Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

cato networks

Cato CTRL Threat Research: PHP2Shell Exploitation Attempts in the Wild, and How Cato IPS Blocked Them

Oct 30, 2026 By Dr. Guy Waizel In Cato Networks
On 21 October 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, a pair of critical runtime vulnerabilities known as PHP2Shell. One day later, we described how our self-evolving CVE mitigation agent turned the patch into reviewed IPS protection in minutes. This report follows what happened next, including how quickly attackers moved, what their attempts looked like, and how Cato’s cloud-delivered IPS protection blocked them on inspected customer traffic.
Read Post
cato networks

Cato CTRL Threat Brief: eMudhra Certificate Compromise Highlights the Value of Protection Delivered by an AI-Native SASE Platform

Oct 29, 2026 By Dr. Guy Waizel In Cato Networks
Eight eMudhra intermediate certificate authority (CA) private keys were compromised after being generated with insufficient randomness. Attackers could use these keys to forge certificates and impersonate legitimate websites or services to clients that still trust them. An attacker able to intercept a connection could potentially read or modify sensitive traffic.
Read Post
cato networks

See the Real AI Experience with Cato DEM

Oct 29, 2026 By Makiko Yamada In Cato Networks
AI is becoming part of everyday work. Employees rely on services such as ChatGPT and Claude to research, create, and solve problems, while developers increasingly use AI-powered tools like Cursor and coding agents in their development workflows. As employees increasingly rely on AI to work more productively, the AI experience is becoming a critical part of the digital experience IT teams are expected to support.
Read Post
cato networks

Cato AI Endpoint secures browser AI, desktop AI and coding agents on every endpoint

Oct 27, 2026 By Amad Hussain In Cato Networks
AI used to live in a browser tab. Today it also runs inside the apps employees use every day, like Copilot in Word, in dedicated apps like ChatGPT and in coding agents such as Claude Code, Codex and Cursor. Coding agents work differently from chat apps. A chat app answers a question and waits. A coding agent is given tools and takes actions on its own, with the developer’s access. So every endpoint is becoming an agentic endpoint.
Read Post
cato networks

Cato CTRL Threat Brief on Attacks Against Refrigeration Controllers

Oct 26, 2026 By Dr. Guy Waizel In Cato Networks
CERT-FR’s October 13 update reports compromises of refrigeration controllers, naming Danfoss AK-SM and AK-SC alongside Copeland/Dixell XWEB systems. The entry methods remain unconfirmed. CERT-FR warns that attacks are probably continuing and recommends removing public exposure, checking configurations, and securing remote access. Compromised operational technology (OT) can disrupt cooling, compromise stored products, and threaten cold-chain continuity.
Read Post
cato networks

Cato CTRL Threat Brief: Cato AI native SASE delivers PHP2Shell protection at machine speed

Oct 22, 2026 By Dr. Guy Waizel In Cato Networks
On 21 October 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities known as PHP2Shell that can enable unauthenticated remote code execution. Cato’s self-evolving CVE mitigation agent helped turn the investigation into concrete research output by creating a proof of concept and generating an IPS signature in minutes. The agent connects vulnerability analysis, controlled lab testing and protection generation.
Read Post
cato networks

Make Your SIEM Smarter with Cato

Oct 21, 2026 By Makiko Yamada In Cato Networks
Effective security operations require more than isolated alerts. Analysts need context from across the environment to understand what happened, assess its significance, and decide what to do next. That is why accessing insights and telemetry from across your networking and security stack is critical to teams using a SIEM tool.
Read Post
cato networks

Stop Guessing. Find the Root Cause with Cato DEM.

Oct 20, 2026 By Makiko Yamada In Cato Networks
When a user says, “the application is slow,” IT has to answer a much harder question: where did the problem actually begin? The issue could be on the endpoint, local network, ISP, the network path, enterprise infrastructure, or application provider itself. That investigation often takes time because teams have to reproduce intermittent problems, collect evidence from separate tools, and hand cases between endpoint, network, and application owners.
Read Post

Cato DEM Root Cause Analysis: Find What's Slowing Down Your Applications

Oct 19, 2026 By Cato Networks In Cato Networks
When users report slow application performance, where do you start troubleshooting? The Wi-Fi, ISP, network, or application itself? With Cato Digital Experience Monitoring (DEM), IT teams can move beyond guesswork and identify the root cause of performance issues using evidence from across the user-to-application path. In this demo, a user reports slow Zoom performance at a branch location. Watch how Cato DEM Root Cause Analysis investigates the issue, examines latency, jitter, and packet loss, and identifies the branch wireless LAN as the source of the slowdown. See how Cato DEM helps IT teams.
View Video
cato networks

Beyond Deployment: Evaluating the Operational Impact of an SD-WAN Refresh

Oct 14, 2026 By Amad Hussain In Cato Networks
Many SD-WAN refreshes start with an expiring contract or edge equipment reaching end of life. But replacing the edge should not be the measure of success. For network and infrastructure leaders, the real test is what improves after the refresh. Will the refresh put IT on another appliance cycle, or move the WAN to a cloud service? Can IT keep critical applications performing consistently? Can the WAN respond when network conditions change?
Read Post
cato networks

Why AI Red Teaming Belongs at the Core of Your AI Security Program

Oct 13, 2026 By Liron Hakim Bobrov In Cato Networks
Enterprises are putting AI applications and agents to work on sensitive data and business workflows, while attackers look for new ways to manipulate the models and exploit the tools connected to them. Security leaders need to know whether those systems will hold up against a real attack, and AI red teaming gives them that answer by testing AI the way an attacker would.
Read Post

Cato AI Red Teaming: Find AI Model Risks Before Attackers Do

Oct 13, 2026 By Cato Networks In Cato Networks
AI-powered applications depend on the models behind them, and those models keep changing. New attack techniques appear every day, model updates can change how safeguards behave, and switching models can leave existing protections behind. Security teams need to know where their AI is exposed before an attacker finds out first.
View Video
cato networks

Stopping destructive commands in AI agents

Oct 12, 2026 By Liron Hakim Bobrov In Cato Networks
An engineer gives a coding agent a routine task: clean up an old test deployment. The request sounds harmless, and the environment is cluttered with unused cloud resources, stale branches, and temporary credentials that should have been removed weeks ago. The agent gets to work. It lists resources, identifies old infrastructure, and finds a deployment command. Then it sees a naming pattern that appears to connect the test environment to production.
Read Post
cato networks

Wait, Did We Just Invent Classifiers Again? Introducing Jev, a new way to do AI.

Oct 8, 2026 By Robin Johns In Cato Networks
For the last few years, when somebody says “AI,” what they are usually referring to is a Large Language Model, or LLM for short. You chuck some text in, it has a think, and it gives you some more text back. This is brilliant if you want code written, documents summarised, or quantum physics explained to you in a limerick, but while this is great for humans, most software doesn’t actually want a beautifully written paragraph. Software just wants an answer so it can make a decision.
Read Post
cato networks

Beyond Model Access: Frontier AI Defense Needs Runtime Prevention

Oct 8, 2026 By Sangita Patel In Cato Networks
Access to powerful AI models is opening new possibilities for cybersecurity. Models can help uncover weaknesses, investigate threats, and explore how attackers might break into an environment. Using several models can bring different strengths to that work. But model access alone does not answer a critical question: can your defense stop an attack while it is happening? In the frontier AI era, discovery needs to connect to action.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.