Bright Ideas Blog

The Supply-Chain Risk Hiding in Your MCP Servers | Corelight

James Lagermann, Director of Technical Alliances — Tue, 10 Nov 2026 23:19:03 GMT

In my last post I used an AI agent to work out the blast radius of a compromise, and the agent found something I had not been looking for: other AI agents inside the blast radius. On an administrator's workstation, AI coding assistants were running Model Context Protocol (MCP) servers that the administrator had set up, and those servers held privileged credentials for security tools and other administrative resources. Nothing on that workstation was compromised, but it raised a question: where does the code in those servers come from, and how does it get updated?

Black Hat USA 2026: Apps Leaking PII in the Clear | Corelight

Technical Marketing team member — Mon, 02 Nov 2026 20:22:33 GMT

You have likely heard the old Russian proverb: “доверяй, но проверяй.” It means “trust, but verify,” and it used to be a standard within the InfoSec community for decades. Slowly, many organizations have moved their infrastructure toward a Zero Trust Architecture, which has helped improve security postures further. But even still, unearned and unverified trust is rampant. For example, as a user of apps and devices, how much do you trust that the apps you use are secure?

Detecting Compromised eMudhra Certificates with Zeek | Corelight

Johanna Amann, Open Source Architect — Thu, 22 Oct 2026 21:31:35 GMT

This week, two big vulnerabilities are in the news. The first one is the PHP2Shell vulnerability, for which a Zeek^® detector was published yesterday. The second, equally important, vulnerability is the compromise of some intermediate certificates of the eMudhra Certificate Authority (CA).

php2shell: Zeek and Suricata Detections for PHP RCE | Corelight

Ben Reardon : Corelight Labs, Lead Security Researcher — Wed, 21 Oct 2026 13:48:03 GMT

We recently collaborated with OpenAI, PHP, and a number of other organizations to respond to a pair of serious remote code execution vulnerabilities in PHP that are likely to impact the majority of the world's public web servers. PHP underpins a large part of the web, powering content management systems, online stores, and business applications. Its security matters to vital services that millions of people and organizations rely on daily.

From Exposure to Evidence: Agentic AI and Blast Radius | Corelight

James Lagermann, Director of Technical Alliances — Tue, 20 Oct 2026 13:05:57 GMT

What if security teams could combine knowledge of which systems are vulnerable with evidence of how an attacker is actually moving through the network?

CVE-2026-70111: One-Packet Windows Server DoS via DFS | Corelight

Travis Green & Labs Team — Tue, 13 Oct 2026 23:29:54 GMT

In the process of fuzzing MS-RPC and Distributed File System (DFS) APIs, we discovered a one-packet mechanism set to crash an entire Windows server, which the Microsoft Security Response Center (MSRC) later assigned as CVE-2026-70111. Corelight customers using the Corelight Feed, a custom ruleset within our Open Network Detection and Response (NDR) Platform that’s designed to swiftly detect and help respond to emerging threats, are already automatically covered with the latest detection for exploitation attempts of this vulnerability.

Hunting Citrix NetScaler zero-days with Corelight: Part 2

Deepali Prasad, Corelight Labs, Senior Detection Engineer. — Fri, 09 Oct 2026 23:04:12 GMT

In Hunting Citrix NetScaler zero-days with Corelight, we explored how network evidence from Corelight’s Open Network Detection and Response (NDR) Platform can help identify candidate NetScaler appliances, observe DTLS use and hunt for suspicious activity. This follow-up examines a clue recorded by an existing DTLS analyzer from the Zeek® Project (a non-profit project that maintains an open-source software platform which generates compact, high-fidelity transaction logs, file content, and fully customizable outputs), and shows how defenders can use it within Corelight Open NDR to investigate potential exploitation attempts. For teams retaining the relevant analyzer logs, this investigation can extend to historical traffic—including activity recorded before the vulnerability was disclosed.

Black Hat USA 2026 NOC: Cleartext, Leaky Apps, AI Mistakes | Corelight

Mark Overholser — Fri, 09 Oct 2026 18:30:47 GMT

When I got back from Black Hat USA, I was stunned. Of course, it’s easy to be overwhelmed by Black Hat. There is so much going on. Las Vegas casinos are loud and flashy. Going outdoors feels like standing on the surface of the sun. Everywhere you walk there are strong smells, and you hope it’s a delicious meal, but sometimes it’s not. Then, once you layer Black Hat on top of it—the crowded show floor, one hundred friends you haven’t seen since the last conference stopping you in the halls to say hello, and the sound of thousands of voices all speaking simultaneously—it’s a lot to take in.

Watch what happens when your AI agent actually knows how to investigate

alyssa.ideboen@corelight.com (Alyssa Ideboen) — Tue, 29 Sep 2026 17:32:47 GMT

A SOC analyst spots suspicious activity from an internal IP. They need to understand what is happening. They open their SIEM's built-in AI assistant and type: "Tell me about 192.168.0.10."

Hunting Citrix NetScaler zero-days with Corelight

Ben Reardon : Corelight Labs, Lead Security Researcher — Mon, 28 Sep 2026 23:28:48 GMT

Citrix’s security bulletin CTX697096, the NetScaler security blog, and WatchTowr’s vulnerability FAQ describe an urgent situation for organizations using NetScaler ADC and NetScaler Gateway. Two vulnerabilities (CVE-2026-88771 and CVE-2026-88772) are known to be exploited. CISA confirms active exploitation globally and has added both to its Known Exploited Vulnerabilities catalog.