Research Deep Dives · 2026-W45
Strategic analyses
In-depth analyses from the Auto-CTI pipeline: full-text articles from vendor and researcher blogs, summarised by Claude Sonnet and annotated with key findings for your stack. Click a card for the unabridged version.
Week 46
09 Nov – 15 Nov 2026Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)
Microsoft addressed a total of 1,260 vulnerabilities in November 2026, 68 of which are rated critical. 167 of these vulnerabilities are Chromium issues affecting Microsoft Edge. An Outlook spoofing vulnerability (CVE-202
Update Chrome now to fix a flaw attackers are exploiting
Google released a security update for Chrome on November 9. The update fixes nine vulnerabilities, including an actively exploited zero-day tracked as CVE-2026-125350. This vulnerability is a high severity use-after-free
Week 45
02 Nov – 08 Nov 2026Virtualization security: attack layers and misconfiguration impact
The key insight is that virtualization security depends heavily on identity and monitoring hygiene, and compromised monitoring access can expose the ESXi administration plane.
How Adversaries Are Turning the Vulnerability Ecosystem Against Defenders
The report shows that the window between patch release and a working exploit for edge devices is often down to hours or a few days, so the patch cycle alone is no longer a reliable protection threshold.
Week 44
26 Oct – 01 Nov 2026From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
The attack shows how an AD CS misconfiguration (ESC1/ESC8) turns a simple help desk call into durable certificate-based authentication that survives password resets.
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
In the third quarter of 2026, phishing remained the most common initial access vector but fell to just over one third of incident response engagements. Voice phishing attacks increased, with actors impersonating IT help
NIK C2: The new AI-enabled command-and-control framework
NIK C2 shows attackers integrating generative AI directly into the C2 channel to automatically analyze harvested data and lower operational costs.
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
The October 2026 Patch Tuesday report documents 1,413 CVEs, including three zero-day vulnerabilities and 75 critical vulnerabilities. For Joel Traber AG, a manufacturing company in the DACH region, this creates heightene
Week 43
19 Oct – 25 Oct 2026Infostealer riding the AI Train
The analysis shows an infostealer distributed via AI-themed lures that specifically collects browser credentials, clipboard contents, and screenshots , an example of using current trends as bait.
The Current Landscape of OAuth Attacks
OAuth attacks are not classic malware attacks; they abuse trust in cloud apps and tokens, giving attackers long-lived access to M365 data without a password.
Compromised eMudhra intermediate certificates
Cisco Talos identified eight compromised intermediate certificates belonging to the certificate authority eMudhra. Due to a flaw in the key generation process, the private keys were generated with only 3 to 8 bits of ent
Week 42
12 Oct – 18 Oct 2026Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Unit 42 has discovered a stealthy FortiGate implant named PEERSTITCH. This malware appears to be distributed via a vulnerability in FortiManager (CVE-2024-47575) and allows attackers persistent access to firewalls. For m
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Phishing kits and cloud-environment credentials are traded as industrialised goods on a Chinese-language marketplace, so the exposed surface lies less in own code than in hardening identities and mail access.
The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk
The case shows that a months-long, technically simple attack via VPN brute-force and a WSUS RCE can succeed when foundational identity and software-distribution controls are weak.
Microsoft Patch Tuesday for October 2026 , Snort rules and prominent vulnerabilities
Of the 1415 flaws fixed in October, only a single one has already been exploited in the wild, while 85 are rated critical , prioritisation therefore follows the flaws marked as likely to be exploited and those already ob
12th October , Threat Intelligence Report
The report is a roundup; the only immediately stack-relevant item is the critical Veeam RCE, while the other reports mainly provide situational awareness and supply-chain context.
Week 39
21 Sept – 27 Sept 2026No more deep dives.