Red plus Blue makes Purple! on Purpleshifthttps://purpleshift.io/Recent content in Red plus Blue makes Purple! on PurpleshiftHugo -- gohugo.ioen© 2026Wed, 12 Aug 2026 00:00:00 +0000A key element of protection: how to effectively manage cybersecurity incidents?https://purpleshift.io/conf/2025/2025-11-14-vadim-nersesov/Fri, 14 Nov 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-11-14-vadim-nersesov/Inside BlackNevas: gaps, grief, and lessons learnedhttps://purpleshift.io/conf/2026/2026-03-14-eduardo-ovalle/Sat, 14 Mar 2026 00:00:00 +0000https://purpleshift.io/conf/2026/2026-03-14-eduardo-ovalle/C2 by Microsoft: What can go wrong if SCCM ends up in the wrong handshttps://purpleshift.io/conf/2025/2025-11-14-alexander-rodchenko/Fri, 14 Nov 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-11-14-alexander-rodchenko/Inside the Guts of Ransomwarehttps://purpleshift.io/conf/2026/2026-03-14-ashley-munoz/Sat, 14 Mar 2026 00:00:00 +0000https://purpleshift.io/conf/2026/2026-03-14-ashley-munoz/How to avoid turning your QA into just a testerhttps://purpleshift.io/conf/2026/2026-03-14-olga-kuznetsova/Sat, 14 Mar 2026 00:00:00 +0000https://purpleshift.io/conf/2026/2026-03-14-olga-kuznetsova/Cyber Polygon: Career Developmenthttps://purpleshift.io/conf/2025/2025-09-16-viktor-zvarykin/Tue, 16 Sep 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-09-16-viktor-zvarykin/Buying protection doesn’t mean being protectedhttps://purpleshift.io/conf/2025/2025-09-16-grigory-sablin/Tue, 16 Sep 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-09-16-grigory-sablin/Greybox fuzzing of embedded systems made simple: minimizing preparation with Qilinghttps://purpleshift.io/conf/2025/2025-08-22-nikita-proshin/Fri, 22 Aug 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-08-22-nikita-proshin/Hack The Air, or How to talk to the air without attracting the attention of the doctorshttps://purpleshift.io/conf/2025/2025-08-22-sergey-andreev/Fri, 22 Aug 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-08-22-sergey-andreev/Yet another way to dump LSASShttps://purpleshift.io/conf/2025/2025-08-22-georgy-kiguradze/Fri, 22 Aug 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-08-22-georgy-kiguradze/Silent Harvest: extracting Windows secrets under radarhttps://purpleshift.io/conf/2025/2025-08-22-khaydar-kabibo/Fri, 22 Aug 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-08-22-khaydar-kabibo/A Thousand and One Nights in Search of Indicators of Compromisehttps://purpleshift.io/conf/2025/2025-08-22-victor-sergeev/Fri, 22 Aug 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-08-22-victor-sergeev/Detection of ADCS ESC9-15 attackshttps://purpleshift.io/conf/2025/2025-08-22-dmitry-shchetinin-andrey-skablonsky/Fri, 22 Aug 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-08-22-dmitry-shchetinin-andrey-skablonsky/When the target is one and the attackers are many: competition for the victimhttps://purpleshift.io/conf/2025/2025-08-22-alina-sukhanova/Fri, 22 Aug 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-08-22-alina-sukhanova/Abusing SSH for fun and profit: Outlaw analysishttps://purpleshift.io/conf/2025/2025-06-03-cristian-souza/Tue, 03 Jun 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-06-03-cristian-souza/Foremost-NG: An Open-Source Toolkit for Advanced File Carving and Analysishttps://purpleshift.io/conf/2025/2025-06-03-cristian-souza-foremost-ng/Tue, 03 Jun 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-06-03-cristian-souza-foremost-ng/From entertainment to manipulation: The Dark Side of deepfakeshttps://purpleshift.io/conf/2025/2025-05-23-maxim-shmelev/Fri, 23 May 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-05-23-maxim-shmelev/Standard rules for non-standard sourceshttps://purpleshift.io/conf/2025/2025-05-23-nikolay-sovetkin/Fri, 23 May 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-05-23-nikolay-sovetkin/SOC architecture practices in the digital flood erahttps://purpleshift.io/conf/2025/2025-05-23-alexey-peshik/Fri, 23 May 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-05-23-alexey-peshik/Adventures of Red Team in SBC securityhttps://purpleshift.io/conf/2025/2025-05-22-alexander-makovsky/Thu, 