Jutsu Blog: Insights for the AI-Native SOC

Research, playbooks, and product updates from the team building autonomous security operations.

All articles

PHP2Shell: Two Critical PHP Flaws and the Old PHP Nobody Can Patch, PHP2Shell lets attackers run code on unpatched PHP servers. What CVE-2026-109618 and 109619 do, which versions are fixed, and why old PHP is the real risk.
Security Tools Guide for Startups (2026), Startups rarely fail to buy a security tool because they have never heard of one. They struggle because every vendor sounds essential, budgets are limited, and no one wants to discover a missing control during a customer security review. The answer is not to buy everything. It is to choose tools around the risks you […]
SOC 2 Startup Checklist (2026) 24 Steps to Audit Readiness, SOC 2 readiness is not a document you create once. It is a set of controls your startup can prove it operated. Before an auditor asks for evidence, someone on your team needs to know what the control does, who owns it, how often it runs and where its dated records live. This practical checklist […]
SOC 2 Cost Guide (2026): Audit Fees, Hidden Costs and Startup Budget, How much does SOC 2 cost in 2026? For many startups, the independent CPA audit is only one part of the budget. Published guidance puts a typical audit fee at $10,000–$50,000, while a first-year program can reach $80,000 or more once you add readiness work, security tools, a penetration test, remediation and staff time. Your […]
SOC 2 Compliance Checklist for Startups, A SOC 2 audit evaluates whether a company’s security controls are suitably designed and, for a Type 2 report, whether they operated effectively throughout a defined period. This checklist covers each stage of preparation, from defining the scope through the final audit.
Jutsu vs Blumira: Features, Pricing and SOC 2, Jutsu vs Blumira compared on features, pricing, and SOC 2 support. See which fits a cloud startup, an IT team, or an MSP. Sources checked Oct 2026.
ConnectWise Breach: How One App Exposed 173 Microsoft 365 Accounts, Attackers used a stolen ConnectWise credential to sign in to the Microsoft 365 accounts of 173 companies without a password or MFA. Learn what to check in your own accounts before a vendor breach reaches you.
How to Set Up SOC 2 and ISO 27001 in Jutsu: A Step-by-Step Guide, A screenshot-by-screenshot guide to Jutsu Compliance: setup, policies, evidence, daily checks, your readiness score and the audit, from an empty workspace.
How to Choose a SOC 2 Auditor, A SOC 2 audit must be performed and signed by a licensed CPA firm, and the firm you choose matters nearly as much as the report itself.
Why Startups Need a SOC 2 Gap Analysis Tool (vs a Consultant or Spreadsheet), A SOC 2 gap analysis costs $0 in a spreadsheet, $5,000+ from a consultant, or $12,000+ a year in a tool. Why the tool still wins for a startup.
The 7 Ways Attackers Get Into Startups — And How to Stop Them, Startups move quickly. Almost every day, new employees join, cloud accounts are made, code is submitted, and new technologies are integrated. That pace is amazing, but it also provides openings for attackers. What is the good news? You do not need a large security staff to lower your risk. You must identify and safeguard the […]
The gap between agent access and oversight, By Ayu, Cybersecurity Operations, Jutsu AI agents are not news anymore. They triage tickets, write code, browse the web, and run in half the tools your company pays for. What I keep noticing is how little has changed about the way they get access. This week gave a pretty clear picture of what that looks […]
We Made the Jutsu Console Twice as Fast by Deleting Work Nobody Asked For, Pages usable in half the time, 73% less JavaScript, 73% less ClickHouse time, and flat load times up to 5M events. Here’s what was slow and how we fixed it.
OpenAI Halved ChatGPT Pro. Unlimited AI Was Never Going to Last, OpenAI’s $200 Pro plan now includes half the usage. Why flat-rate AI was always going to end, and how to stop rationing from turning into shadow AI.
OpenClaw Prompt Injection: Attacks, Fixes, and Hardening, Researchers made OpenClaw run attacker code and leak secrets. Here is how the attacks worked, what OpenClaw fixed, and how to harden any AI agent.
The Gentlemen Ransomware: TTPs, Detection, and Defense, The Gentlemen ransomware now lists nearly 900 victims. Here is how it breaks in and spreads like a worm, mapped to ATT&CK, and where to catch it.
npm v12 Disables Install Scripts: What It Stops and Misses, npm v12 blocks dependency install scripts by default. Learn what changed, what breaks, how to allowlist safely, and which supply chain attacks it misses.
A Clean Automated Pentest Doesn’t Mean You’d See the Attack, Automated penetration testing shows whether attackers can get in, not whether you would see them. Here is how detection validation closes that gap.
Swivel Chair SOC: The Risk Hiding Between Your Tools, Copying data between SIEM, EDR, identity, and ticket tools slows response. Learn how to measure swivel chair work in your SOC and close the handoff gaps.

CybersecurityOct 22, 2026

PHP2Shell: Two Critical PHP Flaws and the Old PHP Nobody Can Patch

PHP2Shell lets attackers run code on unpatched PHP servers. What CVE-2026-109618 and 109619 do, which versions are fixed, and why old PHP is the real risk.

Cybersecurity

Security Tools Guide for Startups (2026)

Oct 22, 2026

Compliance

SOC 2 Startup Checklist (2026) 24 Steps to Audit Readiness

Oct 22, 2026

Compliance

SOC 2 Cost Guide (2026): Audit Fees, Hidden Costs and Startup Budget

Oct 22, 2026

Subscribe to our newsletter

Get the latest security tips, product updates, and news delivered to your inbox.