Corelight Labs found CVE-2026-70111 while fuzzing DFS APIs: A one-packet kernel crash that kills any affected Windows Server immediately.
Explore how existing Zeek logs can reveal suspicious NetScaler DTLS traffic associated with CVE-2026-88772, with practical searches and investigation...
Inside the Black Hat USA NOC, we found cleartext Splunk and BigFix traffic, leaky apps, and an exposed MCP server with read and write access.
See what a SOC agent does when it has real network forensics expertise behind it, from hypothesis to IDS alerts, timeline, and next steps.
Learn how to use Zeek logs and Corelight Investigator to discover Citrix NetScaler assets, monitor DTLS traffic, and hunt for zero-day exploitation...
PQC will make handshakes chunkier and cipher names weirder. What the migration changes for defenders, and why encrypted-traffic visibility still wins.
Corelight's Natural Language Query (NLQ) turns plain-English questions into working queries and runs them against your Investigator data in seconds.
Learn how Canada’s Bill C-8 raises cybersecurity requirements for critical infrastructure and why high-fidelity network evidence is essential.
The water-system attacks needed little OT expertise, but securing OT isn't simple. Why the evidence you collect before a disruption matters most.