22 May 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-05-22-alexander-makovsky/Flashy doesn't mean effectivehttps://purpleshift.io/conf/2025/2025-05-22-olga-zinenko/Thu, 22 May 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-05-22-olga-zinenko/bind_tcp_agent: a Mythic P2P bridge for TCP-based C2https://purpleshift.io/articles/2026-08-14-bindtcpagent/Wed, 12 Aug 2026 00:00:00 +0000https://purpleshift.io/articles/2026-08-14-bindtcpagent/How to bridge Mythic’s egress network with TCP-based P2P agents through an outbound connectionCertighost: a new vulnerability in Windows Serverhttps://purpleshift.io/purple/2026-08-11-mfjy/Tue, 11 Aug 2026 06:05:15 +0000https://purpleshift.io/purple/2026-08-11-mfjy/How to find out if your servers have been attackedHacker group Labooboo developed its own backdoorhttps://purpleshift.io/purple/2026-08-05-fnpg/Wed, 05 Aug 2026 09:13:01 +0000https://purpleshift.io/purple/2026-08-05-fnpg/New malware uses MQTT and Matrix protocols to talk to C2Detecting Certighost attackhttps://purpleshift.io/articles/2026-08-07-certighost/Wed, 05 Aug 2026 00:00:00 +0000https://purpleshift.io/articles/2026-08-07-certighost/A user with minimal privileges can gain control over the domainAttacks on Educationhttps://purpleshift.io/purple/2026-08-03-ozxe/Mon, 03 Aug 2026 18:00:42 +0000https://purpleshift.io/purple/2026-08-03-ozxe/Schools and universities are hacked through stolen accounts and outdated softwareTurning a TURN server into an evil proxyhttps://purpleshift.io/purple/2026-07-29-xfzo/Sun, 02 Aug 2026 00:00:00 +0000https://purpleshift.io/purple/2026-07-29-xfzo/A video conferencing relay host can redirect traffic to C2Our Incident Response talks at DEFCONhttps://purpleshift.io/purple/2026-07-30-lexa/Thu, 30 Jul 2026 00:00:00 +0000https://purpleshift.io/purple/2026-07-30-lexa/Guts of ransomware, Bitlocker abuse, and a workshop on investigative skillsPrivilege escalation through trusts in ADhttps://purpleshift.io/purple/2026-07-10-dqoo/Tue, 28 Jul 2026 00:00:00 +0000https://purpleshift.io/purple/2026-07-10-dqoo/Trust relationships between domains facilitate various attacksActive Directory Trust Relationship Attackshttps://purpleshift.io/articles/2026-07-09-trusts/Mon, 27 Jul 2026 00:00:00 +0000https://purpleshift.io/articles/2026-07-09-trusts/Our lab environment examples show how to get info about domains and elevate privilegesHeartlessSoul APT uses blockchain to hide C2https://purpleshift.io/purple/2026-07-24-offj/Fri, 24 Jul 2026 05:47:11 +0000https://purpleshift.io/purple/2026-07-24-offj/Command & control addresses are transmitted in BNB Smart Chain and Solana transactionsHow BitLocker becomes ransomwarehttps://purpleshift.io/purple/2026-07-21-olgs/Tue, 21 Jul 2026 13:23:01 +0000https://purpleshift.io/purple/2026-07-21-olgs/Incidents in Latin America show how secure configuration could prevent encryptionExtracting secrets from Octopus Deployhttps://purpleshift.io/purple/2026-07-16-gelw/Thu, 16 Jul 2026 03:51:24 +0000https://purpleshift.io/purple/2026-07-16-gelw/Attackers can get valuable data even if they don’t have access to the web version of the toolLeaks through Claude Code and other missed incidentshttps://purpleshift.io/purple/2026-07-02-rbcn/Thu, 02 Jul 2026 09:05:02 +0000https://purpleshift.io/purple/2026-07-02-rbcn/Our Compromise Assessment service report features such a hidden threat as generative AILarge-scale attack via stealthy ScreenConnect installationhttps://purpleshift.io/purple/2026-07-01-elbb/Wed, 01 Jul 2026 10:03:44 +0000https://purpleshift.io/purple/2026-07-01-elbb/Users receive attackers’ remote access tool along with popular freewareGhost in the RAM: weaponizing memfd_create() for fileless attackshttps://purpleshift.io/purple/2026-06-29-onsd/Mon, 29 Jun 2026 04:55:19 +0000https://purpleshift.io/purple/2026-06-29-onsd/How to detect malware that runs on Linux systems without writing on diskWeb shells in backups: natural persistencehttps://purpleshift.io/purple/2026-06-25-ppmu/Thu, 25 Jun 2026 09:52:43 +0000https://purpleshift.io/purple/2026-06-25-ppmu/Some stats on threats found in backups during compromise assessmentNTLM Reflection attack: