Blog

2026's Shifting Threat Landscape: What Alert Data Reveals

The alert data has spoken: attackers are spending less time breaking in and more time operating once they're inside. Here's what Critical Start's H1 2026 Cyber Threat Intelligence Report reveals about the shift and what security leaders should do about it.

Critical Start
September 3, 2026
•
6 min read
Threat Intel

PHP2SHELL RCE Vulnerabilities

Two critical flaws in the PHP runtime (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) can let unauthenticated attackers run code on web servers, and patching alone doesn’t finish the job. Here’s what CRU recommends in the first 24 hours.
Gerard Chukwu, CTI AI Technologist
October 21, 2026
•
12 min read
Webinar

Ask our SOC anything: Alert noise and what analysts do all day Session 2

Critical Start’s senior manager of security operations answers six attendee questions, covering how SOC AI is validated by humans, why AI shifts attacker speed rather than attacker behavior, and how a 90% analyst retention rate is built.
Seth Thompson, Senior Manager, Security Operations
October 21, 2026
•
28 minutes
Blog

You Asked. Seth Answered. Live SOC Session 2 Recap

Six real customer questions, answered by Seth Thompson, Senior Manager of Security Operations. See how the SOC measures AI accuracy, what happens behind the scenes, and how analyst expertise stays in your corner.
Critical Start
October 20, 2026
•
8 min
Threat Intel

Citrix NetScaler: Active Exploitation and Critical Vulnerabilities

Three Citrix NetScaler flaws are on CISA’s KEV list, and a tenth, CVE-2026-107406, now affects builds that were supposed to be fixed. Here is what CRU found and the steps to take in the next 24 hours.
Gerard Chukwu, CTI AI Technologist
October 16, 2026
•
14 min read
Blog

You Asked. Wyatt Answered. Live SOC Session 1 Recap

Ten real customer questions, answered straight by our VP of Security Operations. See how the SOC decides what to escalate, where detection coverage gaps hide, and what separates a contained threat from one that spreads.
Critical Start
October 14, 2026
•
8 min
Webinar

Ask our SOC anything: Alert noise and what analysts do all day Session 1

Wyatt answers ten practitioner questions on when to escalate, how to close detection gaps, and why identity keeps topping the alert queue. Get an inside look at how a 24x7 SOC cuts millions of events down to a few hundred escalations.
Wyatt Quintero, VP, Security Operations
October 13, 2026
•
30 min