Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In response to requests, this update consolidates the Sophos countermeasures that relate the PHP2Shelll vulnerabilities. SophosLabs has developed the following countermeasures to specifically detect activity associated with this threat. The next table lists additional pre-existing Sophos countermeasures that will likely address post-exploitation activity associated with these vulnerabilities.

Recent incident response investigations reveal how AI-assisted attackers are chaining web application vulnerabilities, credential theft, privilege escalation, and lateral movement into autonomous intrusion workflows. This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI-era threats.

This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI-era threats. A 20% growth forecast for cybersecurity talent sounds significant. I believe it understates what we are going to see in Incident Response. The U.S.

The China-based threat group uses DLL sideloading in these attacks Counter Threat Unit (CTU) and SophosLabs researchers investigated a cluster of incidents attributed to the BRONZE SANDCASTLE threat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading.

Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants On October 15, 2026, Sophos X-Ops researchers identified a series of service principal sign-ins in which a threat actor authenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants.

Traditional business email compromise (BEC) is often thought of as a mailbox problem: a stolen account, unauthorized access to email, forwarding rules, and (sometimes) outgoing mail impersonating the compromised user. But more recent incidents show how far beyond “email only” these intrusions can extend once an attacker gains control of a cloud identity.

Sophos ITDR now delivers deeper AI identity visibility, expanded Microsoft support, faster response, and seamless deployment. Identity has become one of the most targeted attack surfaces in cybersecurity, with attackers increasingly relying on stolen credentials, compromised sessions, excessive privileges, and identity misconfigurations to gain access.