The CRA reporting clock starts on Thursday, and most summaries of it are wrong
From 11 September, a 24-hour reporting clock applies to actively exploited vulnerabilities — including in products you shipped years ago.
Incident-Response
Rogue ScreenConnect clients: hunt the session, not the filenames
Modified ScreenConnect clients that infect every host they connect to. The durable detection is in the audit log.