A NEWSLETTER FROM COMMAND ZERO
The Modern SOC Briefing
What matters this week for the people who run security operations, and the executives they report to.
ISSUE 01 · OCTOBER 2026
Patched is not the same as clean
Welcome to the first issue. Each one brings one idea worth arguing about, what to hunt this week, and the numbers your board will ask for.
Quick hits
The lead: a remote access zero-day was exploited for about seven weeks before disclosure, and the patch does not undo it.
Hunt list: BeyondTrust indicators, plus four new KEV entries with fixes.
For the exec team: 40 laptop farms raided, and why hiring is now part of your attack surface.
Budget math: average budgets grew 5%, and 45% of teams got nothing new.
Agent Zero field notes: a Trojan marked Prevented, and the 15 questions it took to prove it never ran.
THE LEAD
The patch answers the wrong question
BeyondTrust disclosed CVE-2026-102764 in its self-hosted Remote Support appliance this week. Google Threat Intelligence and Mandiant tie the exploitation to a suspected PRC-nexus espionage cluster and date it to August 29. That is roughly seven weeks of access before most teams had a ticket open.
The line in the guidance that matters for how you run a SOC is easy to skim past: upgrading does not remediate prior exposure. Mandiant says any internet-reachable appliance on a vulnerable version during that window should be treated as potentially compromised until someone reviews it. Cisco made a similar point about the Secure Email Gateway flaw CISA added to KEV the same week. An attacker with root can clean up after themselves on the box, so the evidence you need lives in logs stored somewhere else.
Most vulnerability workflows close the ticket when the patch lands. For edge and remote access appliances, the patch tells you whether an attacker can get in today. Leadership will also ask whether they were already in, and what they touched. Nothing in a patch ticket answers that.
Three changes worth making this quarter:
Split the ticket. Patching and investigating become two tasks with two owners, and the investigation task has a defined end state.
Write down what "reviewed" means. Off-box logs for the full exposure window, a file integrity check against a known-good image, a diff of accounts and permissions, and a look at outbound connections. If you cannot produce those, the honest status is "patched, not reviewed."
Put exposure windows in the leadership report. Show them next to time-to-patch. A two-day patch looks different when it sits beside 48 days of exposure.
FOR THE SOC LEAD
This week's hunt list
BeyondTrust Remote Support, self-hosted, version 26.2.3 and earlier
Indicators Mandiant published for the ARMORY CASTLE activity (also tracked as WARP PANDA):
A PHP web shell in the appliance web root
A root-owned SUID copy of /bin/sh at /usr/bin/dbus-authd
A startup script adding a passwordless sudo entry to the sudoers template
bt-secrets used to try to dump the credential vault
Deleted system, web server, or application logs
Jump Item or Team permissions raised from No Access to Administrator
A SOCKS5 tunneler and HAProxy edits routing traffic to a hidden local listener
Order of operations: snapshot a suspect appliance before rebooting, rebuild from a clean image if compromised, patch, and rotate credentials after the patch. SaaS tenants were patched automatically, but Mandiant still recommends rotating credentials and reviewing configuration.
Also added to KEV this week
Palo Alto PAN-OS management interface, CVE-2026-0322. Authenticated RCE as root. No workaround, so upgrade and restrict management access to trusted internal addresses.
Cisco Secure Email Gateway, CVE-2026-76519. A crafted attachment can lead to root command execution when file reputation is on. Move to AsyncOS 16.5.0-780 or update Content Scanner Tools, then review off-device logs for unexpected uploads.
Ahsay AhsayCBS, CVE-2026-105133 and CVE-2026-105134. Chained for auth bypass and SYSTEM-level code execution, used to drop web shells and miners. The first patches were incomplete, so confirm you are on 10.3.4.45 or 9.15.2.70 and reboot.
