Sophos Endpoint
Endpoint protection with Intercept X anti-ransomware technology and EDR.
Product pageSophos
United Kingdom3 products listed
Sophos Fusion is the industry’s most complete cyber defense system. It sees everything, connects everything, and enables your defenses to respond as one.
Our summaryBritish security company offering endpoint protection, firewalls and managed detection and response. Sophos X-Ops publishes threat research.
- Products listed
- 3
- Research stories
- 24
- Incidents and advisories
- 4
- Indicators
- 13
Sophos in our news, month by month
ResearchIncidents and advisories
2
3
Jun
2
Jul
1
Aug
2
Sept
8
Oct
1
1
Nov
Products and the controls they provide
Sophos MDR
Managed detection and response, 24/7, including for other vendors' tools.
Product pageSophos Firewall
Next-generation firewall with intrusion prevention.
Product pageExternal reviews
Independent tests, peer reviews and articles about Sophos. We link to them; we did not write or commission them, and nobody pays to appear here.
Research by Sophos
Stories in our coverage based on what researchers at Sophos found or reported: 24 in total.
- 2 Nov 2026Ransomware gang talked AI agents into doing much of its dirty work
Ransomware gang uses AI agents to automate network traversal and credential collection.
- 30 Oct 2026Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data
Aur0ra ransomware hackers leverage AI agents for domain admin access and data theft.
- 23 Oct 2026Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware
Public exploit code for critical PHP vulnerabilities PHP2Shell (CVE-2026-109618, CVE-2026-109619) released; attackers
- 23 Oct 2026Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Mirai botnet operators exploit PHP2Shell vulnerabilities, but no successful compromise confirmed.
- 23 Oct 2026PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet
Millions of PHP2Shell attacks observed targeting critical CVEs, with exploit development ongoing.
- 23 Oct 2026PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Attackers attempt to deploy Potassium Mirai botnet variant using PHP2Shell vulnerabilities.
- 23 Oct 2026Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
PHP2Shell vulnerabilities see rising exploitation attempts, but experts say most PoCs fail in real-world conditions.
- 21 Oct 2026China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
China-aligned Bronze Sandcastle targets Asia/Africa with Sandboxie DLL sideloading attacks since mid-2025.
- 9 Sept 2026F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Malware injects PHP web shell into memory on F5 BIG-IP APM, evading disk-based detection.
- 8 Sept 2026Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
Hackers deploy Linux rootkit on F5 BIG-IP APM devices via RCE vulnerability.
Incidents and advisories
Stories where a Sophos product had a vulnerability or was attacked, or Sophos itself was: 4 in total. Useful if you run its products.
- 3 Nov 2026UK school estate hit by 3AM ransomware in suspected AI-assisted attack
3AM ransomware affiliate targets UK school estate, encrypting 37 machines in suspected AI-assisted attack.
- 23 Jun 2026FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation
FortiBleed operation harvests 110 million credentials from FortiGate firewalls.
- 18 Jun 2026Gentlemen ransomware uses multiple EDR killers to disable defenses
Gentlemen ransomware uses multiple EDR killers to disable defenses.
- 3 Jun 2026Attackers Use AI to Automate EDR Evasion Testing
Attackers automate EDR evasion testing using Python scripts against major endpoint security products.
Indicators from these stories13 indicators · show· hide
Vendor Watch
Run Sophos?
Get an email when a new story names Sophos, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
From Sophos
Is this your company, or did we get something wrong?
Tell us what to fix on this page: a product, a description, a link or a review. We check every suggestion before changing anything, and listing stays free and editorial.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.