Coalition Security

Was PHP2Shell overhyped? 🤔 Just because the claims aren't rolling in doesn't mean we're in the clear. Learn why the claims curve tracks behind the exploit curve for weeks: bit.ly/4zrQk63

Insurers using point-in-time questionnaires for cyber underwriting will struggle to face the worsening threat landscape. Daniel Woods explained why ongoing prevention and protection in addition to risk transfer is needed in @DarkReading. bit.ly/4e2tdq3

The refrigeration controllers that were hacked in French supermarkets had vulnerabilities that were exploitable for months before the attacks. 🥦🍗🥩 @Balgan shared what our scans showed after a patch became available in August. bit.ly/4z3iJ1X

We're excited to congratulate Chris Clark on his promotion to CISO! 🎉 Chris reflected on his efforts to uphold our mission of protecting the unprotected while balancing security decisions without adding too much friction for users: bit.ly/4jultRb

Over the weekend, we began alerting at-risk policyholders to two Citrix NetScaler zero-day vulnerabilities following unconfirmed reports of active exploitation from reliable sources. All details can be found here: bit.ly/4jvCBpu

⚠️ Two vulnerabilities in WordPress Core can be chained together to achieve unauthenticated remote code execution. Coalition notified all impacted policyholders 24 hours before active exploitation began. Learn more: bit.ly/4psyETr

We’re very excited to head to Black Hat USA with our Wirespeed team. 🎩 If you’re headed to the cybersecurity conference, stop by booth 4700 to see how Wirespeed Automated Detection & Response catches threats and contains them in milliseconds.

“That’s when an alarm bell went off: Why would an IT person need to check in with reception?” CIR Director Leeann Nicolo shared anecdotes with CNN from responding to incidents at law firms over the past year where physical access was involved. bit.ly/440zQnn

Can you get a perfect score on this ransomware simulator? 💯 Our Head of Coalition Incident Response shared his experiences responding to ransomware attacks with @ITBrew. You can catch a couple of his quotes throughout the simulation. Test yourself: bit.ly/4vaN2lw

⚠️ There's a critical vulnerability in cPanel that allows remote attackers to bypass authentication and gain root access on the WebHost Manager (WHM).  Get all the details on what's happening, who's at risk, and how you should address this vulnerability: bit.ly/4unV3T8

Ransom demands went up in 2025, but 86% of our policyholders who experienced a ransomware incident refused to pay. Our incident response lead explains why organizations have gained more leverage against ransomware groups. bit.ly/4s7EhGB

⚠️ Citrix NetScaler is once again vulnerable due to two critical flaws that allow unauthenticated remote attackers to bypass multi-factor authentication (MFA) by siphoning active session tokens directly from the device’s memory. Get all the details: bit.ly/4dJ8W9t

We don't want to add to the noise of your security alerts if vulnerabilities aren't critical. That's why we only send ZDAs for the most critical and time-sensitive threats. Explore how we get ahead of CISA's KEV catalog and how our alerting process works: bit.ly/3PuRw6s

We're sharing our observations and real reconnaissance patterns that threat actors in the Middle East are using to target organizations around the world. Review what we're seeing and the steps organizations should prioritize to reduce risks: bit.ly/40VS7kh

Most MDR providers operate at human speed in a world where threat actors operate at machine speed. 🤖⚡ It's not fast enough. @⚡wirespeed by Coalition uses automation to identify, isolate, and contain digital threats with lightning-fast speed.

⚠️Security Alert⚠️ Threat actors are actively exploiting misconfigured guest user permissions in Salesforce Experience Cloud to exfiltrate sensitive CRM data via the Aura API endpoint. Get more details on what's happening and how to can address the risk: bit.ly/4bExIWP

Simulated attacks test cyber defenses in preparation for real attacks, but they can also create some unnecessary noise for SOC analysts. Learn how Wirespeed integrates with SafeBreach to positively confirm attack simulations and close them out: bit.ly/4cF39RW

There are too many preventable security failures from legacy hardware security providers. Read about what we can do as a community of partners, policyholders, and cybersecurity practitioners to move beyond accepting preventable failures: bit.ly/4ar0fgQ

Threat actors ❤️ business inboxes. They're an attractive target for stealing data, money, and exploiting other technologies. Get tips on how to protect your business email: bit.ly/4r3P7xB

Hear firsthand how our Wirespeed automation-first MDR works alongside MSPs and MSSPs to help protect shared clients from cyber incidents. Attend the LinkedIn Live event for a candid discussion among Wirespeed cofounders and one of our MSSP partners: bit.ly/49VL4gz