Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In short: By default, Microsoft Configuration Manager (SCCM) refreshes hardware inventory every seven days, and clients check for new policy every 60 minutes. Shortening those intervals adds load and is still polling. Real-time endpoint management needs an architecture built for it, not a faster schedule. Ask most endpoint teams how current their view of the estate is, and the honest answer is: it depends when the last cycle ran. That isn't a criticism of the people running Configuration Manager.

October has made a strong case for this year’s Cybersecurity Awareness Month (opens in a new tab) theme, “Securing the Next 250,” chosen in honor of the U.S.’s 250th anniversary. The initiative, started by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA), occurs annually in October to raise awareness about online safety and empower individuals and businesses to protect themselves from cybercrime.

Learn how Tanium turned a bug hidden inside other software into a fleet-wide answer, a tested Tanium Atlas hunt and lab-proven detection guidance within a day of the flaw's scope widening.

Learn how Tanium put a fleet-wide PHP inventory in every Tanium Cloud tenant about eight hours after PHP shipped its php2shell fix.

On October 17, 2026, a researcher reported that eight intermediate certificate authorities (CAs) run by eMudhra have private keys that anyone can calculate from the public certificates. Six of the CAs are for TLS (website) certificates and two are for code signing. Sectigo cross-signed the same eight keys, so 16 certificates are affected in total With these keys, anyone can issue a certificate for any website, or sign software, and it chains to root CAs that many systems trust.

If you run Node.js, update to 26.12.1, 24.22.1 or 22.23.4 now. If you run Python, upgrade the Brotli package to 1.2.1 and brotlicffi to 1.2.1.0. If you run Bun, move to 1.4.4. All three carry a fix for CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder that can let a remote, unauthenticated attacker crash a process, read its memory or potentially run code by sending it crafted compressed data. Google's CVE record scores it 9.2 under CVSS v4.0.