https://seclab.cyshield.com/categories/article/Recent content in Article on Cyshield SeclabHugo -- gohugo.ioen© 2026 Cyshield.Mon, 05 Oct 2026 00:00:00 +0000https://seclab.cyshield.com/posts/detection-or-proof-rethinking-the-central-question-behind-wafs/Mon, 05 Oct 2026 00:00:00 +0000https://seclab.cyshield.com/posts/detection-or-proof-rethinking-the-central-question-behind-wafs/This paper challenges the idea that WAFs should rely primarily on attack detection. It proposes a risk-based architecture where lower-risk endpoints use detection and anomaly analysis, while high-risk functions require validation of structure, authorization, context, and business logic. The paper concludes that effective WAF security is fundamentally a risk-routing problem.https://seclab.cyshield.com/posts/securing-the-ran-4-operationalizing-from-security-standards-to-operational-defense/Tue, 22 Sep 2026 00:00:00 +0000https://seclab.cyshield.com/posts/securing-the-ran-4-operationalizing-from-security-standards-to-operational-defense/A practical guide to operationalizing RAN security through base-station hardening, secure cryptographic and key-management practices, proactive threat detection, telemetry analysis, interface protection, and Zero Trust principles across 5G and O-RAN environments.https://seclab.cyshield.com/posts/addressing-modern-soc-challenges-with-agentic-approaches/Thu, 10 Sep 2026 00:00:00 +0000https://seclab.cyshield.com/posts/addressing-modern-soc-challenges-with-agentic-approaches/Modern SOCs are under increasing pressure from alert overload, fragmented investigations, scattered expertise, and complex incident coordination. This article explores how Agentic SOCs use AI agents to connect and streamline the security lifecycle, from alert triage and investigation to response and reporting, while preserving context, reducing repetitive work, and keeping human analysts focused on critical security decisions.https://seclab.cyshield.com/posts/securing-the-ran-3-security-in-standardization-evolution-from-3g-to-5g-advanced/Sun, 23 Aug 2026 00:00:00 +0000https://seclab.cyshield.com/posts/securing-the-ran-3-security-in-standardization-evolution-from-3g-to-5g-advanced/How 3GPP has systematically hardened RAN security from 3G through 5G-Advanced, from SUCI encryption defeating IMSI catchers to Zero Trust O-RAN interfaces and next-gen protections for IoT, sensing, and satellite networks.https://seclab.cyshield.com/posts/the-invisible-attack-surface-what-vulnerability-scanners-are-not-telling-you/Sun, 09 Aug 2026 00:00:00 +0000https://seclab.cyshield.com/posts/the-invisible-attack-surface-what-vulnerability-scanners-are-not-telling-you/Traditional vulnerability scanners only see known assets, leaving unknown systems and exposures invisible. As cloud, APIs, and third-party services expand the attack surface, continuous discovery becomes critical. This post shows how Attack Surface Management fills that gap by uncovering hidden risks before attackers do.https://seclab.cyshield.com/posts/waf-evasion-101-how-attackers-bypass-security-gates/Mon, 27 Jul 2026 00:00:00 +0000https://seclab.cyshield.com/posts/waf-evasion-101-how-attackers-bypass-security-gates/Attackers reshape the same malicious payload just enough that the WAF no longer recognizes it, while the backend still executes it exactly as intended. This post walks through the real evasion playbook (encoding tricks, token splitting, noise injection, and reinforcement-learning-driven automated probing) and shows why the problem is structural, not a matter of sloppy engineering.https://seclab.cyshield.com/posts/why-high-accuracy-can-still-mean-bad-security/Sun, 12 Jul 2026 00:00:00 +0000https://seclab.cyshield.com/posts/why-high-accuracy-can-still-mean-bad-security/High accuracy in security does not guarantee real-world protection. Through the WAMM research study, this post examines what accuracy metrics hide, how false positives and false negatives manifest in production environments, and what a security-grade evaluation framework should actually measure.https://seclab.cyshield.com/posts/augmenting-security-datasets-a-technical-methodology-for-modern-threat-simulation/Wed, 08 Jul 2026 00:00:00 +0000https://seclab.cyshield.com/posts/augmenting-security-datasets-a-technical-methodology-for-modern-threat-simulation/A comprehensive enhancement of the SR-BH 2020 dataset for WAF training, combining LLM-assisted labeling, diverse benign traffic, and targeted attack injection to improve training data quality.https://seclab.cyshield.com/posts/securing-the-ran-2-attacks-on-the-radio-interface/Mon, 29 Jun 2026 00:00:00 +0000https://seclab.cyshield.com/posts/securing-the-ran-2-attacks-on-the-radio-interface/This post explores different attack surfaces, attack vectors, and attack scenarios across the RAN, explaining categories of threats and attacker TTPs supported by attack flow illustrations.https://seclab.cyshield.com/posts/can-ai-detect-web-attacks-better-than-rules/Tue, 16 Jun 2026 00:00:00 +0000https://seclab.cyshield.com/posts/can-ai-detect-web-attacks-better-than-rules/The real challenge is not choosing rules or AI, but designing detection systems that can operate under uncertainty and adversarial pressure. This article examines web attack detection and WAF evasion through scientific research and real-world observations.https://seclab.cyshield.com/posts/sbom-demystified-a-practical-guide-to-software-supply-chain-transparency/Tue, 12 May 2026 00:00:00 +0000https://seclab.cyshield.com/posts/sbom-demystified-a-practical-guide-to-software-supply-chain-transparency/Software is built like a layer cake full of libraries, packages, and hidden dependencies. But when a security crisis hits, do you really know what’s inside your code? This is where a Software Bill of Materials (SBOM) becomes essential.https://seclab.cyshield.com/posts/remote-code-execution-on-solarview-compact-firmware-a-technical-walkthrough/Mon, 27 Apr 2026 00:00:00 +0000https://seclab.cyshield.com/posts/remote-code-execution-on-solarview-compact-firmware-a-technical-walkthrough/In this post, we demonstrate how we achieved Remote Code Execution (RCE) on a web server connected to a solar system monitoring firmware: SolarView Compact. This walkthrough covers four key stages: Firmware Extraction, Reconnaissance, Code Review, and Exploitation.https://seclab.cyshield.com/posts/securing-the-ran-1-an-introduction/Thu, 09 Apr 2026 00:00:00 +0000https://seclab.cyshield.com/posts/securing-the-ran-1-an-introduction/When people talk about mobile network security, the conversation almost always gravitates toward the core network. However, there is another part of the network that quietly sits in public spaces, exposed by design: the Radio Access Network (RAN).