Sophos X-Ops (incl. former Secureworks CTU)

https://www.sophos.com/en-us/blog

Sophos cross-team threat research. Sophos acquired Secureworks in 2025 → former Secureworks CTU research now publishes here (the legacy `secureworks-ctu` source ID was removed 2026-05-08 to avoid duplication). The sophos.com domain occasionally serves a 503 to non-browser TLS fingerprints; if WebFetch fails, retry once before falling back to https://news.sophos.com/en-us/category/x-ops/ . (v2.55: rss_url verified — use `python3 tools/fetch_source.py feed https://www.sophos.com/en-us/blog/feed?id=blt6f15f4f7deaf4242 [N]`) | 2026-06-01: feed silent / prior 503 (rotation-priority unrecovered) | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → rss: python3 tools/fetch_source.py feed https://www.sophos.com/en-us/blog/feed?id=blt6f15f4f7deaf4242 5 — clean dated entries; then WebFetch per-article /en-us/blog/{slug} for body.. AVOID: Don't WebFetch the sophos.com root first — it has 503'd on non-browser TLS fingerprints. The documented feed is the reliable entry; it has recovered from the 2026-06-01 silent/503 state noted in sources.json..