briefly hijacked AOMEI updates to deliver CROSSROAD and SHINYROAD malware.
82
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Huntress mapped an Akira ransomware intrusion that used RDP, LSASS dumping, GOST tunneling, and RClone.
55
FBI Removes Accenture Contractor After Unpatched PeopleSoft Flaw Exposes Thousands of Employees
FBI removed an Accenture contractor after an unpatched Oracle PeopleSoft HR system exposed thousands of employees' sensitive personal data.
75
FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach
The FBI removed an Accenture contractor after a missed PeopleSoft patch let ShinyHunters steal thousands of employees' data.
84
Related CVEs
by mentions- CVE-2026-3527397%9.8Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools
- CVE-2026-8877278%9.5Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
- CVE-2026-8877182%9.5Unauthenticated RCE in Citrix NetScaler ADC and Gateway
- CVE-2026-10276419%9.3Message-origin spoofing enables file ops on BeyondTrust Remote Support
- CVE-2024-21887100%9.1Command Injection RCE in Ivanti Connect Secure and Policy Secure
- CVE-2025-0282100%9.0Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways
- CVE-2023-46805100%8.2Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
- CVE-2023-4966100%7.5Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway
- CVE-2026-2276914%10.0Hard-coded credentials in Dell RecoverPoint for Virtual Machines allow root OS access
- CVE-2026-173193%9.9Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA
Appears with
- Google Threat Intelligence Grouporganization · 36
- ShinyHuntersthreat actor · 20
- Googlevendor · 20
- Googleorganization · 19
- CISAorganization · 18
- Armory Castlethreat actor · 16
- Citrixvendor · 16
- BeyondTrustvendor · 15
- BeyondTrust Remote Supportproduct · 13
- UNC5221threat actor · 13
- FBIorganization · 12
- Sawflymalware · 12
- Oraclevendor · 11
- SlowMistorganization · 11
- Bareclawmalware · 11
- Bitgetorganization · 10
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.