when it workshttps://purpleshift.io/purple/2026-06-23-qjdo/Tue, 23 Jun 2026 05:41:05 +0000https://purpleshift.io/purple/2026-06-23-qjdo/Under what conditions can a non-domain Windows host be compromisedHacker group VasyGrek expands its arsenalhttps://purpleshift.io/purple/2026-06-17-rjjv/Wed, 17 Jun 2026 06:19:48 +0000https://purpleshift.io/purple/2026-06-17-rjjv/New attacks use .vbs droppers, .com droppers, and .com stealer written in RustMalicious Network Provider DLL allows stealing credentialshttps://purpleshift.io/purple/2026-06-15-ckcn/Mon, 15 Jun 2026 04:59:33 +0000https://purpleshift.io/purple/2026-06-15-ckcn/Registration of a malicious provider can be detected in ProviderOrder and ProviderPath parametersVulnerable PackageKit gives attacker root accesshttps://purpleshift.io/purple/2026-06-09-rsgr/Tue, 09 Jun 2026 05:00:12 +0000https://purpleshift.io/purple/2026-06-09-rsgr/Detecting privilege escalation in Linux through TOCTOU vulnerabilityExtending IDA Pro: а guide for reverse engineershttps://purpleshift.io/purple/2026-03-03-lgyh/Fri, 05 Jun 2026 00:00:00 +0000https://purpleshift.io/purple/2026-03-03-lgyh/What if your decompiler doesn’t support some RISC-V instructionsMiniPlasma: detecting a dangerous exploit from Nightmare Eclipsehttps://purpleshift.io/purple/2026-06-03-hojr/Wed, 03 Jun 2026 08:40:12 +0000https://purpleshift.io/purple/2026-06-03-hojr/A 2020 vulnerability still allows a local user to elevate privileges to SYSTEMTeaching IDA Pro to understand the RISC-V P Extensionhttps://purpleshift.io/articles/2026-06-02-risc_v/Tue, 02 Jun 2026 00:00:00 +0000https://purpleshift.io/articles/2026-06-02-risc_v/How we make IDA Pro decode, interpret, and lift previously unsupported CPU instructionsCVE-2026-26980 | Ghost CMS | SQLhttps://purpleshift.io/avl/2026/cve-2026-26980-_-ghost-cms-_-sql/Mon, 01 Jun 2026 00:00:00 +0000https://purpleshift.io/avl/2026/cve-2026-26980-_-ghost-cms-_-sql/CVE-2026-32202 | Windows | Protection Mechanism Failurehttps://purpleshift.io/avl/2026/cve-2026-32202-_-windows-_-protection-mechanism-failure/Mon, 01 Jun 2026 00:00:00 +0000https://purpleshift.io/avl/2026/cve-2026-32202-_-windows-_-protection-mechanism-failure/CVE-2026-34926 | Trend Micro Apex One | PThttps://purpleshift.io/avl/2026/cve-2026-34926-_-trend-micro-apex-one-_-pt/Mon, 01 Jun 2026 00:00:00 +0000https://purpleshift.io/avl/2026/cve-2026-34926-_-trend-micro-apex-one-_-pt/CVE-2026-41091 | Microsoft Defender | EoPhttps://purpleshift.io/avl/2026/cve-2026-41091_-microsoft-defender_-eop/Mon, 01 Jun 2026 00:00:00 +0000https://purpleshift.io/avl/2026/cve-2026-41091_-microsoft-defender_-eop/CVE-2026-42897 | Exchange | XSShttps://purpleshift.io/avl/2026/cve-2026-42897-_-exchange-_-xss/Mon, 01 Jun 2026 00:00:00 +0000https://purpleshift.io/avl/2026/cve-2026-42897-_-exchange-_-xss/CVE-2026-44277 | FortiAuthenticator | RCEhttps://purpleshift.io/avl/2026/cve-2026-44277_-fortiauthenticator_-rce/Mon, 01 Jun 2026 00:00:00 +0000https://purpleshift.io/avl/2026/cve-2026-44277_-fortiauthenticator_-rce/Privilege escalation on SCCM undetected by antiviruseshttps://purpleshift.io/purple/2026-05-26-kklj/Tue, 26 May 2026 06:10:17 +0000https://purpleshift.io/purple/2026-05-26-kklj/Vulnerability CVE-2025-47179 allows for full control over SCCMFrom RCE on a controller to domain adminhttps://purpleshift.io/purple/2026-05-21-hyci/Thu, 21 May 2026 04:17:22 +0000https://purpleshift.io/purple/2026-05-21-hyci/An interesting experience in solving a pentesting taskRole-playing games: when SCCM turns into C2https://purpleshift.io/articles/2026-05-22-sccm/Thu, 21 May 2026 00:00:00 +0000https://purpleshift.io/articles/2026-05-22-sccm/Catching exploitation of a vulnerability that antiviruses don’t seeNetNTLM hashes leak through Snipping Toolhttps://purpleshift.io/purple/2026-05-18-nkdw/Mon, 18 May 2026 04:50:21 +0000https://purpleshift.io/purple/2026-05-18-nkdw/How to prevent exploitation of a vulnerability in a popular image editing toolCVE-2026-42945 | NGINX | HOhttps://purpleshift.io/avl/2026/cve-2026-42945-_-nginx-_-ho/Thu, 14 May 2026 00:00:00 +0000https://purpleshift.io/avl/2026/cve-2026-42945-_-nginx-_-ho/Accessing Bitbucket through a test