Use our Zeek package to detect the affected eMudhra certificates, since devices that don’t automatically get updates remain vulnerable.
We built Zeek and Suricata detections for php2shell, two serious remote code execution vulnerabilities in PHP, and released them as open source.
Corelight Labs found CVE-2026-70111 while fuzzing DFS APIs: A one-packet kernel crash that kills any affected Windows Server immediately.
Explore how existing Zeek logs can reveal suspicious NetScaler DTLS traffic associated with CVE-2026-88772, with practical searches and investigation...
Learn how to use Zeek logs and Corelight Investigator to discover Citrix NetScaler assets, monitor DTLS traffic, and hunt for zero-day exploitation...
Core protocols like LDAP are often left unmonitored. See how Zeek's ldap_search and DNS logs expose injection canaries and confirm whether attacks...
Learn how to test Zeek packages without PCAPs by using Zeek logs and the Input Framework to reproduce bugs, analyze historical data, and prevent...
Learn how to test Zeek packages without shareable PCAPs by hand-crafting BTest events and using Zeek event traces to reliably reproduce network...
Learn how to unit test Zeek packages with BTest and assert statements, using practical examples to catch failures and build more reliable Zeek...