Upwind Story Replay is now available in Upwind: a visual timeline of the detections that led to a threat. Click a threat story, watch the attack unfold step by step.
Three Vectors in One Week
AI is accelerating everything we knew about supply chain attacks, zero-days, and finding new critical CVEs. Attacks are unfolding fast and are becoming multi-vector, across APIs, files, process execution, and identities take over. The last few days have shown us that the attack surface continues to expand with no foreseeable limits
- PHP core, CVE-2026-109618 and CVE-2026-109619. Two critical unauthenticated RCEs in PHP core, with research published before the official disclosure. Upwind had detection rules deployed before the vulnerabilities were confirmed (our analysis).
- eMudhra intermediate CA keys. The private keys of eight eMudhra intermediate CAs were recoverable from the certificates themselves, enough to sign fraudulent TLS and code-signing certificates that chain to a trusted root (what we published).
- LiteLLM 1.107.0. A poisoned PyPI release shipped a remote-code backdoor through .pth and sitecustomize.py, running on every Python start on the host (Upwind MDR Post).
- GitLab, CVE-2026-110264. An integer overflow in the regular-expression compiler, rated CVSS 10.0, that could let an unauthenticated user run code on a self-managed GitLab server. It reaches every version back to 7.0, and GitLab shipped two behavioral detections alongside the patch (what we published).
A language runtime. A trust anchor. A package registry. Over 4 vectors in one week, and each one a chain of steps rather than a single event.
AI is speeding up both the pace and the sophistication of attacks. The window between research going public and the technique being used in a production environment keeps getting shorter.
Attackers Think in Graphs
An attack is a sequence: initial access, persistence, execution, lateral movement. The stages land on different workloads and different identities, minutes or hours apart. The three incidents above are the raw material. The PHP RCEs are a way in. The eMudhra keys are a way to be trusted. The LiteLLM wheel is access, persistence, and remote code in a single install.
AI-backed attackers chain those steps faster than they were ever chained by hand, which is why a week like this one produces three usable vectors instead of one.
Understanding a threat means following the whole chain: what initiated it, what it accessed, what crumbs it left behind, where it was heading.
Upwind’s Agentic Pack already does the triage, and every threat comes with its Story: the narrative behind it in plain language, what happened, on what, and why it was raised.
What is left is the part that belongs to you.
Take in the chain fast enough to cut it, then remediate. Every second between the first detection and the decision is a second the attacker still has.
A Replay Is Worth a Thousand Investigation Hours & Words
Upwind Story Replay is a visual timeline of the detections that led to a real threat.
Click any threat Story and watch each step of the attack, the MITRE tactics, and the associated resources unfold in the order it happened.
Every detection that contributed to the threat sits on the timeline, coming together into a clear picture of the attack path.
The more complex the attack, the more a visual helps.
A dozen detections across four workloads is hard to hold in your head as a list. On a timeline, it reads at a glance: where it started, where it branched, how long the attacker had, and which step to cut first.
Inside Upwind Story Replay
What Replay Gives Analysts and CISOs
For analysts. Clarity on multi-stage threats, and a shorter path from the first detection to the remediation step that matters. The order, timing, and blast radius appear on the screen instead of in your head.
For CISOs. A clear picture of how an attack progressed, in a form you can take into a leadership briefing, a board update, or a customer call without rebuilding the story from an alert list.
Attacks are getting faster and more complex, and you have to understand the chain before you can cut it. One replay is worth a thousand words, and it turns the most complex attack into a story you can see.
Learn more about Upwind Story Replay.