K8s clusterhttps://purpleshift.io/purple/2026-05-13-lfym/Wed, 13 May 2026 08:10:53 +0000https://purpleshift.io/purple/2026-05-13-lfym/Kubernetes API can reveal many secrets without authenticationNew NTLM audit events help to detect coercing attackshttps://purpleshift.io/purple/2026-05-08-biat/Fri, 08 May 2026 09:48:48 +0000https://purpleshift.io/purple/2026-05-08-biat/A chain of events 4023 and 4021 from the same IP address means an attackLLM for pentesting: speed isn't everythinghttps://purpleshift.io/purple/2026-05-05-ugbv/Tue, 05 May 2026 06:11:28 +0000https://purpleshift.io/purple/2026-05-05-ugbv/We found out which local LLMs are better at finding vulnerabilitiesPentesting by AI: Local LLMs Benchmarkhttps://purpleshift.io/articles/2026-05-05-llm-pentesting/Mon, 04 May 2026 00:00:00 +0000https://purpleshift.io/articles/2026-05-05-llm-pentesting/Comparative analysis of multiple LLMs in their ability to uncover vulnerabilitiesCopyFail: Decade-old kernel flaw in all Linux distributionshttps://purpleshift.io/purple/2026-04-30-vtqo/Thu, 30 Apr 2026 13:44:42 +0000https://purpleshift.io/purple/2026-04-30-vtqo/Severe vulnerability allows an unprivileged user to gain rootPhantomRPC: A new method for privilege escalationhttps://purpleshift.io/purple/2026-04-24-juwr/Fri, 24 Apr 2026 08:46:16 +0000https://purpleshift.io/purple/2026-04-24-juwr/Fake RPC server can impersonate the security context of the calling client, up to SYSTEMHow to make OpenClaw execute malicious commandshttps://purpleshift.io/purple/2026-04-22-vizw/Wed, 22 Apr 2026 04:47:30 +0000https://purpleshift.io/purple/2026-04-22-vizw/We found a vulnerabilty in a popular LLM agentAttacks via OpenClaw: when your LLM can make RCEhttps://purpleshift.io/articles/2026-04-21-openclaw/Tue, 21 Apr 2026 00:00:00 +0000https://purpleshift.io/articles/2026-04-21-openclaw/Following a special link, the AI agent itself will execute shell commandsPrivilege escalation on SCCM with WebClienthttps://purpleshift.io/purple/2026-04-14-irtw/Tue, 14 Apr 2026 08:10:24 +0000https://purpleshift.io/purple/2026-04-14-irtw/An attacker can take over the domain if automatic client push installation is enabled on the serverWho are the SOC and why do IS professionals need a tester?https://purpleshift.io/conf/2026/2026-04-10-olga-kuznetsova/Fri, 10 Apr 2026 00:00:00 +0000https://purpleshift.io/conf/2026/2026-04-10-olga-kuznetsova/Bruteforcing WPA 802.11r: a new module for HashCathttps://purpleshift.io/purple/2026-04-09-deve/Thu, 09 Apr 2026 07:19:17 +0000https://purpleshift.io/purple/2026-04-09-deve/Previously, pentesting tools did not work with 802.11r hashesCVE-2026-21509 | MS Office | SFBhttps://purpleshift.io/avl/2026/cve-2026-21509-_-ms-office-_-sfb/Thu, 09 Apr 2026 00:00:00 +0000https://purpleshift.io/avl/2026/cve-2026-21509-_-ms-office-_-sfb/CVE-2026-25676 | HP installer | dll hijackhttps://purpleshift.io/avl/2026/cve-2026-25676-_-hp-installer-_-dll-hijack/Thu, 09 Apr 2026 00:00:00 +0000https://purpleshift.io/avl/2026/cve-2026-25676-_-hp-installer-_-dll-hijack/CVE-2026-25747 | Apache Camel | RCEhttps://purpleshift.io/avl/2026/cve-2026-25747-_-apache-camel-_-rce/Thu, 09 Apr 2026 00:00:00 +0000https://purpleshift.io/avl/2026/cve-2026-25747-_-apache-camel-_-rce/Invisible attacks with bind mounthttps://purpleshift.io/purple/2026-04-06-oqqa/Mon, 06 Apr 2026 07:12:39 +0000https://purpleshift.io/purple/2026-04-06-oqqa/A technique much simpler than rootkit can make a malicious process invisibleIncidents 2025: MDR and IR Reporthttps://purpleshift.io/purple/2026-03-31-fusf/Tue, 31 Mar 2026 10:51:13 +0000https://purpleshift.io/purple/2026-03-31-fusf/Combining MDR and IR statistics provides a better understanding of current and emerging threatsCVE-2026-20127 | Cisco | ABhttps://purpleshift.io/avl/2026/cve-2026-20127--cisco--ab/Thu, 26 Mar 2026 00:00:00 +0000https://purpleshift.io/avl/2026/cve-2026-20127--cisco--ab/CVE-2026-25769 | Wazuh | RCEhttps://purpleshift.io/avl/2026/cve-2026-25769--wazuh--rce/Thu, 26 Mar 2026 00:00:00 +0000https://purpleshift.io/avl/2026/cve-2026-25769--wazuh--rce/Yes, we can RCE via your AI agent OpenClawhttps://purpleshift.io/purple/2026-03-24-rkdd/Tue, 24 Mar 2026 