Sophos provides cybersecurity software and appliances, whose vulnerabilities, advisories, and deployments can affect network defense and endpoint security.
Search across headline titles and summaries.
Background for this topic.
Sophos is a cybersecurity vendor whose products include endpoint and server protection, network firewalls, email security, cloud-based administration, and managed detection services. The tag generally covers vulnerabilities and security advisories affecting these products, as well as their detection capabilities, updates, integrations, and operational use.
Security concerns vary by deployment. Internet-facing Sophos Firewall appliances and management interfaces are high-value targets: an unpatched vulnerability or exposed administrative service can enable unauthorized access to the appliance or connected networks. Administrators should monitor Sophos advisories, apply firmware and software updates promptly, restrict management access, and use strong authentication. Sophos Central and endpoint agents also hold broad administrative authority and collect security telemetry, so compromised accounts, unsafe exclusions, faulty policy changes, or disabled agents can reduce detection and containment. During an investigation, preserve relevant endpoint and firewall logs and verify that alert forwarding and response integrations are functioning rather than assuming protection is active.
Weekly headline count for the current query.
Research of incidents by Sophos finds that phishing, brute force attacks and other identity-based threats have surpassed software vulnerabilities as means of delivering ransomware
Sophos looked at a week of its own endpoint data and found that AI coding agents such as Claude Code, Cursor, and OpenAI Codex are setting off detection rules written to catch human intruders
Analysis of chatter on underground forums by Sophos finds that hackers fear AI could take work away from them
Python scripts were used to test malware against endpoint detection and response agents from Sophos, CrowdStrike, and Windows Defender.
A threat actor used AI coding tools to build and test EDR evasion malware, Sophos finds
Sophos finds fake Claude site spreading DonutLoader and a new Beagle backdoor via DLL sideloading
UK Rollout to Link Arco's Cybersecurity Assurance With Sophos's Threat IntelligenceSophos acquired Arco to expand into cybersecurity assurance and compliance, launching a new CISO Advantage capability. The company plans a phased rollout starting in the U.K., integrating Arco’s risk and regulatory mapping platform with Sophos Central and its global threat intelligence operations.
Canadian organizations have emerged as the focus of a targeted cyber campaign orchestrated by a threat activity cluster known as STAC6565
Threat actors are abusing Velociraptor, an open-source digital forensics and incident response (DFIR) tool, in connection with ransomware attacks likely orchestrated by Storm-2603 (aka CL-CRI-1040 or Gold Salem), which is known for deploying the Warlock and LockBit ransomware
Sophos found that average ransom demands and payments fell substantially in the education sector in 2025, as recovery time and costs fell
Dark Reading Confidential Episode 9: Join us for a look around today's Dark Web, and find out how law enforcement, AI, nation-state activities, and more are reshaping the way cybercriminals conduct their dirty business online. Keith Jarvis, senior security researcher at Sophos' Counter Threat Unit joins Dark Reading's Alex Culafi for a conversation you don't want to miss.
Sophos and SonicWall have alerted users of critical security flaws in Sophos Firewall and Secure Mobile Access (SMA) 100 Series appliances that could be exploited to achieve remote code execution. The two vulnerabilities impacting Sophos Firewall are listed below - CVE-2025-6704 (CVSS score: 9.8) - An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature can lead
Experts Say MDR Services and Proactive Defense Can Break the Payment CycleAPJ organizations face a ransomware paradox: demands dropped 50% to $500,000, yet 54% paid the threat actors. The new Sophos report shows why firms continue paining, how successful negotiations work and what proactive defenses can stop attacks before encryption begins
PLUS: Crooks target hardware crypto wallets; Bad flaws in Brother printers; ,O365 allows takeover-free phishing; and more Infosec in Brief Despite warnings not to pay ransomware operators, almost half of those infected by the malware send cash to the crooks who planted it, according to infosec software slinger Sophos.…
Sophos researchers found this operation has similarities or connections to many other campaigns targeting GitHub repositories dating back to August 2022.
Someone went to great lengths to prey on the next generation of cybercrooks Sophos thinks a single person or group called "ischhfd83" is behind more than a hundred backdoored malware variants targeting novice cybercriminals and video game cheaters looking to get their hands on malicious code.…
Sophos has uncovered a scheme planting malicious code in 130+ GitHub repositories, targeting hackers and gamers
Sophos has observed DragonForce attacking rival ransomware operators including RansomHub as it seeks to expand its reach in the cybercrime marketplace
Sophos found that compromise of network edge devices, such as VPN appliances, accounted for 30% of incidents impacted SMBs in 2024
An Android malware family previously observed targeting Indian military personnel has been linked to a new campaign likely aimed at users in Taiwan under the guise of chat apps