TL;DR Progress has fixed CVE-2026-91140, a critical Progress DataDirect vulnerability in its Autonomous REST Connector AI Model Generator agents. A crafted OpenAPI or Swagger file could run comman…

Why a patch that passes review can still leave the one hop an attacker needs wide open.

TL;DR The Argo CD project has fixed four critical security flaws, each rated 9.9 on CVSS. Three of these Argo CD vulnerabilities let a user run commands or read files inside the argocd-repo-server…

TL;DR Gitea has shipped 27 security fixes across versions 28.0.0 and 28.1.0. This Gitea security update closes server-side request forgery (SSRF) paths, an installer bug that grants admin sessions…

Why security assessments should be scoped around business risk — not generic checklists.

Someone is using a poem on GitHub to coordinate a cryptomining botnet called PoeLLM, according to Lumen’s Black Lotus Labs. Gamers, if you…

This was not a story about AI replacing security engineers. It was a demonstration of how AI becomes useful when humans refuse to give it…

Threat Modeling vs. Penetration Testing: The $80 Million Lesson From Capital One

TL;DR GitLab released versions 19.4.2, 19.3.4 and 19.2.8 on October 8, 2026, fixing 24 security issues. The worst, CVE-2026-97229, is a GitLab critical vulnerability with a CVSS score of 10.0. It …

Digital certificates are a fundamental part of internet security. They help websites establish encrypted connections, authenticate their…

Fifteen DevSecOps and application security interview questions covering what DevSecOps really means, secure development lifecycle…

No zero day exploit, no phishing. Just a trust decision nobody made on purpose, and how to close the same gap in your own pipelines.

A practitioner’s walk through SAST, DAST, manual pentesting and the OWASP checklist, and how to layer them so gaps don’t line up.

GitLab Patches a Maximum-Severity Flaw GitLab has fixed a critical vulnerability that, under certain conditions, lets attackers run arbitrary code on a server. They need no password and no user in…

How a missing RBAC policy check exposed security actions and resources to low-privileged users.

A technical walkthrough of the open-source, code-aware AI pentester — its agent architecture, its “no exploit, no report” philosophy, how…

GitHub Tightens npm Trusted Publishing Rules GitHub has changed the rules for npm trusted publishing. A new configuration that does not complete its first successful publish within 48 hours will n…

Technical debt is often discussed as an engineering problem. Outdated software, temporary workarounds, inconsistent configurations, and…

If you are attacking web targets on platforms like Hack The Box (HTB) or navigating OffSec lab environments, running a headless Docker…

I recently listened to a discussion between James Berthoty and Chris Romeo about AI pentesting and whether traditional DAST is basically…