SecTower Blog
Industry insights, technical guides, cheat sheets, and solutions to complex problems
One Encoded Character: How ShinyHunters Walked Back Through the PeopleSoft Door You Thought You Closed
ShinyHunters defeated PeopleSoft WAF rules with a single URL-encoded character. If your mitigation for the June vulnerability was a blocking rule rather than the patch, assume it no longer protects you.
Microsoft Moves the SIEM Into Defender: What ISOC Means for Your SOC
What Microsoft’s Integrated Security Operations Center changes for SOC teams: licensing, data retention, ingestion costs, automation, and the trade-offs for Sentinel and Splunk users.
BOD 26-04: The End of Patch-Everything, and What It Actually Takes to Comply
CISA's BOD 26-04 revokes BOD 19-02 and 22-01, replacing flat patch deadlines with a four-variable risk model and a 16-tier remediation matrix. What changed, why it matters, and how to operationalize it.
Building a SOC from Scratch: Seven Principles of Security Operations Architecture
What every CISO and security leader needs to know before spending a dollar — and the seven principles that separate resilient operations from expensive alert factories.
"Search Not Executed": Fixing the Minimum Free Disk Space Error After a Splunk ES Upgrade
After a Splunk Enterprise Security upgrade, searches stop with a minimum free disk space error. The message points at concurrency and dispatch, but the real culprit is usually an unclean /opt/splunk/etc/backup. Here is how to diagnose, fix, and prevent it.
The OSINT Framework: Turning Public Data Into Defensible Intelligence
Most security teams already do OSINT. Few do it as a framework. Here is the process model, the five collection domains, the OPSEC and legal guardrails, and how to operationalize open-source intelligence inside a SOC.
ShinyHunters' Oracle PeopleSoft Campaign: 8 Detection Use Cases Every SOC Should Deploy
Google Threat Intelligence Group recently analyzed a ShinyHunters campaign exploiting Oracle PeopleSoft. Here are eight high-value detection use cases every SOC should deploy—applicable to Splunk, Sentinel, QRadar, Elastic, Chronicle, and other SIEMs.
When One HTTP Request Is All It Takes: The ShinyHunters PeopleSoft Campaign
A SecTower threat advisory on the ShinyHunters campaign exploiting Oracle PeopleSoft zero-day CVE-2026-35273, how it worked, and what defenders should do now.
SPLUNK UBA End of Sale/End of Life
Frequently Asked Questions (FAQ)
Vulnerabilities in the Wild
Vulnerabilities in the Wild
Understanding Zero Trust Architecture: A Complete Guide
Learn how Zero Trust security models are revolutionizing enterprise cybersecurity by eliminating implicit trust and continuously validating every request.
AWS vs Azure vs GCP: Choosing the Right Cloud Platform in 2025
A comprehensive comparison of the three major cloud providers to help you make an informed decision for your organization's cloud strategy.
Kubernetes Security Best Practices Cheat Sheet
Essential security configurations and best practices every DevOps team should implement in their Kubernetes clusters.
Implementing SIEM: From Planning to Production
A step-by-step guide to planning, deploying, and operationalizing a Security Information and Event Management system.