FOR THE EXECUTIVE TEAM
Your hiring pipeline is part of the attack surface
The FBI searched 40 suspected laptop farms in Texas in late September and seized about 187 laptops and KVM devices. This week the Justice Department announced an Ohio indictment charging 14 people over a North Korean remote IT worker scheme that placed workers at more than 70 US companies across 17 states and brought in roughly $3 million. US-based facilitators kept company laptops at their own addresses and ran remote access tools so the real workers could log in from abroad. Some of those workers went after employer data and cryptocurrency once they were inside.
This sits across HR, IT, and security, which is exactly why it slips through. Three questions to put to those owners:
Who verifies a remote hire's identity and location beyond the documents they submit?
Does anyone flag a laptop shipped to an address that does not match payroll, or a "stolen device" replacement request in the first 90 days?
Would the SOC notice unapproved remote access software, or VPN and proxy logins, on a new hire's machine in week one?
Sources: BleepingComputer · The Next Web
The budget conversation, by the numbers
5%
average security budget growth this year
45%
of organizations got no increase at all
42%
of security leaders struggle to show the board a return
The IANS Research and Artico Search benchmark found that 69% of CISOs named AI for security as their top priority for any new dollars, and a separate Absolute Security survey of 1,001 CISOs found 69% do not expect AI to shrink existing headcount. KPMG's survey of 310 leaders at $1B+ companies supplies the third number: four in ten cannot clearly show ROI to their board.
Put together, flat budgets and a board asking for proof mean an AI line item has to be argued in capacity terms. Before the next budget review, measure how many analyst hours a week go to investigation, how much of that work repeats, and what the team would do with the time it gets back. That last answer is the one boards remember.
RUNNING THE TEAM
Write the new job descriptions before the tools do
Rapid7 laid out how it sees SOC roles shifting as AI takes on triage. Analysts own cases end to end and spend more time explaining response options. Detection engineers add prompt design, workflow testing, and validation of AI output to their rule writing. SOC engineers grow in number to test automated workflows and set guardrails on AI-supported decisions.
Whether or not that exact map fits your team, the shift is already happening one tool rollout at a time. If nobody writes down who owns a case, who validates an automated verdict, and who is accountable when one is wrong, the defaults will be set by whatever got deployed first. A one-page RACI for AI-assisted investigations is a reasonable Q4 project.
FROM COMMAND ZERO · FIELD NOTES FROM AGENT ZERO
Agent Zero, our autonomous security analyst, on the case.
Prevented is not the same as proven
Same idea as the lead, smaller scale. Defender flagged two Trojan detections tied to one file across four workstations and marked them Prevented. Plenty of queues would close that ticket on the word alone.
Agent Zero treated Prevented as a claim to check. It tested five hypotheses: execution, persistence, credential theft, suspicious follow-on activity, and false positive. Process and file events showed the file never ran on any of the four devices, identity logs showed no account takeover, and the PowerShell and RDP activity traced back to normal admin work. Verdict: true positive, blocked, high confidence. It also wrote down what it could not prove, which is how the file arrived. Copies in browser caches point to a drive-by download, and the write-up labels that as an inference.
Fifteen questions, 256 records across four Microsoft data sources, 2 minutes 28 seconds, and every step is in the casebook for a human to replay.
More recent write-ups from our team:
The Insider Brought an Agent
A departing engineer used an AI coding agent to take credentials, delete files, and wipe logs. How the investigation put the timeline back together.
Case File #01: 16 Logins, 7 Countries, 1 Account
Impossible travel turned out to be the weakest evidence in the case. Four other signals resolved it.
Build vs. Buy vs. Co-Manage
Hybrid SOC models that rent the engineering and keep analyst judgment in house, and where that split tends to break.
Know someone who runs a SOC or signs off on its budget? Forward this along. If someone sent it to you, you can subscribe at newsletter.commandzero.ai.
Reply and tell us what you want covered next. A person reads every reply.
The Modern SOC Briefing is written by practitioners at Command Zero. Everything above the Command Zero section is vendor-neutral.