VirusTotal

Livehunt rules could see which processes ran in the sandbox, but not what spawned them. Now they can.

Every process in vt.behaviour.processes_list now includes parent_name and ancestor_names.

How we use it for hunting, with real samples and YARA rules: blog.virustotal.com/2026/10/proces…

Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), a leak before the patch and millions of PHP servers on the Internet. We used VirusTotal Internet Scanning to measure who is exposed, what they run and how to cut the window:
blog.virustotal.com/2026/10/sizing…

Internet Scanning in VirusTotal: hunting infrastructure by what it exposes
blog.virustotal.com/2026/10/intern…

From Automation to Infection (Part III): Naming, Measuring, and Detecting Malicious AI Agent Skills

blog.virustotal.com/2026/10/from-a…