Cybersecurity blog
Rapid response
QuartzLine: A working PDF viewer with a backdoor insideQuartzLine is a working PDF viewer with a backdoor inside, spread in part through Google Ads. See what it does in real environments, plus IOCs.
Rapid response | 4 min read
Storm-0940 ARTEX attacks: ConnectWise app abuse and Okta sign-upsStorm-0940 used ARTEX AI agents to abuse ConnectWise apps and Okta self-registration. Get the IOCs, detection guidance, and steps to take now.
Rapid response | 5 min read
Php2Shell PHP vulnerabilities: Unauthenticated RCE and fixesPhp2Shell is a pair of critical PHP RCE flaws that let attackers run code without logging in. Expel analyzed it in October 2026. Includes patch versions, detection guidance, and mitigations.
Current events | 4 min read
Take the practice exam first: 5 tips for acing security certificationsRusty Newton shares a science-backed way to study for security certs: start with the practice exam, quiz yourself, study in short bursts, and plan exam day.
MDR | 5 min read
Context is king in the new SecOps eraAI made speed cheap, and in the context era, SOCs win or lose on the quality of their calls.
Rapid response | 7 min read
QuartzLine: A working PDF viewer with a backdoor insideQuartzLine is a working PDF viewer with a backdoor inside, spread in part through Google Ads. See what it does in real environments, plus IOCs.
Current events | 2 min read
Patch Tuesday: October 2026 (Expel’s version)Microsoft's October release is the largest in its history with 1,414 CVEs. Two of them are zero-days already exploited in the wild, so patch ASAP.
Current events | 2 min read
This cybersecurity awareness month, skip the phishing test—play a game insteadSkip another phishing test this cybersecurity awareness month. Download Oh Noes!, Expel's free incident response tabletop game, no form required.
Product | 2 min read
What we built: September 2026In September 2026, Expel's product team launched one new Ruxie power-up and one new threat hunt. Learn more about each here.
MDR | 4 min read
Why three security leaders still won’t let AI make the callThree SOC leaders from Riot Games, Markel, and ZoomInfo explain why adding AI to your SOC isn't a one-size-fits-all solution.
Security operations | 4 min read
“Are we secure against AI agents?” is a question we couldn’t answer wellExplore a strategic risk model CISOs can use for AI: six control planes that show where you can act, and ten risk domains that show where risk surfaces.
Data & research | 3 min read
AI-augmented, still human-led: What changed in the 2026 Gartner Market Guide for Managed Detection and ResponseThe Gartner 2026 MDR insights added "AI-augmented" to the definition and kept the human-led requirement. Here's what changed.
Expel culture | 4 min read
Meet the Expletive: Todd Bane, Director of Professional ServicesMeet Todd Bane, Director of Professional Services at Expel. He came up through bank IT and the Pentagon, and he restores tractors.