Hunt SAWFLY and BARECLAW on BeyondTrust After CVE-2026-102764
Public Mandiant IOCs turned into lab greps: mangoapi.php, _c94mfe, ingredi_ws, /uidchanarge, zz-root-persist. Patch first. Hunt off-box logs. Rebuild if trust is gone.
threat hunting
Read Full News
Hunt PAN-OS CVE-2026-0322: Three Attacker IPs and Management Plane Logs
Authenticated root RCE on the management interface, KEV the day of disclosure, three IPs in the advisory. Here is a lab grep session so you can hunt before the jump box excuse wears thin.
Hunt FortiMail CVE-2026-104286: archive234, ld.so.preload, and Bad Base64
Fortinet published hashes, IPs, and an archive account named archive234. Here is a lab grep-and-hash session so you can find tenants who moved in before the patch.
Hunt Ivanti CVE-2026-104935 in Your Proxy Logs Before the Board Asks
URL says welcome.cgi, header says wu.cgi. That mismatch is how you hunt CVE-2026-104935 in proxy logs. Lab-only grep session with terminal screenshots.