07:59:44 +0000https://purpleshift.io/purple/2026-03-24-rkdd/Overly autonomous LLM executes commands not requested by the userHow we patched PEAS and ensured Provisioninghttps://purpleshift.io/purple/2026-03-23-dcul/Mon, 23 Mar 2026 06:45:27 +0000https://purpleshift.io/purple/2026-03-23-dcul/If Exchange ActiveSync requires security policy agreement, PEAS still worksAttribution by Slang: Exposing Horabothttps://purpleshift.io/purple/2026-03-18-nffa/Wed, 18 Mar 2026 00:00:00 +0000https://purpleshift.io/purple/2026-03-18-nffa/How our MDR team investigated a Brazilian hacker attack on MexicoThe moment of controls, services, and management in cybersecurity strategieshttps://purpleshift.io/conf/2026/2026-03-17-eduardo-ovalle/Tue, 17 Mar 2026 00:00:00 +0000https://purpleshift.io/conf/2026/2026-03-17-eduardo-ovalle/Accessing services through Kuberneteshttps://purpleshift.io/purple/2026-03-11-cqoo/Wed, 11 Mar 2026 06:04:04 +0000https://purpleshift.io/purple/2026-03-11-cqoo/K8s clusters can be an interesting target during a pentestIncidents 2020-2025: Industry Statisticshttps://purpleshift.io/purple/2026-03-02-etxv/Tue, 03 Mar 2026 00:00:00 +0000https://purpleshift.io/purple/2026-03-02-etxv/What types of attacks are leading in different sectors in different years?History of Critical Incidentshttps://purpleshift.io/articles/2026-03-02-critical-incidents/Mon, 02 Mar 2026 00:00:00 +0000https://purpleshift.io/articles/2026-03-02-critical-incidents/How critical incidents of different types were distributed across industries in 2020-2025Hidden Tunnel: Proxying through WebSocket Securehttps://purpleshift.io/purple/2026-02-24-qjtc/Tue, 24 Feb 2026 05:35:02 +0000https://purpleshift.io/purple/2026-02-24-qjtc/Another story of non-standard remote accessAttack with Four Remote Access Channelshttps://purpleshift.io/purple/2026-02-19-tvxz/Thu, 19 Feb 2026 04:30:32 +0000https://purpleshift.io/purple/2026-02-19-tvxz/Attackers used Velociraptor, VS Code Tunnel, Cloudflare Tunnel, and Zoho AssistScan2hive helps upload data to Hivehttps://purpleshift.io/purple/2026-02-10-zoyf/Tue, 10 Feb 2026 06:56:04 +0000https://purpleshift.io/purple/2026-02-10-zoyf/How we improved our work with Hexway Pentest SuiteHow to detect Notepad++ attackhttps://purpleshift.io/purple/2026-02-05-kmwb/Thu, 05 Feb 2026 06:56:04 +0000https://purpleshift.io/purple/2026-02-05-kmwb/Attackers were distributing malware from Notepad++ update centerBypassing authentication in Fortinet products via SSOhttps://purpleshift.io/purple/2026-02-04-gjgx/Wed, 04 Feb 2026 08:21:47 +0000https://purpleshift.io/purple/2026-02-04-gjgx/An attacker with a FortiCloud account can log in to other users’ FortiOSImplementation of TCP transport for the Mythic agenthttps://purpleshift.io/purple/2026-01-30-saqk/Fri, 30 Jan 2026 11:41:55 +0000https://purpleshift.io/purple/2026-01-30-saqk/If Mythic agents communicate over HTTP(S), they are easy to detectCognitive Biases in SOC Analysts' Workhttps://purpleshift.io/purple/2026-01-19-akaq/Mon, 19 Jan 2026 10:52:55 +0000https://purpleshift.io/purple/2026-01-19-akaq/Anchoring effect, reasoning by analogy, and other logical errorsHuman factor in cyber defense: when the enemy is our own mindsethttps://purpleshift.io/articles/2026-01-16-mindset/Fri, 16 Jan 2026 00:00:00 +0000https://purpleshift.io/articles/2026-01-16-mindset/The most common biases that occur in SOC and how to avoid themDisabling Windows Defender via symlinkhttps://purpleshift.io/purple/2026-01-12-bmka/Mon, 12 Jan 2026 00:00:00 +0000https://purpleshift.io/purple/2026-01-12-bmka/Built-in antivirus could be switched off without any third-party softwareTop-10 posts of PurpleShift in 2025https://purpleshift.io/purple/2025-12-26-ikap/Fri, 26 Dec 2025 09:47:52 +0000https://purpleshift.io/purple/2025-12-26-ikap/We selected posts that got the most likesOverview of Industrial Cyber Threats and How to Counter Themhttps://purpleshift.io/conf/2025/2025-11-26-sergey-sidorov/Wed, 26 Nov 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-11-26-sergey-sidorov/Entry Points to the Cloudhttps://purpleshift.io/conf/2025/2025-11-13-sergey-bobrov/Thu, 13 Nov 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-11-13-sergey-bobrov/CVE-2025-7771: