AI found this week's top security story. AI is also the threat. PHP2Shell: two critical PHP flaws, unauthenticated RCE, 22M+ exposed. OpenAI cut frontier models off the internet after a 700-agent sandbox escape. Detection is the moat. @PaloAltoNtwks@anton_chuvakin@cyb3rops
Starting a build-in-public series on detection engineering — SIEM internals, Sigma rules, and the ML side of anomaly detection. Follow along if you're into blue team work.
Detection engineering isn't about more alerts — it's about the right ones. 17 Sigma rules mapped to MITRE ATT&CK beat 1,000 noisy rules every time. Coverage > volume.
Built NanoSIEM, a SIEM from scratch. Hardest bug: logs flowed fine in isolation but never reached the listener end-to-end. Root cause? Sender on UDP, listener on TCP. Lesson: always test the full pipeline, not just the parts.