Elastic

Stop rebuilding Grafana dashboards during migrations. You can migrate Grafana dashboards into Kibana using Claude, while keeping the original PromQL queries intact. That means: •Keep your Prometheus metrics flowing into Elastic via Remote Write •Import existing dashboards instead of recreating them •Continue using familiar PromQL queries •Start exploring immediately Migration shouldn't mean starting from scratch.

A pre-authentication remote code execution vulnerability in WordPress Core is being actively exploited. We ran the Icex0 PoC end-to-end with Elastic Defend and traced every stage. On the host, every run ends the same way: the web server writes PHP under wp-content/plugins/, then spawns a shell. wp2shell (CVE-2026-63030 and CVE-2026-60137) requires no login and no vulnerable plugins. Proof-of-concept tools hit GitHub within hours of disclosure on July 17. We are seeing active scanning and exploitation in customer telemetry. 4 rules caught it: - Payload Execution by Web Server: EDR, kills the shell on launch - PHP File Creation in WordPress Plugin Directory: catches the drop before execution - Suspicious Command Execution via Web Server: flags discovery commands from the web parent - Unusual Command Execution via Web Server: alerts on command lines the host has never run The PoC self-cleans after running. A missing plugin folder doesn't mean a clean host. Hunt the indicators of compromise while stock tooling is unchanged. The behavioral detection rules are what survive when attackers rename their tools. Full rule walkthrough, process lineage, and Attack Discovery correlation from Ruben Groenewoud and Bryan Porras: https://go.es.io/4wqvWAE

We just released nightMARE v0.18.0, our reverse-engineering library powered by Rizin. This release adds the TELEPUZ string decryption algorithm from the research below. You can check out the code here: https://lnkd.in/e_hmVc4V

If every alert requires a second query before action can be taken, the pipeline is incomplete. That's the problem Visa's cybersecurity engineering team set out to solve while migrating from a legacy SIEM to Elastic. One high-stakes mainframe detection used to take analysts 10–20 minutes to triage. They'd manually run a follow-up search to identify the user behind the activity, and results varied depending on how familiar they were with mainframe logs. Now a single Elastic Workflows pipeline handles detection, enrichment, AI validation, and delivery, cutting that time to seconds. The AI verifies the data and writes the summary. The engineer still owns the call, which is what makes it safe to run in a regulated environment. See how Visa built it and the pattern it's applying next → https://lnkd.in/eYxc3GUW

28 AI models that install and run fully offline. Jina AI by Elastic now ships self-contained on-prem bundles. Pre-composed Docker containers or full local dependency install, for air-gapped, firewalled, and isolated systems. Embedding and reranking models you can't lose access to, on hardware you control. Hardware sizing, supported models, and use-case breakdown: https://go.es.io/4b702k2

Elastic just earned the Amazon Web Services (AWS) AI Security Distinction in the AWS Security Competency. AWS grants this to an exclusive set of partners who can rigorously demonstrate technical depth, proven customer outcomes, and third-party proof in AI and security efficacy. With the Elastic 9.4 release, even more AI security capabilities are now generally available. Elastic Workflows automates triage and response where security data lives. Attack Discovery and Elastic Agent Builder surface findings and act on them, including prompt injection, agent manipulation, and RAG data poisoning. See how Elastic Security works on AWS → https://go.es.io/45flKyT

Elastic has entered into an agreement to acquire Deductive AI, an AI-powered investigation platform. As applications become more distributed and complex, engineering teams are dealing with more telemetry than ever before. Understanding what happened, why it happened, and what to do next often means pulling together information from multiple systems, with too much of the investigation still done manually. Deductive AI has built an AI SRE agent that connects code, telemetry, and organizational knowledge to investigate alerts and production issues. It gathers evidence, tests hypotheses, and continuously learns from every investigation to help teams identify root causes faster. Bringing these capabilities together advances our vision for AI-driven investigations in Elastic Observability. By combining Elastic's ability to infer meaningful entities, relationships, and operational events from telemetry with Deductive AI's investigation engine and knowledge graph, we'll help users investigate issues with richer context, identify root causes faster, and spend less time on manual investigation. We’re looking forward to sharing more as we bring these capabilities into Elastic Observability. Read more: https://go.es.io/4b4heXr

We're introducing Elasticsearch Columnar Mode: A new index mode that stores data once, in columnar form, with no redundant copies and no indexes the workload doesn't need. Not replacing the document model. Adding a second way to organise data alongside it, for the workloads where columnar is the right shape: logs, telemetry, metrics, security events, AI retrieval. One platform for search and analytics at the same level, on the same data. Tech Preview in 9.5, GA in 9.6. Full deep dive on why Elasticsearch is going columnar, what Columnar Mode changes, and what it doesn't: https://go.es.io/4fbQdDS

Trust what you can verify. At Black Hat USA 2026, see the actual mechanics behind every AI-driven decision, not just the results. See the prompts. Inspect the queries. Edit the workflows. Verify every decision. That's how trust in AI gets earned. Open detection rules. Open schema. Open agentic frameworks. Run any model, including on-prem. Backed by Elastic Security Labs Threat Command research, built into the platform. Elastic shows its work. Booth #3444, Aug 1–6, Mandalay Bay. https://go.es.io/4vyLdyd #BHUSA

Elastic Security Labs uncovered a bank fraud operation targeting financial organizations in Mexico that used AI-generated malware. Axios featured the research as part of a broader look at how AI is beginning to appear in real-world cybercrime activity beyond isolated experiments and proofs of concept. The full coverage: https://go.es.io/4fb4QHH