Antivirus Evasion Through Legitimate Driver Abusehttps://purpleshift.io/conf/2025/2025-11-10-ashley-munoz/Mon, 10 Nov 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-11-10-ashley-munoz/Attacks on Automotive Manufacturinghttps://purpleshift.io/conf/2025/2025-10-18-sergey-sidorov/Sat, 18 Oct 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-10-18-sergey-sidorov/Creating a QA process from scratchhttps://purpleshift.io/conf/2025/2025-10-17-olga-kuznetsova/Fri, 17 Oct 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-10-17-olga-kuznetsova/Offensive Security: how to turn Pentesting and RedTeaming into a strategyhttps://purpleshift.io/conf/2025/2025-10-15-vyacheslav-vasin/Wed, 15 Oct 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-10-15-vyacheslav-vasin/Ransomware attacks: Risks, Impacts, and Preventionhttps://purpleshift.io/conf/2025/2025-10-10-cristian-souza/Fri, 10 Oct 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-10-10-cristian-souza/How do we know if we are prepared to respond to current cyberattacks?https://purpleshift.io/conf/2025/2025-09-25-ashley-munoz/Thu, 25 Sep 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-09-25-ashley-munoz/Attacks on warehouse infrastructure: where robots meet humanshttps://purpleshift.io/conf/2025/2025-09-24-sergey-sidorov/Wed, 24 Sep 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-09-24-sergey-sidorov/Turn me off, Turn me onhttps://purpleshift.io/conf/2025/2025-09-17-khaydar-kabibo/Wed, 17 Sep 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-09-17-khaydar-kabibo/Collect the shadows of compromised systemshttps://purpleshift.io/conf/2025/2025-09-07-areg-baghinyan/Sun, 07 Sep 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-09-07-areg-baghinyan/Lessons Learned from the ShrinkLocker Ransomware: From Response to Detectionhttps://purpleshift.io/conf/2025/2025-07-02-cristian-souza/Wed, 02 Jul 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-07-02-cristian-souza/Hybrid SOC 2025: How AI, Automation, and Humans Defeat Cyber Threats Togetherhttps://purpleshift.io/conf/2025/2025-06-26-alexey-peshik/Thu, 26 Jun 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-06-26-alexey-peshik/Find the shadow, hunting advanced malwarehttps://purpleshift.io/conf/2025/2025-06-14-areg-baghinyan/Sat, 14 Jun 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-06-14-areg-baghinyan/Revealing LockBit's secrets: From technical analysis to tactical perspectivehttps://purpleshift.io/conf/2025/2025-06-13-eduardo-ovalle/Fri, 13 Jun 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-06-13-eduardo-ovalle/Cyber security aspects of digital tradehttps://purpleshift.io/conf/2025/2025-06-06-cristian-souza/Fri, 06 Jun 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-06-06-cristian-souza/AI-Enhanced Forensics Analysis of Web Application Attackshttps://purpleshift.io/conf/2025/2025-05-28-ahmad-zaidi-said/Wed, 28 May 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-05-28-ahmad-zaidi-said/Agentic AI Security: Managing Autonomous AI Systems in Cybersecurityhttps://purpleshift.io/conf/2025/2025-05-27-ayman-shaaban/Tue, 27 May 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-05-27-ayman-shaaban/Are we ready for the threats related to AI?https://purpleshift.io/conf/2025/2025-05-21-eduardo-ovalle/Wed, 21 May 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-05-21-eduardo-ovalle/The Art of Finding Hidden threatshttps://purpleshift.io/conf/2025/2025-05-16-ahmed-khlief/Fri, 16 May 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-05-16-ahmed-khlief/Targeted Attacks: Be Ready, Respond Smart, Recover Fasthttps://purpleshift.io/conf/2025/2025-04-28-ayman-shaaban/Mon, 28 Apr 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-04-28-ayman-shaaban/New Ransomware Ymir & Fortinet FortiClientEMS (CVE-2023-48788)https://purpleshift.io/conf/2025/2025-03-01-ashley-munoz/Sat, 01 Mar 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-03-01-ashley-munoz/AI-Driven Incident Responsehttps://purpleshift.io/conf/2025/2025-02-27-ahmad-zaidi-said/Thu, 27 Feb 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-02-27-ahmad-zaidi-said/Technologies