Technical notes from the people who run pentests and operate digital risk every day — no fluff, no content dressed up as a sales pitch.
A hosting credential allowed to add domains can cross tenant boundaries and take over the server. Every hosted account, website, and database is within the blast radius.
Read article →A common CephX read permission was enough to extract the Monitor secret store, including keys capable of expanding access to every host in the cluster.
Read article →A credential obtained in 2012 was still relevant in 2016. The Dropbox case shows why time to detect, password reuse, and coordinated response belong in the same conversation.
Read article →The victim opens a link, the VS Code session receives an attacker-controlled environment variable, and the next Node.js command executes code. The click does not run the payload immediately, it prepares the terminal.
Read article →The authorization hook denied access, but the resolver could still execute, return data, and cause side effects. Understand the bypass fixed in graphql-ruby 2.6.6.
Read article →The signature and expiration were correct. Even so, a token issued for another service could pass Camel authentication because issuer and audience were not validated.
Read article →NVTabular loaded workflows with cloudpickle without restricting reconstructed classes. If an untrusted artifact reaches the pipeline, the file executes with the identity of the ML process.
Read article →CVE-2026-18577 allowed unauthenticated remote administrative access to N-central. The risk does not end at the console: the RMM already has a trusted path to endpoints.
Read article →Permission to build a workflow appeared confined to the editor. A live reference to a host prototype crossed the sandbox and reached the main n8n process.
Read article →When an agent gains tools and credentials, the conversation becomes a control plane. Learn how to limit permissions, validate inputs and outputs, and test a POC before production.
Read article →A list of CVEs with CVSS scores pasted from a scanner isn't a pentest report, it's a nice-looking PDF. Three things separate one from the other: reproducible evidence, severity adjusted to your environment, and remediation a developer can actually apply. How to spot each before you sign.
Read article →One HTTP request with no credentials at all turns into administrator access. And a Metabase administrator does not just see reports: they see the connection credentials for every database wired into the tool.
Read article →The breach is arguable. The date you learned about it and the date you reported it are not. That is why failure to notify is the cheapest violation to prove.
Read article →The service was bound to 127.0.0.1, with no port open to the internet, and an ordinary website still managed to send it a command. The security check that failed fit on a single line of code.
Read article →What grew fastest was not the attack, it was the phase that comes before it. How an attacker builds a target list without sending a single packet to your server.
Read article →A path traversal in the vCenter syslog server turns into unauthenticated code execution, and from there the attacker reaches the entire ESXi fleet. Five days was the gap between the patch and mass exploitation.
Read article →Lazarus used a fake job offer on LinkedIn to get in, and a Windows kernel zero-day to erase its own tracks before any EDR noticed. A real-world case for why local privilege escalation matters as much as remote RCE.
Read article →For study purposes: how CIH, WinNuke, Ping of Death, and other historical Windows 95 flaws worked under the hood, and why the same failure pattern still shows up in modern systems.
Read article →An unauthenticated RCE in TeamCity On-Premises, CVSS 9.8 and already under confirmed active exploitation per CISA, shows why a CI/CD server deserves the same pentest scope as a production system.
Read article →The same five failure patterns keep showing up API after API. A practical rundown of what to test before someone outside finds it first.
Read article →The moment an AI agent gets access to a tool, a file, or a shell, prompt injection stops being a chatbot trick and becomes a path to command execution. A technical overview with one confirmed real-world case.
Read article →Tell us what you need to validate and the team scopes a penetration test to match.
Ready to assess your company's risk?