We built Zeek and Suricata detections for php2shell, two serious remote code execution vulnerabilities in PHP, and released them as open source.
See how Corelight and Tenable use agentic AI to correlate network evidence with exposure data, assess blast radius, and prioritize investigations.
Corelight Labs found CVE-2026-70111 while fuzzing DFS APIs: A one-packet kernel crash that kills any affected Windows Server immediately.
Explore how existing Zeek logs can reveal suspicious NetScaler DTLS traffic associated with CVE-2026-88772, with practical searches and investigation...
Inside the Black Hat USA NOC, we found cleartext Splunk and BigFix traffic, leaky apps, and an exposed MCP server with read and write access.
See what a SOC agent does when it has real network forensics expertise behind it, from hypothesis to IDS alerts, timeline, and next steps.
Learn how to use Zeek logs and Corelight Investigator to discover Citrix NetScaler assets, monitor DTLS traffic, and hunt for zero-day exploitation...
PQC will make handshakes chunkier and cipher names weirder. What the migration changes for defenders, and why encrypted-traffic visibility still wins.
Corelight's Natural Language Query (NLQ) turns plain-English questions into working queries and runs them against your Investigator data in seconds.