and products for equipping the SOChttps://purpleshift.io/conf/2025/2025-02-13-sergey-soldatov/Thu, 13 Feb 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-02-13-sergey-soldatov/Dangers of AI: disinformation using ChatGPThttps://purpleshift.io/conf/2025/2025-01-28-eduardo-ovalle/Tue, 28 Jan 2025 00:00:00 +0000https://purpleshift.io/conf/2025/2025-01-28-eduardo-ovalle/About ushttps://purpleshift.io/about/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/about/CVE-2025-0282 | Ivanti | RCEhttps://purpleshift.io/avl/2025/cve-2025-0282--ivanti--rce/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-0282--ivanti--rce/CVE-2025-0411 | 7-Zip | PMFhttps://purpleshift.io/avl/2025/cve-2025-0411--7-zip--pmf/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-0411--7-zip--pmf/CVE-2025-22225 | VMware | AWhttps://purpleshift.io/avl/2025/cve-2025-22225--vmware--aw/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-22225--vmware--aw/CVE-2025-24071 | Windows File Explorer | spoofinghttps://purpleshift.io/avl/2025/cve-2025-24071---windows-file-explorer--spoofing/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-24071---windows-file-explorer--spoofing/CVE-2025-24813 | Tomcat | RCEhttps://purpleshift.io/avl/2025/cve-2025-24813--tomcat--rce/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-24813--tomcat--rce/CVE-2025-29824 | Windows | LPEhttps://purpleshift.io/avl/2025/cve-2025-29824--windows--lpe/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-29824--windows--lpe/CVE-2025-29927 | NextJs | ABhttps://purpleshift.io/avl/2025/cve-2025-29927--nextjs--ab/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-29927--nextjs--ab/CVE-2025-31644 | Big-IP | RCEhttps://purpleshift.io/avl/2025/cve-2025-31644--big-ip--rce/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-31644--big-ip--rce/CVE-2025-32433 | SSH | RCEhttps://purpleshift.io/avl/2025/cve-2025-32433--ssh--rce/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-32433--ssh--rce/CVE-2025-32463 | sudo | LPEhttps://purpleshift.io/avl/2025/cve-2025-32463--sudo--lpe/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-32463--sudo--lpe/CVE-2025-33053 | WEBDAV | RCEhttps://purpleshift.io/avl/2025/cve-2025-33053--webdav--rce/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-33053--webdav--rce/CVE-2025-33073 | MS | PEhttps://purpleshift.io/avl/2025/cve-2025-33073--ms--pe/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-33073--ms--pe/CVE-2025-34291 | Langflow | AThttps://purpleshift.io/avl/2025/cve-2025-34291--langflow--at/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-34291--langflow--at/CVE-2025-34291 | Langflow | AThttps://purpleshift.io/avl/2025/cve-2025-49113--roundcube--rce/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-49113--roundcube--rce/CVE-2025-61882 | Oracle | RCEhttps://purpleshift.io/avl/2025/cve-2025-61882--oracle--rce/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-61882--oracle--rce/CVE-2025-61884 | Oracle | IDhttps://purpleshift.io/avl/2025/cve-2025-61884--oracle--id/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-61884--oracle--id/CVE-2025-64446 | Fortiweb | PThttps://purpleshift.io/avl/2025/cve-2025-64446--fortiweb--pt/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-64446--fortiweb--pt/CVE-2025-65964 | n8n | RCEhttps://purpleshift.io/avl/2025/cve-2025-65964--n8n--rce/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-65964--n8n--rce/CVE-2025-8088 | WinRar | PThttps://purpleshift.io/avl/2025/cve-2025-8088--winrar--pt/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-2025-8088--winrar--pt/CVE-2025–55182 | RSC | RCEhttps://purpleshift.io/avl/2025/cve-202555182--rsc--rce/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve-202555182--rsc--rce/CVE‑2025‑31324 | SAP | RCEhttps://purpleshift.io/avl/2025/cve202531324--sap--rce/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve202531324--sap--rce/CVE‑2025‑42999 | SAP | RCEhttps://purpleshift.io/avl/2025/cve202542999--sap--rce/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve202542999--sap--rce/CVE‑2025‑47827 | IGEL | SBBhttps://purpleshift.io/avl/2025/cve202547827--igel--sbb/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve202547827--igel--sbb/CVE‑2025‑53770 | SharePoint | RCEhttps://purpleshift.io/avl/2025/cve202553770--sharepoint--rce/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/avl/2025/cve202553770--sharepoint--rce/Disclaimerhttps://purpleshift.io/disclaimer/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/disclaimer/Toolshttps://purpleshift.io/tools/Wed, 01 Jan 2025 00:00:00 +0000https://purpleshift.io/tools/Attacking Security Researchers via Visual Studiohttps://purpleshift.io/articles/2025-05-01-attacking-security-researchers-via-visual-studio/Fri, 05 Jul 2024 00:00:00 +0000https://purpleshift.io/articles/2025-05-01-attacking-security-researchers-via-visual-studio/A new technique to exploit VS IDE using SUO filesCVE-2024-1086 | Linux-kernel | LPEhttps://purpleshift.io/avl/2024/cve-2024-1086--linux-kernel--lpe/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-1086--linux-kernel--lpe/CVE-2024-1512 | WordPress | SQLhttps://purpleshift.io/avl/2024/cve-2024-1512--wordpress--sql/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-1512--wordpress--sql/CVE-2024-21412 | SmartScreenhttps://purpleshift.io/avl/2024/cve-2024-21412--smartscreen/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-21412--smartscreen/CVE-2024-21413 | Outlook | RCEhttps://purpleshift.io/avl/2024/cve-2024-21413--outlook--rce/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-21413--outlook--rce/CVE-2024-23113 CVE-2024-47575 | Fortinet | LPE-RCEhttps://purpleshift.io/avl/2024/cve-2024-23113-cve-2024-47575--fortinet--lpe-rce/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-23113-cve-2024-47575--fortinet--lpe-rce/CVE-2024-24919 | Check Point SVN | AFRhttps://purpleshift.io/avl/2024/cve-2024-24919--check-point-svn--afr/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-24919--check-point-svn--afr/CVE-2024-25600 | WordPress | RCEhttps://purpleshift.io/avl/2024/cve-2024-25600--wordpress--rce/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-25600--wordpress--rce/CVE-2024-30088 | Windows kernel | AMWhttps://purpleshift.io/avl/2024/cve-2024-30088--windows-kernel--amw/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-30088--windows-kernel--amw/CVE-2024-32002 | Git | RCEhttps://purpleshift.io/avl/2024/cve-2024-32002--git--rce/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-32002--git--rce/CVE-2024-37404 | Ivanti | RCEhttps://purpleshift.io/avl/2024/cve-2024-37404--ivanti--rce/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-37404--ivanti--rce/CVE-2024-38063 | Windows | RCEhttps://purpleshift.io/avl/2024/cve-2024-38063--windows--rce/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-38063--windows--rce/CVE-2024-38112| MSHTML | RCEhttps://purpleshift.io/avl/2024/cve-2024-38112-mshtml--rce/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-38112-mshtml--rce/CVE-2024-38200| Windows | LPEhttps://purpleshift.io/avl/2024/cve-2024-38200-windows--lpe/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-38200-windows--lpe/CVE-2024-45409 | Gitlab | UAhttps://purpleshift.io/avl/2024/cve-2024-45409---gitlab--ua/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-45409---gitlab--ua/CVE-2024-4577 | PHP | RCEhttps://purpleshift.io/avl/2024/cve-2024-4577--php--rce/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-4577--php--rce/CVE-2024-4985 | Github | UAhttps://purpleshift.io/avl/2024/cve-2024-4985--github--ua/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-4985--github--ua/CVE-2024-50379 | Tomcat | RCEhttps://purpleshift.io/avl/2024/cve-2024-50379--tomcat--rce/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-50379--tomcat--rce/CVE-2024-6387 | OpenSSH | RCEhttps://purpleshift.io/avl/2024/cve-2024-6387--openssh--rce/Mon, 01 Jan 2024 00:00:00 +0000https://purpleshift.io/avl/2024/cve-2024-6387--openssh--rce/CVE-2023-35359 | Windows | LPEhttps://purpleshift.io/avl/2023/cve-2023-35359--windows--lpe/Sun, 01 Jan 2023 00:00:00 +0000https://purpleshift.io/avl/2023/cve-2023-35359--windows--lpe/CVE-2023-48788 | FortinetClientEMS | RCEhttps://purpleshift.io/avl/2023/cve-2023-48788--fortinetclientems--rce/Sun, 01 Jan 2023 00:00:00 +0000https://purpleshift.io/avl/2023/cve-2023-48788--fortinetclientems--rce/